Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe
-
Size
455KB
-
MD5
09e7cda1e781b1aa4d7106c8c5989ab0
-
SHA1
c6661422ee77b06b6b844644338df9dd0a172166
-
SHA256
85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74d
-
SHA512
0d26a03610b840e4224b0364e3e90b48ad3f76dfa2f4650086565b339f6118444b2b2e966df42bcf92578c496bb38def95be355e29c4eed6d374d97c0cbd1238
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2072-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-23-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2996-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2404-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-322-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-380-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1872-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-801-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-879-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3032-915-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2008-964-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1696-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1832-1030-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-1053-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-1155-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3060-1168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-1300-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/744-1313-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 bhhhnn.exe 2996 vpjpv.exe 2548 5fxfllr.exe 2128 5djjp.exe 2784 nbbhhn.exe 2404 vvddj.exe 2704 tnbhht.exe 2604 1tnnnn.exe 1592 xrlxlrr.exe 2592 vjdvd.exe 3024 3fflxlx.exe 2044 bntbnh.exe 868 5lxflrx.exe 1552 btbhnb.exe 756 dvdvv.exe 1992 nhhthb.exe 1372 vdvjd.exe 1432 rfrrxff.exe 2912 pjpvj.exe 2252 vppvd.exe 2256 bttbtt.exe 584 pjddj.exe 1140 1btbnt.exe 1316 pdpvv.exe 996 nnbhnn.exe 1376 jjdvv.exe 2312 frlrxff.exe 764 pjppv.exe 1544 rxfllff.exe 2464 tnbttt.exe 2164 1jvdj.exe 1580 5lxrxfl.exe 2932 9htbbb.exe 2936 jvjpv.exe 1928 3ffflrf.exe 2548 htnhnn.exe 2768 tnhnnn.exe 2676 dvpvd.exe 2824 rlffxfl.exe 2908 5hnnbb.exe 2916 vdvpv.exe 2748 jdpdj.exe 2736 lfrxfxx.exe 2572 nnhttb.exe 1716 nhttbt.exe 3040 9jjdv.exe 2896 frxxrrx.exe 1976 btnnbt.exe 1856 htnbnh.exe 1948 vjpjv.exe 2872 lrrfxrf.exe 1980 lrrrxxr.exe 2008 7hhnnn.exe 1428 1jddj.exe 1312 jdvvv.exe 2928 xlxxxxx.exe 1484 7btbbb.exe 1872 3ppdd.exe 1016 pdpdv.exe 1584 xrflrxl.exe 448 bnbbhb.exe 1140 5htttt.exe 1364 dpjjp.exe 1380 xrxxfxf.exe -
resource yara_rule behavioral1/memory/2072-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-322-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-801-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-854-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1832-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1044-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-1168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-1237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-1262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-1293-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2072 2376 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 30 PID 2376 wrote to memory of 2072 2376 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 30 PID 2376 wrote to memory of 2072 2376 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 30 PID 2376 wrote to memory of 2072 2376 85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe 30 PID 2072 wrote to memory of 2996 2072 bhhhnn.exe 31 PID 2072 wrote to memory of 2996 2072 bhhhnn.exe 31 PID 2072 wrote to memory of 2996 2072 bhhhnn.exe 31 PID 2072 wrote to memory of 2996 2072 bhhhnn.exe 31 PID 2996 wrote to memory of 2548 2996 vpjpv.exe 32 PID 2996 wrote to memory of 2548 2996 vpjpv.exe 32 PID 2996 wrote to memory of 2548 2996 vpjpv.exe 32 PID 2996 wrote to memory of 2548 2996 vpjpv.exe 32 PID 2548 wrote to memory of 2128 2548 5fxfllr.exe 33 PID 2548 wrote to memory of 2128 2548 5fxfllr.exe 33 PID 2548 wrote to memory of 2128 2548 5fxfllr.exe 33 PID 2548 wrote to memory of 2128 2548 5fxfllr.exe 33 PID 2128 wrote to memory of 2784 2128 5djjp.exe 34 PID 2128 wrote to memory of 2784 2128 5djjp.exe 34 PID 2128 wrote to memory of 2784 2128 5djjp.exe 34 PID 2128 wrote to memory of 2784 2128 5djjp.exe 34 PID 2784 wrote to memory of 2404 2784 nbbhhn.exe 35 PID 2784 wrote to memory of 2404 2784 nbbhhn.exe 35 PID 2784 wrote to memory of 2404 2784 nbbhhn.exe 35 PID 2784 wrote to memory of 2404 2784 nbbhhn.exe 35 PID 2404 wrote to memory of 2704 2404 vvddj.exe 36 PID 2404 wrote to memory of 2704 2404 vvddj.exe 36 PID 2404 wrote to memory of 2704 2404 vvddj.exe 36 PID 2404 wrote to memory of 2704 2404 vvddj.exe 36 PID 2704 wrote to memory of 2604 2704 tnbhht.exe 37 PID 2704 wrote to memory of 2604 2704 tnbhht.exe 37 PID 2704 wrote to memory of 2604 2704 tnbhht.exe 37 PID 2704 wrote to memory of 2604 2704 tnbhht.exe 37 PID 2604 wrote to memory of 1592 2604 1tnnnn.exe 38 PID 2604 wrote to memory of 1592 2604 1tnnnn.exe 38 PID 2604 wrote to memory of 1592 2604 1tnnnn.exe 38 PID 2604 wrote to memory of 1592 2604 1tnnnn.exe 38 PID 1592 wrote to memory of 2592 1592 xrlxlrr.exe 39 PID 1592 wrote to memory of 2592 1592 xrlxlrr.exe 39 PID 1592 wrote to memory of 2592 1592 xrlxlrr.exe 39 PID 1592 wrote to memory of 2592 1592 xrlxlrr.exe 39 PID 2592 wrote to memory of 3024 2592 vjdvd.exe 40 PID 2592 wrote to memory of 3024 2592 vjdvd.exe 40 PID 2592 wrote to memory of 3024 2592 vjdvd.exe 40 PID 2592 wrote to memory of 3024 2592 vjdvd.exe 40 PID 3024 wrote to memory of 2044 3024 3fflxlx.exe 41 PID 3024 wrote to memory of 2044 3024 3fflxlx.exe 41 PID 3024 wrote to memory of 2044 3024 3fflxlx.exe 41 PID 3024 wrote to memory of 2044 3024 3fflxlx.exe 41 PID 2044 wrote to memory of 868 2044 bntbnh.exe 42 PID 2044 wrote to memory of 868 2044 bntbnh.exe 42 PID 2044 wrote to memory of 868 2044 bntbnh.exe 42 PID 2044 wrote to memory of 868 2044 bntbnh.exe 42 PID 868 wrote to memory of 1552 868 5lxflrx.exe 43 PID 868 wrote to memory of 1552 868 5lxflrx.exe 43 PID 868 wrote to memory of 1552 868 5lxflrx.exe 43 PID 868 wrote to memory of 1552 868 5lxflrx.exe 43 PID 1552 wrote to memory of 756 1552 btbhnb.exe 44 PID 1552 wrote to memory of 756 1552 btbhnb.exe 44 PID 1552 wrote to memory of 756 1552 btbhnb.exe 44 PID 1552 wrote to memory of 756 1552 btbhnb.exe 44 PID 756 wrote to memory of 1992 756 dvdvv.exe 45 PID 756 wrote to memory of 1992 756 dvdvv.exe 45 PID 756 wrote to memory of 1992 756 dvdvv.exe 45 PID 756 wrote to memory of 1992 756 dvdvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe"C:\Users\Admin\AppData\Local\Temp\85079048fa289beda8681ef25da162ba4ed80ae947ecaceec4c6cb0b7c3fc74dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bhhhnn.exec:\bhhhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vpjpv.exec:\vpjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\5fxfllr.exec:\5fxfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5djjp.exec:\5djjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nbbhhn.exec:\nbbhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vvddj.exec:\vvddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\tnbhht.exec:\tnbhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1tnnnn.exec:\1tnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xrlxlrr.exec:\xrlxlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\vjdvd.exec:\vjdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\3fflxlx.exec:\3fflxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\bntbnh.exec:\bntbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\5lxflrx.exec:\5lxflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\btbhnb.exec:\btbhnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\dvdvv.exec:\dvdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\nhhthb.exec:\nhhthb.exe17⤵
- Executes dropped EXE
PID:1992 -
\??\c:\vdvjd.exec:\vdvjd.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rfrrxff.exec:\rfrrxff.exe19⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pjpvj.exec:\pjpvj.exe20⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vppvd.exec:\vppvd.exe21⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bttbtt.exec:\bttbtt.exe22⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pjddj.exec:\pjddj.exe23⤵
- Executes dropped EXE
PID:584 -
\??\c:\1btbnt.exec:\1btbnt.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\pdpvv.exec:\pdpvv.exe25⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nnbhnn.exec:\nnbhnn.exe26⤵
- Executes dropped EXE
PID:996 -
\??\c:\jjdvv.exec:\jjdvv.exe27⤵
- Executes dropped EXE
PID:1376 -
\??\c:\frlrxff.exec:\frlrxff.exe28⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pjppv.exec:\pjppv.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\rxfllff.exec:\rxfllff.exe30⤵
- Executes dropped EXE
PID:1544 -
\??\c:\tnbttt.exec:\tnbttt.exe31⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1jvdj.exec:\1jvdj.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5lxrxfl.exec:\5lxrxfl.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9htbbb.exec:\9htbbb.exe34⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jvjpv.exec:\jvjpv.exe35⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3ffflrf.exec:\3ffflrf.exe36⤵
- Executes dropped EXE
PID:1928 -
\??\c:\htnhnn.exec:\htnhnn.exe37⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tnhnnn.exec:\tnhnnn.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:2676 -
\??\c:\rlffxfl.exec:\rlffxfl.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5hnnbb.exec:\5hnnbb.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vdvpv.exec:\vdvpv.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jdpdj.exec:\jdpdj.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfrxfxx.exec:\lfrxfxx.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nnhttb.exec:\nnhttb.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhttbt.exec:\nhttbt.exe46⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9jjdv.exec:\9jjdv.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\frxxrrx.exec:\frxxrrx.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\btnnbt.exec:\btnnbt.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\htnbnh.exec:\htnbnh.exe50⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vjpjv.exec:\vjpjv.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lrrrxxr.exec:\lrrrxxr.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7hhnnn.exec:\7hhnnn.exe54⤵
- Executes dropped EXE
PID:2008 -
\??\c:\1jddj.exec:\1jddj.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jdvvv.exec:\jdvvv.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe57⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7btbbb.exec:\7btbbb.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3ppdd.exec:\3ppdd.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pdpdv.exec:\pdpdv.exe60⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrflrxl.exec:\xrflrxl.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\bnbbhb.exec:\bnbbhb.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\5htttt.exec:\5htttt.exe63⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dpjjp.exec:\dpjjp.exe64⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xrxxfxf.exec:\xrxxfxf.exe65⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nnthbn.exec:\nnthbn.exe66⤵PID:2496
-
\??\c:\3djpd.exec:\3djpd.exe67⤵PID:2192
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe68⤵PID:1660
-
\??\c:\llxfrxl.exec:\llxfrxl.exe69⤵PID:2272
-
\??\c:\hhntth.exec:\hhntth.exe70⤵PID:1512
-
\??\c:\pjpdd.exec:\pjpdd.exe71⤵PID:1820
-
\??\c:\lxrrrrx.exec:\lxrrrrx.exe72⤵PID:2120
-
\??\c:\rfrrrlr.exec:\rfrrrlr.exe73⤵PID:1608
-
\??\c:\btbbbh.exec:\btbbbh.exe74⤵PID:2488
-
\??\c:\vvjjj.exec:\vvjjj.exe75⤵PID:1788
-
\??\c:\ffxfffr.exec:\ffxfffr.exe76⤵PID:2932
-
\??\c:\lxllxxl.exec:\lxllxxl.exe77⤵PID:2936
-
\??\c:\bnbhnn.exec:\bnbhnn.exe78⤵PID:1928
-
\??\c:\ppvjv.exec:\ppvjv.exe79⤵PID:2128
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe80⤵PID:2032
-
\??\c:\rflxrfr.exec:\rflxrfr.exe81⤵PID:2404
-
\??\c:\bnhhnn.exec:\bnhhnn.exe82⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\ddvdd.exec:\ddvdd.exe83⤵PID:2664
-
\??\c:\xrlfxxf.exec:\xrlfxxf.exe84⤵PID:2744
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe85⤵PID:2620
-
\??\c:\ttntbh.exec:\ttntbh.exe86⤵PID:2588
-
\??\c:\pjdvv.exec:\pjdvv.exe87⤵PID:3060
-
\??\c:\rlllrlx.exec:\rlllrlx.exe88⤵
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\xlllrxf.exec:\xlllrxf.exe89⤵PID:2816
-
\??\c:\bnbhhn.exec:\bnbhhn.exe90⤵PID:2044
-
\??\c:\vjpdd.exec:\vjpdd.exe91⤵PID:1564
-
\??\c:\vjpjj.exec:\vjpjj.exe92⤵PID:2808
-
\??\c:\llxxxff.exec:\llxxxff.exe93⤵PID:2388
-
\??\c:\tnhhnh.exec:\tnhhnh.exe94⤵PID:2080
-
\??\c:\dpvdd.exec:\dpvdd.exe95⤵PID:2004
-
\??\c:\vvjjp.exec:\vvjjp.exe96⤵PID:2012
-
\??\c:\lxrrrrl.exec:\lxrrrrl.exe97⤵PID:1912
-
\??\c:\bnhtth.exec:\bnhtth.exe98⤵PID:3004
-
\??\c:\3pvdj.exec:\3pvdj.exe99⤵PID:2912
-
\??\c:\djpvd.exec:\djpvd.exe100⤵PID:2268
-
\??\c:\1ffrxxr.exec:\1ffrxxr.exe101⤵PID:2088
-
\??\c:\9nhntb.exec:\9nhntb.exe102⤵PID:1480
-
\??\c:\9nhbnn.exec:\9nhbnn.exe103⤵PID:1088
-
\??\c:\djvjj.exec:\djvjj.exe104⤵PID:1108
-
\??\c:\lfrxfff.exec:\lfrxfff.exe105⤵PID:448
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe106⤵PID:2204
-
\??\c:\1btbbb.exec:\1btbbb.exe107⤵PID:1096
-
\??\c:\vjvdd.exec:\vjvdd.exe108⤵PID:996
-
\??\c:\vjddd.exec:\vjddd.exe109⤵PID:2412
-
\??\c:\9xrxxfl.exec:\9xrxxfl.exe110⤵PID:1672
-
\??\c:\nnhhhh.exec:\nnhhhh.exe111⤵PID:2168
-
\??\c:\hbnnbh.exec:\hbnnbh.exe112⤵PID:2468
-
\??\c:\5pvvd.exec:\5pvvd.exe113⤵PID:764
-
\??\c:\pdjjd.exec:\pdjjd.exe114⤵PID:2308
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe115⤵PID:552
-
\??\c:\nhtbnn.exec:\nhtbnn.exe116⤵PID:2156
-
\??\c:\ttnhtt.exec:\ttnhtt.exe117⤵PID:1608
-
\??\c:\pdvvd.exec:\pdvvd.exe118⤵PID:1580
-
\??\c:\frxrrll.exec:\frxrrll.exe119⤵PID:2104
-
\??\c:\lxlrfll.exec:\lxlrfll.exe120⤵PID:2932
-
\??\c:\hhbhtn.exec:\hhbhtn.exe121⤵PID:2936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-