Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe
-
Size
455KB
-
MD5
c32fb4b5c8b7eb2ccfcfdb0b81e7495d
-
SHA1
706fb9bbf421211619d15cd3507eae7d07026923
-
SHA256
018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43
-
SHA512
b0d33c8a8fd653f66954c21a583d7cb152322011f641c90a1019a922ea03882448b65f6c6eb7cdf308c162bc2336da73fb62ef879901bcd72029a60fe4a12eeb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1976-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-337-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2684-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-339-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2580-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-368-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-587-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1448-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-901-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-1002-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1072-1314-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1976 rrrxlxl.exe 2440 nhtnnn.exe 2800 1nnbtn.exe 2636 ttntbb.exe 2728 rlrxxrx.exe 2832 bnbttt.exe 1800 lrfxfxf.exe 2668 5bbtht.exe 2544 rrflflx.exe 2980 btnbtt.exe 2436 jpjdv.exe 2052 3rlxllx.exe 1668 vjvvp.exe 856 xrfrrxf.exe 764 1jjpd.exe 2496 ffrrllx.exe 2284 pjdjv.exe 2632 3fxrrxf.exe 2860 ffllllf.exe 2844 5lxflrf.exe 2880 1bnbnt.exe 1724 1fxlrxr.exe 900 jpvpj.exe 824 fxlrffr.exe 1476 btnttb.exe 3056 7jdvj.exe 1748 ttbthb.exe 2368 1rfrflx.exe 1000 nhbnnt.exe 1012 dvvdp.exe 2044 nbnntb.exe 1536 vvjpv.exe 2956 nhnttb.exe 2896 btnnhh.exe 532 dvjvd.exe 2776 lfxxllx.exe 2772 ttnthn.exe 2684 pjdjj.exe 2752 pjvdp.exe 2864 ffrxflr.exe 2580 bbthhh.exe 2528 pjjpd.exe 2548 1lflxrf.exe 2996 3xxxfrf.exe 1356 7thbht.exe 1276 ddvdv.exe 1896 fxlrxfl.exe 1660 ffxfrfx.exe 2508 bnbhnt.exe 1688 tbnthh.exe 1076 dvvvd.exe 1008 lffrrfr.exe 1516 llflrxf.exe 852 bhnttb.exe 2036 jpddv.exe 2876 jdjjd.exe 2416 rrfrfxf.exe 1040 hhbhbh.exe 2880 ddjvv.exe 1900 7jdvj.exe 1588 1fflxxr.exe 932 nthnbh.exe 2240 tthbbh.exe 2848 ppjvp.exe -
resource yara_rule behavioral1/memory/1976-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-293-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1536-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-337-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2684-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-785-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-976-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-1130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-1275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-1288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 1976 1840 018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe 31 PID 1840 wrote to memory of 1976 1840 018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe 31 PID 1840 wrote to memory of 1976 1840 018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe 31 PID 1840 wrote to memory of 1976 1840 018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe 31 PID 1976 wrote to memory of 2440 1976 rrrxlxl.exe 32 PID 1976 wrote to memory of 2440 1976 rrrxlxl.exe 32 PID 1976 wrote to memory of 2440 1976 rrrxlxl.exe 32 PID 1976 wrote to memory of 2440 1976 rrrxlxl.exe 32 PID 2440 wrote to memory of 2800 2440 nhtnnn.exe 33 PID 2440 wrote to memory of 2800 2440 nhtnnn.exe 33 PID 2440 wrote to memory of 2800 2440 nhtnnn.exe 33 PID 2440 wrote to memory of 2800 2440 nhtnnn.exe 33 PID 2800 wrote to memory of 2636 2800 1nnbtn.exe 34 PID 2800 wrote to memory of 2636 2800 1nnbtn.exe 34 PID 2800 wrote to memory of 2636 2800 1nnbtn.exe 34 PID 2800 wrote to memory of 2636 2800 1nnbtn.exe 34 PID 2636 wrote to memory of 2728 2636 ttntbb.exe 35 PID 2636 wrote to memory of 2728 2636 ttntbb.exe 35 PID 2636 wrote to memory of 2728 2636 ttntbb.exe 35 PID 2636 wrote to memory of 2728 2636 ttntbb.exe 35 PID 2728 wrote to memory of 2832 2728 rlrxxrx.exe 36 PID 2728 wrote to memory of 2832 2728 rlrxxrx.exe 36 PID 2728 wrote to memory of 2832 2728 rlrxxrx.exe 36 PID 2728 wrote to memory of 2832 2728 rlrxxrx.exe 36 PID 2832 wrote to memory of 1800 2832 bnbttt.exe 37 PID 2832 wrote to memory of 1800 2832 bnbttt.exe 37 PID 2832 wrote to memory of 1800 2832 bnbttt.exe 37 PID 2832 wrote to memory of 1800 2832 bnbttt.exe 37 PID 1800 wrote to memory of 2668 1800 lrfxfxf.exe 38 PID 1800 wrote to memory of 2668 1800 lrfxfxf.exe 38 PID 1800 wrote to memory of 2668 1800 lrfxfxf.exe 38 PID 1800 wrote to memory of 2668 1800 lrfxfxf.exe 38 PID 2668 wrote to memory of 2544 2668 5bbtht.exe 39 PID 2668 wrote to memory of 2544 2668 5bbtht.exe 39 PID 2668 wrote to memory of 2544 2668 5bbtht.exe 39 PID 2668 wrote to memory of 2544 2668 5bbtht.exe 39 PID 2544 wrote to memory of 2980 2544 rrflflx.exe 40 PID 2544 wrote to memory of 2980 2544 rrflflx.exe 40 PID 2544 wrote to memory of 2980 2544 rrflflx.exe 40 PID 2544 wrote to memory of 2980 2544 rrflflx.exe 40 PID 2980 wrote to memory of 2436 2980 btnbtt.exe 41 PID 2980 wrote to memory of 2436 2980 btnbtt.exe 41 PID 2980 wrote to memory of 2436 2980 btnbtt.exe 41 PID 2980 wrote to memory of 2436 2980 btnbtt.exe 41 PID 2436 wrote to memory of 2052 2436 jpjdv.exe 42 PID 2436 wrote to memory of 2052 2436 jpjdv.exe 42 PID 2436 wrote to memory of 2052 2436 jpjdv.exe 42 PID 2436 wrote to memory of 2052 2436 jpjdv.exe 42 PID 2052 wrote to memory of 1668 2052 3rlxllx.exe 43 PID 2052 wrote to memory of 1668 2052 3rlxllx.exe 43 PID 2052 wrote to memory of 1668 2052 3rlxllx.exe 43 PID 2052 wrote to memory of 1668 2052 3rlxllx.exe 43 PID 1668 wrote to memory of 856 1668 vjvvp.exe 44 PID 1668 wrote to memory of 856 1668 vjvvp.exe 44 PID 1668 wrote to memory of 856 1668 vjvvp.exe 44 PID 1668 wrote to memory of 856 1668 vjvvp.exe 44 PID 856 wrote to memory of 764 856 xrfrrxf.exe 45 PID 856 wrote to memory of 764 856 xrfrrxf.exe 45 PID 856 wrote to memory of 764 856 xrfrrxf.exe 45 PID 856 wrote to memory of 764 856 xrfrrxf.exe 45 PID 764 wrote to memory of 2496 764 1jjpd.exe 46 PID 764 wrote to memory of 2496 764 1jjpd.exe 46 PID 764 wrote to memory of 2496 764 1jjpd.exe 46 PID 764 wrote to memory of 2496 764 1jjpd.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe"C:\Users\Admin\AppData\Local\Temp\018e5e6b5cef18f26168dd6eac13fcd64028d1c03fe7ceae1aac7c02a521ce43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\rrrxlxl.exec:\rrrxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\nhtnnn.exec:\nhtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1nnbtn.exec:\1nnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ttntbb.exec:\ttntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rlrxxrx.exec:\rlrxxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bnbttt.exec:\bnbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\lrfxfxf.exec:\lrfxfxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\5bbtht.exec:\5bbtht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rrflflx.exec:\rrflflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btnbtt.exec:\btnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jpjdv.exec:\jpjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\3rlxllx.exec:\3rlxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vjvvp.exec:\vjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\1jjpd.exec:\1jjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\ffrrllx.exec:\ffrrllx.exe17⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjdjv.exec:\pjdjv.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3fxrrxf.exec:\3fxrrxf.exe19⤵
- Executes dropped EXE
PID:2632 -
\??\c:\ffllllf.exec:\ffllllf.exe20⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5lxflrf.exec:\5lxflrf.exe21⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1bnbnt.exec:\1bnbnt.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1fxlrxr.exec:\1fxlrxr.exe23⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jpvpj.exec:\jpvpj.exe24⤵
- Executes dropped EXE
PID:900 -
\??\c:\fxlrffr.exec:\fxlrffr.exe25⤵
- Executes dropped EXE
PID:824 -
\??\c:\btnttb.exec:\btnttb.exe26⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7jdvj.exec:\7jdvj.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ttbthb.exec:\ttbthb.exe28⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1rfrflx.exec:\1rfrflx.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhbnnt.exec:\nhbnnt.exe30⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvvdp.exec:\dvvdp.exe31⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nbnntb.exec:\nbnntb.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vvjpv.exec:\vvjpv.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nhnttb.exec:\nhnttb.exe34⤵
- Executes dropped EXE
PID:2956 -
\??\c:\btnnhh.exec:\btnnhh.exe35⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvjvd.exec:\dvjvd.exe36⤵
- Executes dropped EXE
PID:532 -
\??\c:\lfxxllx.exec:\lfxxllx.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ttnthn.exec:\ttnthn.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pjdjj.exec:\pjdjj.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pjvdp.exec:\pjvdp.exe40⤵
- Executes dropped EXE
PID:2752 -
\??\c:\ffrxflr.exec:\ffrxflr.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\bbthhh.exec:\bbthhh.exe42⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pjjpd.exec:\pjjpd.exe43⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1lflxrf.exec:\1lflxrf.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3xxxfrf.exec:\3xxxfrf.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7thbht.exec:\7thbht.exe46⤵
- Executes dropped EXE
PID:1356 -
\??\c:\ddvdv.exec:\ddvdv.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe48⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ffxfrfx.exec:\ffxfrfx.exe49⤵
- Executes dropped EXE
PID:1660 -
\??\c:\bnbhnt.exec:\bnbhnt.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tbnthh.exec:\tbnthh.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\dvvvd.exec:\dvvvd.exe52⤵
- Executes dropped EXE
PID:1076 -
\??\c:\lffrrfr.exec:\lffrrfr.exe53⤵
- Executes dropped EXE
PID:1008 -
\??\c:\llflrxf.exec:\llflrxf.exe54⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bhnttb.exec:\bhnttb.exe55⤵
- Executes dropped EXE
PID:852 -
\??\c:\jpddv.exec:\jpddv.exe56⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jdjjd.exec:\jdjjd.exe57⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rrfrfxf.exec:\rrfrfxf.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hhbhbh.exec:\hhbhbh.exe59⤵
- Executes dropped EXE
PID:1040 -
\??\c:\ddjvv.exec:\ddjvv.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7jdvj.exec:\7jdvj.exe61⤵
- Executes dropped EXE
PID:1900 -
\??\c:\1fflxxr.exec:\1fflxxr.exe62⤵
- Executes dropped EXE
PID:1588 -
\??\c:\nthnbh.exec:\nthnbh.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\tthbbh.exec:\tthbbh.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ppjvp.exec:\ppjvp.exe65⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9xxlrlr.exec:\9xxlrlr.exe66⤵PID:2172
-
\??\c:\hhttbh.exec:\hhttbh.exe67⤵PID:2432
-
\??\c:\1pdjd.exec:\1pdjd.exe68⤵PID:1748
-
\??\c:\7pvvv.exec:\7pvvv.exe69⤵PID:2088
-
\??\c:\lfrxllf.exec:\lfrxllf.exe70⤵PID:876
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe71⤵
- System Location Discovery: System Language Discovery
PID:2612 -
\??\c:\3btbhn.exec:\3btbhn.exe72⤵PID:2108
-
\??\c:\vpddd.exec:\vpddd.exe73⤵PID:1544
-
\??\c:\3xrrflf.exec:\3xrrflf.exe74⤵PID:616
-
\??\c:\nnbhnn.exec:\nnbhnn.exe75⤵PID:2132
-
\??\c:\vvpvd.exec:\vvpvd.exe76⤵PID:2624
-
\??\c:\vpddv.exec:\vpddv.exe77⤵PID:2092
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe78⤵PID:2660
-
\??\c:\9tntnb.exec:\9tntnb.exe79⤵PID:2760
-
\??\c:\hbbtnt.exec:\hbbtnt.exe80⤵PID:2744
-
\??\c:\5vdvj.exec:\5vdvj.exe81⤵PID:2740
-
\??\c:\9rxxxxf.exec:\9rxxxxf.exe82⤵PID:2752
-
\??\c:\5xrrxlx.exec:\5xrrxlx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2348 -
\??\c:\nnthtb.exec:\nnthtb.exe84⤵PID:2536
-
\??\c:\nnbbnt.exec:\nnbbnt.exe85⤵PID:2584
-
\??\c:\3vjvj.exec:\3vjvj.exe86⤵PID:2784
-
\??\c:\xrllflf.exec:\xrllflf.exe87⤵PID:2992
-
\??\c:\9tnnbh.exec:\9tnnbh.exe88⤵
- System Location Discovery: System Language Discovery
PID:1448 -
\??\c:\tbnhhb.exec:\tbnhhb.exe89⤵PID:1700
-
\??\c:\djvjp.exec:\djvjp.exe90⤵PID:1876
-
\??\c:\xxrxlrr.exec:\xxrxlrr.exe91⤵PID:2352
-
\??\c:\lfflxfr.exec:\lfflxfr.exe92⤵PID:760
-
\??\c:\ttnhbn.exec:\ttnhbn.exe93⤵PID:2272
-
\??\c:\ppdjj.exec:\ppdjj.exe94⤵PID:1624
-
\??\c:\9dpvv.exec:\9dpvv.exe95⤵PID:1232
-
\??\c:\llfllrx.exec:\llfllrx.exe96⤵PID:1008
-
\??\c:\hbntht.exec:\hbntht.exe97⤵PID:2748
-
\??\c:\bbnbht.exec:\bbnbht.exe98⤵PID:2600
-
\??\c:\jjdvv.exec:\jjdvv.exe99⤵PID:2036
-
\??\c:\xfxlrrl.exec:\xfxlrrl.exe100⤵PID:2964
-
\??\c:\5frrflx.exec:\5frrflx.exe101⤵PID:2392
-
\??\c:\9nnntb.exec:\9nnntb.exe102⤵PID:1408
-
\??\c:\dvddd.exec:\dvddd.exe103⤵PID:1680
-
\??\c:\jdddj.exec:\jdddj.exe104⤵PID:736
-
\??\c:\lrxflxl.exec:\lrxflxl.exe105⤵PID:1588
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe106⤵PID:1496
-
\??\c:\bhbnbb.exec:\bhbnbb.exe107⤵PID:2240
-
\??\c:\3pddp.exec:\3pddp.exe108⤵PID:1844
-
\??\c:\pjvjp.exec:\pjvjp.exe109⤵PID:2056
-
\??\c:\frffxxl.exec:\frffxxl.exe110⤵PID:1740
-
\??\c:\5hbbtb.exec:\5hbbtb.exe111⤵PID:1488
-
\??\c:\vpdpv.exec:\vpdpv.exe112⤵PID:2456
-
\??\c:\vvjjv.exec:\vvjjv.exe113⤵PID:1000
-
\??\c:\rrrllrx.exec:\rrrllrx.exe114⤵PID:1012
-
\??\c:\tnhnbh.exec:\tnhnbh.exe115⤵PID:2500
-
\??\c:\bhbnht.exec:\bhbnht.exe116⤵PID:3016
-
\??\c:\vpjpd.exec:\vpjpd.exe117⤵PID:1536
-
\??\c:\3fxrrxf.exec:\3fxrrxf.exe118⤵PID:3000
-
\??\c:\xfxfllr.exec:\xfxfllr.exe119⤵PID:2672
-
\??\c:\bbtnnb.exec:\bbtnnb.exe120⤵PID:2676
-
\??\c:\jdpvv.exec:\jdpvv.exe121⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-