Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe
Resource
win7-20240903-en
General
-
Target
bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe
-
Size
454KB
-
MD5
5ed1e612d3273688a8f59f0fff22d710
-
SHA1
9072bf735269e4c2fad6c94ae00ff65d6b771ef5
-
SHA256
bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8d
-
SHA512
19a97cc9e661526f4ed3292d034c5dedc9d8ed634336777901c08eddbedb7f43ab29fbf387e4e8a3ddc7b59d25544adeb6f1b084dda2564e0151b6e0caa5f43d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/636-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-272-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-689-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2464-803-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2472-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-934-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-980-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1736-1011-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 bbtbhn.exe 2748 7lfxlrf.exe 2204 9nhtht.exe 2868 1nnhbb.exe 2664 3bthbh.exe 2584 1rlrfrf.exe 2372 tnbbtb.exe 1676 7lxflxl.exe 2932 tntbbh.exe 2952 rfxxffl.exe 756 9ffrxlr.exe 636 nhhbnt.exe 1904 flflxrf.exe 2620 9tttbn.exe 388 xxfxllx.exe 876 nhtbbh.exe 2988 lfrxllr.exe 908 bthnhn.exe 1912 3dddp.exe 2648 rlxlfrx.exe 1016 dvjpd.exe 2504 xlrxfll.exe 1660 bhnnhh.exe 3012 dvjpv.exe 1724 7tnttb.exe 2400 llflrxr.exe 560 hhhhnn.exe 2140 llxlrrf.exe 1280 hbntbb.exe 2980 9jpvj.exe 1936 lxxfrlr.exe 3016 jjjvp.exe 2816 1rlrffr.exe 2752 hhhbtb.exe 2812 pjpvj.exe 2776 fxrlrrr.exe 2784 btthhb.exe 2112 pjdvv.exe 2552 vvvdp.exe 2568 fxrffrf.exe 2584 tbtbnh.exe 3060 dvppv.exe 1796 jjddp.exe 552 1rfllrf.exe 2916 hhhtbb.exe 3044 7jdpv.exe 2540 rllrxlf.exe 1316 fllxlrl.exe 1588 hbtbnh.exe 1536 dddjv.exe 2864 llxfrxl.exe 1896 flfrllx.exe 1876 7nnttb.exe 536 ppjpd.exe 2900 rxxflfr.exe 3000 5fllxxf.exe 980 7tnthn.exe 444 ddpjp.exe 1912 rrflllr.exe 2392 lfrxxxr.exe 3036 hbnhnt.exe 692 ddjdp.exe 2500 vpjpv.exe 1580 frrlrlr.exe -
resource yara_rule behavioral1/memory/2660-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-919-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-947-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-1011-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2060-1081-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2696 2660 bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe 30 PID 2660 wrote to memory of 2696 2660 bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe 30 PID 2660 wrote to memory of 2696 2660 bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe 30 PID 2660 wrote to memory of 2696 2660 bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe 30 PID 2696 wrote to memory of 2748 2696 bbtbhn.exe 31 PID 2696 wrote to memory of 2748 2696 bbtbhn.exe 31 PID 2696 wrote to memory of 2748 2696 bbtbhn.exe 31 PID 2696 wrote to memory of 2748 2696 bbtbhn.exe 31 PID 2748 wrote to memory of 2204 2748 7lfxlrf.exe 32 PID 2748 wrote to memory of 2204 2748 7lfxlrf.exe 32 PID 2748 wrote to memory of 2204 2748 7lfxlrf.exe 32 PID 2748 wrote to memory of 2204 2748 7lfxlrf.exe 32 PID 2204 wrote to memory of 2868 2204 9nhtht.exe 33 PID 2204 wrote to memory of 2868 2204 9nhtht.exe 33 PID 2204 wrote to memory of 2868 2204 9nhtht.exe 33 PID 2204 wrote to memory of 2868 2204 9nhtht.exe 33 PID 2868 wrote to memory of 2664 2868 1nnhbb.exe 34 PID 2868 wrote to memory of 2664 2868 1nnhbb.exe 34 PID 2868 wrote to memory of 2664 2868 1nnhbb.exe 34 PID 2868 wrote to memory of 2664 2868 1nnhbb.exe 34 PID 2664 wrote to memory of 2584 2664 3bthbh.exe 35 PID 2664 wrote to memory of 2584 2664 3bthbh.exe 35 PID 2664 wrote to memory of 2584 2664 3bthbh.exe 35 PID 2664 wrote to memory of 2584 2664 3bthbh.exe 35 PID 2584 wrote to memory of 2372 2584 1rlrfrf.exe 36 PID 2584 wrote to memory of 2372 2584 1rlrfrf.exe 36 PID 2584 wrote to memory of 2372 2584 1rlrfrf.exe 36 PID 2584 wrote to memory of 2372 2584 1rlrfrf.exe 36 PID 2372 wrote to memory of 1676 2372 tnbbtb.exe 37 PID 2372 wrote to memory of 1676 2372 tnbbtb.exe 37 PID 2372 wrote to memory of 1676 2372 tnbbtb.exe 37 PID 2372 wrote to memory of 1676 2372 tnbbtb.exe 37 PID 1676 wrote to memory of 2932 1676 7lxflxl.exe 38 PID 1676 wrote to memory of 2932 1676 7lxflxl.exe 38 PID 1676 wrote to memory of 2932 1676 7lxflxl.exe 38 PID 1676 wrote to memory of 2932 1676 7lxflxl.exe 38 PID 2932 wrote to memory of 2952 2932 tntbbh.exe 39 PID 2932 wrote to memory of 2952 2932 tntbbh.exe 39 PID 2932 wrote to memory of 2952 2932 tntbbh.exe 39 PID 2932 wrote to memory of 2952 2932 tntbbh.exe 39 PID 2952 wrote to memory of 756 2952 rfxxffl.exe 40 PID 2952 wrote to memory of 756 2952 rfxxffl.exe 40 PID 2952 wrote to memory of 756 2952 rfxxffl.exe 40 PID 2952 wrote to memory of 756 2952 rfxxffl.exe 40 PID 756 wrote to memory of 636 756 9ffrxlr.exe 41 PID 756 wrote to memory of 636 756 9ffrxlr.exe 41 PID 756 wrote to memory of 636 756 9ffrxlr.exe 41 PID 756 wrote to memory of 636 756 9ffrxlr.exe 41 PID 636 wrote to memory of 1904 636 nhhbnt.exe 42 PID 636 wrote to memory of 1904 636 nhhbnt.exe 42 PID 636 wrote to memory of 1904 636 nhhbnt.exe 42 PID 636 wrote to memory of 1904 636 nhhbnt.exe 42 PID 1904 wrote to memory of 2620 1904 flflxrf.exe 43 PID 1904 wrote to memory of 2620 1904 flflxrf.exe 43 PID 1904 wrote to memory of 2620 1904 flflxrf.exe 43 PID 1904 wrote to memory of 2620 1904 flflxrf.exe 43 PID 2620 wrote to memory of 388 2620 9tttbn.exe 44 PID 2620 wrote to memory of 388 2620 9tttbn.exe 44 PID 2620 wrote to memory of 388 2620 9tttbn.exe 44 PID 2620 wrote to memory of 388 2620 9tttbn.exe 44 PID 388 wrote to memory of 876 388 xxfxllx.exe 45 PID 388 wrote to memory of 876 388 xxfxllx.exe 45 PID 388 wrote to memory of 876 388 xxfxllx.exe 45 PID 388 wrote to memory of 876 388 xxfxllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe"C:\Users\Admin\AppData\Local\Temp\bb50202a6d331d8a125a36bbc51df529b247a082cdd091235012be23156f0c8dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bbtbhn.exec:\bbtbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7lfxlrf.exec:\7lfxlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\9nhtht.exec:\9nhtht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\1nnhbb.exec:\1nnhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3bthbh.exec:\3bthbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1rlrfrf.exec:\1rlrfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tnbbtb.exec:\tnbbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\7lxflxl.exec:\7lxflxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\tntbbh.exec:\tntbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\rfxxffl.exec:\rfxxffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9ffrxlr.exec:\9ffrxlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\nhhbnt.exec:\nhhbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\flflxrf.exec:\flflxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\9tttbn.exec:\9tttbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xxfxllx.exec:\xxfxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\nhtbbh.exec:\nhtbbh.exe17⤵
- Executes dropped EXE
PID:876 -
\??\c:\lfrxllr.exec:\lfrxllr.exe18⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bthnhn.exec:\bthnhn.exe19⤵
- Executes dropped EXE
PID:908 -
\??\c:\3dddp.exec:\3dddp.exe20⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlxlfrx.exec:\rlxlfrx.exe21⤵
- Executes dropped EXE
PID:2648 -
\??\c:\dvjpd.exec:\dvjpd.exe22⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xlrxfll.exec:\xlrxfll.exe23⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bhnnhh.exec:\bhnnhh.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dvjpv.exec:\dvjpv.exe25⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7tnttb.exec:\7tnttb.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\llflrxr.exec:\llflrxr.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhhhnn.exec:\hhhhnn.exe28⤵
- Executes dropped EXE
PID:560 -
\??\c:\llxlrrf.exec:\llxlrrf.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbntbb.exec:\hbntbb.exe30⤵
- Executes dropped EXE
PID:1280 -
\??\c:\9jpvj.exec:\9jpvj.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\lxxfrlr.exec:\lxxfrlr.exe32⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jjjvp.exec:\jjjvp.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1rlrffr.exec:\1rlrffr.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hhhbtb.exec:\hhhbtb.exe35⤵
- Executes dropped EXE
PID:2752 -
\??\c:\pjpvj.exec:\pjpvj.exe36⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe37⤵
- Executes dropped EXE
PID:2776 -
\??\c:\btthhb.exec:\btthhb.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjdvv.exec:\pjdvv.exe39⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vvvdp.exec:\vvvdp.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\fxrffrf.exec:\fxrffrf.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tbtbnh.exec:\tbtbnh.exe42⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvppv.exec:\dvppv.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jjddp.exec:\jjddp.exe44⤵
- Executes dropped EXE
PID:1796 -
\??\c:\1rfllrf.exec:\1rfllrf.exe45⤵
- Executes dropped EXE
PID:552 -
\??\c:\hhhtbb.exec:\hhhtbb.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7jdpv.exec:\7jdpv.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\rllrxlf.exec:\rllrxlf.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fllxlrl.exec:\fllxlrl.exe49⤵
- Executes dropped EXE
PID:1316 -
\??\c:\hbtbnh.exec:\hbtbnh.exe50⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dddjv.exec:\dddjv.exe51⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llxfrxl.exec:\llxfrxl.exe52⤵
- Executes dropped EXE
PID:2864 -
\??\c:\flfrllx.exec:\flfrllx.exe53⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7nnttb.exec:\7nnttb.exe54⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ppjpd.exec:\ppjpd.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\rxxflfr.exec:\rxxflfr.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5fllxxf.exec:\5fllxxf.exe57⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7tnthn.exec:\7tnthn.exe58⤵
- Executes dropped EXE
PID:980 -
\??\c:\ddpjp.exec:\ddpjp.exe59⤵
- Executes dropped EXE
PID:444 -
\??\c:\rrflllr.exec:\rrflllr.exe60⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrxxxr.exec:\lfrxxxr.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hbnhnt.exec:\hbnhnt.exe62⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ddjdp.exec:\ddjdp.exe63⤵
- Executes dropped EXE
PID:692 -
\??\c:\vpjpv.exec:\vpjpv.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\frrlrlr.exec:\frrlrlr.exe65⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhhtbh.exec:\nhhtbh.exe66⤵PID:3012
-
\??\c:\ppddv.exec:\ppddv.exe67⤵PID:848
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe68⤵PID:2176
-
\??\c:\nhhnbb.exec:\nhhnbb.exe69⤵PID:2492
-
\??\c:\tbbnnn.exec:\tbbnnn.exe70⤵PID:1208
-
\??\c:\3jpvj.exec:\3jpvj.exe71⤵PID:1596
-
\??\c:\fxlfffl.exec:\fxlfffl.exe72⤵PID:2484
-
\??\c:\5bntbh.exec:\5bntbh.exe73⤵PID:1412
-
\??\c:\bbttbb.exec:\bbttbb.exe74⤵PID:1952
-
\??\c:\1ppvd.exec:\1ppvd.exe75⤵PID:2320
-
\??\c:\rxxxffx.exec:\rxxxffx.exe76⤵PID:2348
-
\??\c:\7nntbn.exec:\7nntbn.exe77⤵PID:376
-
\??\c:\pjjvj.exec:\pjjvj.exe78⤵PID:2708
-
\??\c:\vpppd.exec:\vpppd.exe79⤵PID:2772
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe80⤵PID:2780
-
\??\c:\tnhhtt.exec:\tnhhtt.exe81⤵PID:2272
-
\??\c:\nhhthh.exec:\nhhthh.exe82⤵PID:2948
-
\??\c:\pvvjv.exec:\pvvjv.exe83⤵PID:2112
-
\??\c:\xrrxflx.exec:\xrrxflx.exe84⤵PID:2552
-
\??\c:\xrflxfr.exec:\xrflxfr.exe85⤵PID:2828
-
\??\c:\nnbnbn.exec:\nnbnbn.exe86⤵PID:3052
-
\??\c:\djdvj.exec:\djdvj.exe87⤵PID:3060
-
\??\c:\vvpjv.exec:\vvpjv.exe88⤵PID:1932
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe89⤵PID:2892
-
\??\c:\1nnbnn.exec:\1nnbnn.exe90⤵PID:2956
-
\??\c:\dppdj.exec:\dppdj.exe91⤵PID:1072
-
\??\c:\7dppv.exec:\7dppv.exe92⤵PID:1600
-
\??\c:\llfllrl.exec:\llfllrl.exe93⤵PID:1408
-
\??\c:\tnbnbb.exec:\tnbnbb.exe94⤵PID:676
-
\??\c:\jjdpd.exec:\jjdpd.exe95⤵PID:1536
-
\??\c:\vdpvj.exec:\vdpvj.exe96⤵PID:2864
-
\??\c:\rlfrxxr.exec:\rlfrxxr.exe97⤵PID:2840
-
\??\c:\tbbnhn.exec:\tbbnhn.exe98⤵PID:2884
-
\??\c:\jpjpv.exec:\jpjpv.exe99⤵
- System Location Discovery: System Language Discovery
PID:112 -
\??\c:\vvvvd.exec:\vvvvd.exe100⤵PID:2900
-
\??\c:\rrlxxxf.exec:\rrlxxxf.exe101⤵PID:1444
-
\??\c:\bbhhht.exec:\bbhhht.exe102⤵PID:1120
-
\??\c:\ddvvp.exec:\ddvvp.exe103⤵PID:444
-
\??\c:\3pjjp.exec:\3pjjp.exe104⤵PID:316
-
\??\c:\fxflxfr.exec:\fxflxfr.exe105⤵PID:688
-
\??\c:\hhbntb.exec:\hhbntb.exe106⤵PID:1988
-
\??\c:\3vdvv.exec:\3vdvv.exe107⤵PID:580
-
\??\c:\pjdjv.exec:\pjdjv.exe108⤵PID:984
-
\??\c:\fxxlrxr.exec:\fxxlrxr.exe109⤵PID:2464
-
\??\c:\bbthnt.exec:\bbthnt.exe110⤵PID:2216
-
\??\c:\3hhttb.exec:\3hhttb.exe111⤵PID:284
-
\??\c:\1vjjv.exec:\1vjjv.exe112⤵PID:2328
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe113⤵PID:3040
-
\??\c:\bhhbnh.exec:\bhhbnh.exe114⤵PID:2088
-
\??\c:\ntnbnt.exec:\ntnbnt.exe115⤵PID:2056
-
\??\c:\vjdjp.exec:\vjdjp.exe116⤵PID:1564
-
\??\c:\7rrrxfr.exec:\7rrrxfr.exe117⤵PID:1956
-
\??\c:\nnhnbb.exec:\nnhnbb.exe118⤵PID:2472
-
\??\c:\tttntb.exec:\tttntb.exe119⤵PID:352
-
\??\c:\ddvjp.exec:\ddvjp.exe120⤵PID:1888
-
\??\c:\xrlrflf.exec:\xrlrflf.exe121⤵PID:376
-
\??\c:\hbtbnt.exec:\hbtbnt.exe122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-