Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe
-
Size
455KB
-
MD5
118da336b0a5021d33536d287ff7e018
-
SHA1
2028603cd133533c33645dbb104279451f2bf746
-
SHA256
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb
-
SHA512
88c3d08d2ed1de4f928da28d1c7b837ff9793561051f76057d982208ced836cb4e1cb34e3185f05744ea2b5b6aa9be04cf60c29fb0cce3aff61a176cb1265c20
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJKPI:q7Tc2NYHUrAwfMp3CDJKPI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1628-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-348-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2244-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-391-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1340-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-703-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-1022-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1716-1151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2520-1203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-1231-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 1ffrrrf.exe 1732 bbbhbh.exe 2768 nthhhn.exe 2616 tnhntt.exe 2388 vdpvp.exe 2860 lllfxfr.exe 2656 bnhnbb.exe 2556 vpjvd.exe 2128 5bttbh.exe 2404 vpvdp.exe 1052 tnttbb.exe 572 jjvvj.exe 2840 rlflrrx.exe 3008 jjvdp.exe 840 rlxfllr.exe 860 hbbthn.exe 1972 jvppp.exe 1856 rllxlrf.exe 2740 ppdpv.exe 2360 xrflrlr.exe 2144 nthntt.exe 2588 9pdjv.exe 2932 lrllxff.exe 2316 3ntttt.exe 1224 ppjjd.exe 1868 rrflrlx.exe 1708 9pvpp.exe 1028 rfxrlff.exe 2808 9pppd.exe 2296 5frxlrf.exe 2420 nhtbtt.exe 2260 dvjjj.exe 2228 rfrrxrx.exe 3012 htbbhb.exe 2088 jdppd.exe 2772 3xflrrf.exe 2800 rxrxrrr.exe 2768 bnbbhb.exe 2500 ddpvd.exe 2712 xfrrrlr.exe 2244 ththnh.exe 2672 djvpv.exe 2656 rfxxxrf.exe 2488 3lxxfxf.exe 2152 9thnth.exe 580 5vppd.exe 1340 3fffllr.exe 1056 bnnntt.exe 608 ppvjv.exe 2856 ffxxxfr.exe 2848 thbbhn.exe 2968 vjvdj.exe 840 7jvvv.exe 1704 llrlrlx.exe 1304 bbnhnn.exe 1944 dvjpv.exe 1264 dvddv.exe 1316 rrlrxfr.exe 632 bbtthb.exe 1948 tnbbhn.exe 2144 jvpdj.exe 2108 ffrrxxx.exe 2220 bnbhnn.exe 2376 dppjd.exe -
resource yara_rule behavioral1/memory/1628-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-256-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1708-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-966-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1022-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2124-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-1151-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2520-1203-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2876-1257-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1120 wrote to memory of 1628 1120 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 28 PID 1120 wrote to memory of 1628 1120 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 28 PID 1120 wrote to memory of 1628 1120 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 28 PID 1120 wrote to memory of 1628 1120 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 28 PID 1628 wrote to memory of 1732 1628 1ffrrrf.exe 29 PID 1628 wrote to memory of 1732 1628 1ffrrrf.exe 29 PID 1628 wrote to memory of 1732 1628 1ffrrrf.exe 29 PID 1628 wrote to memory of 1732 1628 1ffrrrf.exe 29 PID 1732 wrote to memory of 2768 1732 bbbhbh.exe 30 PID 1732 wrote to memory of 2768 1732 bbbhbh.exe 30 PID 1732 wrote to memory of 2768 1732 bbbhbh.exe 30 PID 1732 wrote to memory of 2768 1732 bbbhbh.exe 30 PID 2768 wrote to memory of 2616 2768 nthhhn.exe 31 PID 2768 wrote to memory of 2616 2768 nthhhn.exe 31 PID 2768 wrote to memory of 2616 2768 nthhhn.exe 31 PID 2768 wrote to memory of 2616 2768 nthhhn.exe 31 PID 2616 wrote to memory of 2388 2616 tnhntt.exe 32 PID 2616 wrote to memory of 2388 2616 tnhntt.exe 32 PID 2616 wrote to memory of 2388 2616 tnhntt.exe 32 PID 2616 wrote to memory of 2388 2616 tnhntt.exe 32 PID 2388 wrote to memory of 2860 2388 vdpvp.exe 33 PID 2388 wrote to memory of 2860 2388 vdpvp.exe 33 PID 2388 wrote to memory of 2860 2388 vdpvp.exe 33 PID 2388 wrote to memory of 2860 2388 vdpvp.exe 33 PID 2860 wrote to memory of 2656 2860 lllfxfr.exe 34 PID 2860 wrote to memory of 2656 2860 lllfxfr.exe 34 PID 2860 wrote to memory of 2656 2860 lllfxfr.exe 34 PID 2860 wrote to memory of 2656 2860 lllfxfr.exe 34 PID 2656 wrote to memory of 2556 2656 bnhnbb.exe 35 PID 2656 wrote to memory of 2556 2656 bnhnbb.exe 35 PID 2656 wrote to memory of 2556 2656 bnhnbb.exe 35 PID 2656 wrote to memory of 2556 2656 bnhnbb.exe 35 PID 2556 wrote to memory of 2128 2556 vpjvd.exe 36 PID 2556 wrote to memory of 2128 2556 vpjvd.exe 36 PID 2556 wrote to memory of 2128 2556 vpjvd.exe 36 PID 2556 wrote to memory of 2128 2556 vpjvd.exe 36 PID 2128 wrote to memory of 2404 2128 5bttbh.exe 37 PID 2128 wrote to memory of 2404 2128 5bttbh.exe 37 PID 2128 wrote to memory of 2404 2128 5bttbh.exe 37 PID 2128 wrote to memory of 2404 2128 5bttbh.exe 37 PID 2404 wrote to memory of 1052 2404 vpvdp.exe 38 PID 2404 wrote to memory of 1052 2404 vpvdp.exe 38 PID 2404 wrote to memory of 1052 2404 vpvdp.exe 38 PID 2404 wrote to memory of 1052 2404 vpvdp.exe 38 PID 1052 wrote to memory of 572 1052 tnttbb.exe 39 PID 1052 wrote to memory of 572 1052 tnttbb.exe 39 PID 1052 wrote to memory of 572 1052 tnttbb.exe 39 PID 1052 wrote to memory of 572 1052 tnttbb.exe 39 PID 572 wrote to memory of 2840 572 jjvvj.exe 40 PID 572 wrote to memory of 2840 572 jjvvj.exe 40 PID 572 wrote to memory of 2840 572 jjvvj.exe 40 PID 572 wrote to memory of 2840 572 jjvvj.exe 40 PID 2840 wrote to memory of 3008 2840 rlflrrx.exe 41 PID 2840 wrote to memory of 3008 2840 rlflrrx.exe 41 PID 2840 wrote to memory of 3008 2840 rlflrrx.exe 41 PID 2840 wrote to memory of 3008 2840 rlflrrx.exe 41 PID 3008 wrote to memory of 840 3008 jjvdp.exe 42 PID 3008 wrote to memory of 840 3008 jjvdp.exe 42 PID 3008 wrote to memory of 840 3008 jjvdp.exe 42 PID 3008 wrote to memory of 840 3008 jjvdp.exe 42 PID 840 wrote to memory of 860 840 rlxfllr.exe 43 PID 840 wrote to memory of 860 840 rlxfllr.exe 43 PID 840 wrote to memory of 860 840 rlxfllr.exe 43 PID 840 wrote to memory of 860 840 rlxfllr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe"C:\Users\Admin\AppData\Local\Temp\120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\1ffrrrf.exec:\1ffrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\bbbhbh.exec:\bbbhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\nthhhn.exec:\nthhhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tnhntt.exec:\tnhntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vdpvp.exec:\vdpvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lllfxfr.exec:\lllfxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bnhnbb.exec:\bnhnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vpjvd.exec:\vpjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5bttbh.exec:\5bttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\vpvdp.exec:\vpvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\tnttbb.exec:\tnttbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jjvvj.exec:\jjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\rlflrrx.exec:\rlflrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\jjvdp.exec:\jjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rlxfllr.exec:\rlxfllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\hbbthn.exec:\hbbthn.exe17⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvppp.exec:\jvppp.exe18⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rllxlrf.exec:\rllxlrf.exe19⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppdpv.exec:\ppdpv.exe20⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xrflrlr.exec:\xrflrlr.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nthntt.exec:\nthntt.exe22⤵
- Executes dropped EXE
PID:2144 -
\??\c:\9pdjv.exec:\9pdjv.exe23⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lrllxff.exec:\lrllxff.exe24⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3ntttt.exec:\3ntttt.exe25⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ppjjd.exec:\ppjjd.exe26⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rrflrlx.exec:\rrflrlx.exe27⤵
- Executes dropped EXE
PID:1868 -
\??\c:\9pvpp.exec:\9pvpp.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rfxrlff.exec:\rfxrlff.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9pppd.exec:\9pppd.exe30⤵
- Executes dropped EXE
PID:2808 -
\??\c:\5frxlrf.exec:\5frxlrf.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhtbtt.exec:\nhtbtt.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dvjjj.exec:\dvjjj.exe33⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe34⤵
- Executes dropped EXE
PID:2228 -
\??\c:\htbbhb.exec:\htbbhb.exe35⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jdppd.exec:\jdppd.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\3xflrrf.exec:\3xflrrf.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rxrxrrr.exec:\rxrxrrr.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bnbbhb.exec:\bnbbhb.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ddpvd.exec:\ddpvd.exe40⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xfrrrlr.exec:\xfrrrlr.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ththnh.exec:\ththnh.exe42⤵
- Executes dropped EXE
PID:2244 -
\??\c:\djvpv.exec:\djvpv.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rfxxxrf.exec:\rfxxxrf.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3lxxfxf.exec:\3lxxfxf.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\9thnth.exec:\9thnth.exe46⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5vppd.exec:\5vppd.exe47⤵
- Executes dropped EXE
PID:580 -
\??\c:\3fffllr.exec:\3fffllr.exe48⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bnnntt.exec:\bnnntt.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ppvjv.exec:\ppvjv.exe50⤵
- Executes dropped EXE
PID:608 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\thbbhn.exec:\thbbhn.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjvdj.exec:\vjvdj.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7jvvv.exec:\7jvvv.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\llrlrlx.exec:\llrlrlx.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bbnhnn.exec:\bbnhnn.exe56⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvjpv.exec:\dvjpv.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvddv.exec:\dvddv.exe58⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe59⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bbtthb.exec:\bbtthb.exe60⤵
- Executes dropped EXE
PID:632 -
\??\c:\tnbbhn.exec:\tnbbhn.exe61⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jvpdj.exec:\jvpdj.exe62⤵
- Executes dropped EXE
PID:2144 -
\??\c:\ffrrxxx.exec:\ffrrxxx.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bnbhnn.exec:\bnbhnn.exe64⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dppjd.exec:\dppjd.exe65⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ddjpv.exec:\ddjpv.exe66⤵PID:2472
-
\??\c:\1frlffl.exec:\1frlffl.exe67⤵PID:1540
-
\??\c:\9bhnbb.exec:\9bhnbb.exe68⤵PID:1180
-
\??\c:\nhbbtt.exec:\nhbbtt.exe69⤵PID:1868
-
\??\c:\1dpvd.exec:\1dpvd.exe70⤵PID:956
-
\??\c:\lxllflr.exec:\lxllflr.exe71⤵PID:928
-
\??\c:\nhtbnn.exec:\nhtbnn.exe72⤵PID:2284
-
\??\c:\tnbbbb.exec:\tnbbbb.exe73⤵PID:1516
-
\??\c:\jvjjp.exec:\jvjjp.exe74⤵PID:2332
-
\??\c:\3xrrxfl.exec:\3xrrxfl.exe75⤵PID:888
-
\??\c:\bhbthb.exec:\bhbthb.exe76⤵PID:2444
-
\??\c:\bnbttt.exec:\bnbttt.exe77⤵PID:884
-
\??\c:\dvpvv.exec:\dvpvv.exe78⤵PID:2228
-
\??\c:\llrfllx.exec:\llrfllx.exe79⤵PID:2620
-
\??\c:\frffffr.exec:\frffffr.exe80⤵PID:2636
-
\??\c:\nhtbhn.exec:\nhtbhn.exe81⤵PID:2356
-
\??\c:\7pvdv.exec:\7pvdv.exe82⤵PID:2776
-
\??\c:\pdpvv.exec:\pdpvv.exe83⤵PID:2692
-
\??\c:\5xrrrxr.exec:\5xrrrxr.exe84⤵PID:2908
-
\??\c:\nhnntn.exec:\nhnntn.exe85⤵PID:2008
-
\??\c:\1nhnhh.exec:\1nhnhh.exe86⤵PID:2492
-
\??\c:\jdvvd.exec:\jdvvd.exe87⤵PID:3028
-
\??\c:\lfrrffl.exec:\lfrrffl.exe88⤵PID:1424
-
\??\c:\7rrllff.exec:\7rrllff.exe89⤵PID:3016
-
\??\c:\btthtt.exec:\btthtt.exe90⤵PID:696
-
\??\c:\pdppv.exec:\pdppv.exe91⤵PID:580
-
\??\c:\pjddd.exec:\pjddd.exe92⤵PID:1340
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe93⤵PID:1496
-
\??\c:\nnbhnt.exec:\nnbhnt.exe94⤵PID:2592
-
\??\c:\thhbhb.exec:\thhbhb.exe95⤵PID:2980
-
\??\c:\vvpjj.exec:\vvpjj.exe96⤵PID:2532
-
\??\c:\lxlflrx.exec:\lxlflrx.exe97⤵PID:1796
-
\??\c:\frflrrr.exec:\frflrrr.exe98⤵PID:804
-
\??\c:\1btnbt.exec:\1btnbt.exe99⤵PID:1808
-
\??\c:\dvjjp.exec:\dvjjp.exe100⤵PID:2252
-
\??\c:\dvpdd.exec:\dvpdd.exe101⤵PID:2352
-
\??\c:\rlrxffr.exec:\rlrxffr.exe102⤵PID:1048
-
\??\c:\bthhhh.exec:\bthhhh.exe103⤵PID:828
-
\??\c:\3httbh.exec:\3httbh.exe104⤵PID:1660
-
\??\c:\pvdvv.exec:\pvdvv.exe105⤵PID:2116
-
\??\c:\9frlflr.exec:\9frlflr.exe106⤵
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\rlrlfxl.exec:\rlrlfxl.exe107⤵PID:1800
-
\??\c:\nbnntt.exec:\nbnntt.exe108⤵PID:2136
-
\??\c:\pdjdj.exec:\pdjdj.exe109⤵PID:1860
-
\??\c:\jpjjp.exec:\jpjjp.exe110⤵PID:2412
-
\??\c:\frfxrrf.exec:\frfxrrf.exe111⤵PID:912
-
\??\c:\rxxflxf.exec:\rxxflxf.exe112⤵PID:1356
-
\??\c:\bnbhnh.exec:\bnbhnh.exe113⤵PID:1180
-
\??\c:\vvpdj.exec:\vvpdj.exe114⤵PID:700
-
\??\c:\flrflrr.exec:\flrflrr.exe115⤵PID:944
-
\??\c:\hbthnh.exec:\hbthnh.exe116⤵PID:1772
-
\??\c:\pjjpj.exec:\pjjpj.exe117⤵PID:1692
-
\??\c:\pvjjv.exec:\pvjjv.exe118⤵PID:1516
-
\??\c:\5rflxxr.exec:\5rflxxr.exe119⤵PID:2420
-
\??\c:\fflrxxr.exec:\fflrxxr.exe120⤵PID:612
-
\??\c:\hhhbbt.exec:\hhhbbt.exe121⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-