Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 20:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe
-
Size
458KB
-
MD5
129a485aaf7c0f83f4e1d2243531134d
-
SHA1
69d288cadd9defb01c22fa5e4daa2c556f7da5b9
-
SHA256
27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373
-
SHA512
f60f10ab6ac999d104fa1888d1b03a0b95c4a049e197a6f02de262f2403f0c5376c9be14e99221bd48997572a3de6a962b10588fcee5739dfe8083209990fe35
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2S:q7Tc2NYHUrAwfMp3CDR2S
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1840-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-92-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2992-90-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2096-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-106-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2064-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2932-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-407-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1520-406-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2812-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1356-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-870-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2856-871-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2960-899-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-939-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 pjdjv.exe 2844 lxrfffl.exe 2700 tnthhb.exe 3016 vpvjv.exe 2600 7lxxxfl.exe 2928 tnnntb.exe 2696 1lxxxxf.exe 2388 xrlflrr.exe 2992 7tbhtb.exe 2224 ttnbbn.exe 2096 xlffrxl.exe 2064 nhbthh.exe 2780 rrllrrf.exe 2912 dvddj.exe 2940 frflllr.exe 2996 vjdvd.exe 772 lfrxrrx.exe 296 1bnbhb.exe 2556 vpjjp.exe 2368 9rlxfrx.exe 2068 3ntbnh.exe 1184 llfxlxr.exe 1116 nnbbhh.exe 2528 7pjpv.exe 1668 7fxrxff.exe 688 jjjvp.exe 1920 xlxxxxf.exe 864 frxrxxf.exe 2484 xrlrllx.exe 764 htnnnh.exe 2660 fxllrxl.exe 1840 3tnnnn.exe 1532 rlxrxrx.exe 2932 3ttnbt.exe 2876 1httbb.exe 2736 ddjjp.exe 2840 lrlrffr.exe 2960 ththhb.exe 2600 tnbhtb.exe 2608 vpddj.exe 2640 1fxxlfl.exe 2136 nhhnhn.exe 1264 thhhhh.exe 2616 1djjj.exe 2104 ffxflrf.exe 2896 tnbttn.exe 2900 hbnntn.exe 1520 jvppv.exe 2812 lxrrxrx.exe 1400 tntbhh.exe 2988 vvjdp.exe 2972 3rllxxl.exe 2544 xxxfllx.exe 1868 nnhnnt.exe 1924 3dvvj.exe 2968 pjppv.exe 1568 9frrffr.exe 3032 9ntnbh.exe 2180 9hbbhh.exe 316 pjvdj.exe 1996 1lxlllr.exe 956 9nbbtn.exe 628 5dvdp.exe 2528 5pjpp.exe -
resource yara_rule behavioral1/memory/1840-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-53-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2388-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-90-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2096-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-219-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/864-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-899-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2684 1840 27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe 31 PID 1840 wrote to memory of 2684 1840 27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe 31 PID 1840 wrote to memory of 2684 1840 27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe 31 PID 1840 wrote to memory of 2684 1840 27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe 31 PID 2684 wrote to memory of 2844 2684 pjdjv.exe 32 PID 2684 wrote to memory of 2844 2684 pjdjv.exe 32 PID 2684 wrote to memory of 2844 2684 pjdjv.exe 32 PID 2684 wrote to memory of 2844 2684 pjdjv.exe 32 PID 2844 wrote to memory of 2700 2844 lxrfffl.exe 33 PID 2844 wrote to memory of 2700 2844 lxrfffl.exe 33 PID 2844 wrote to memory of 2700 2844 lxrfffl.exe 33 PID 2844 wrote to memory of 2700 2844 lxrfffl.exe 33 PID 2700 wrote to memory of 3016 2700 tnthhb.exe 34 PID 2700 wrote to memory of 3016 2700 tnthhb.exe 34 PID 2700 wrote to memory of 3016 2700 tnthhb.exe 34 PID 2700 wrote to memory of 3016 2700 tnthhb.exe 34 PID 3016 wrote to memory of 2600 3016 vpvjv.exe 35 PID 3016 wrote to memory of 2600 3016 vpvjv.exe 35 PID 3016 wrote to memory of 2600 3016 vpvjv.exe 35 PID 3016 wrote to memory of 2600 3016 vpvjv.exe 35 PID 2600 wrote to memory of 2928 2600 7lxxxfl.exe 36 PID 2600 wrote to memory of 2928 2600 7lxxxfl.exe 36 PID 2600 wrote to memory of 2928 2600 7lxxxfl.exe 36 PID 2600 wrote to memory of 2928 2600 7lxxxfl.exe 36 PID 2928 wrote to memory of 2696 2928 tnnntb.exe 37 PID 2928 wrote to memory of 2696 2928 tnnntb.exe 37 PID 2928 wrote to memory of 2696 2928 tnnntb.exe 37 PID 2928 wrote to memory of 2696 2928 tnnntb.exe 37 PID 2696 wrote to memory of 2388 2696 1lxxxxf.exe 38 PID 2696 wrote to memory of 2388 2696 1lxxxxf.exe 38 PID 2696 wrote to memory of 2388 2696 1lxxxxf.exe 38 PID 2696 wrote to memory of 2388 2696 1lxxxxf.exe 38 PID 2388 wrote to memory of 2992 2388 xrlflrr.exe 39 PID 2388 wrote to memory of 2992 2388 xrlflrr.exe 39 PID 2388 wrote to memory of 2992 2388 xrlflrr.exe 39 PID 2388 wrote to memory of 2992 2388 xrlflrr.exe 39 PID 2992 wrote to memory of 2224 2992 7tbhtb.exe 40 PID 2992 wrote to memory of 2224 2992 7tbhtb.exe 40 PID 2992 wrote to memory of 2224 2992 7tbhtb.exe 40 PID 2992 wrote to memory of 2224 2992 7tbhtb.exe 40 PID 2224 wrote to memory of 2096 2224 ttnbbn.exe 41 PID 2224 wrote to memory of 2096 2224 ttnbbn.exe 41 PID 2224 wrote to memory of 2096 2224 ttnbbn.exe 41 PID 2224 wrote to memory of 2096 2224 ttnbbn.exe 41 PID 2096 wrote to memory of 2064 2096 xlffrxl.exe 42 PID 2096 wrote to memory of 2064 2096 xlffrxl.exe 42 PID 2096 wrote to memory of 2064 2096 xlffrxl.exe 42 PID 2096 wrote to memory of 2064 2096 xlffrxl.exe 42 PID 2064 wrote to memory of 2780 2064 nhbthh.exe 43 PID 2064 wrote to memory of 2780 2064 nhbthh.exe 43 PID 2064 wrote to memory of 2780 2064 nhbthh.exe 43 PID 2064 wrote to memory of 2780 2064 nhbthh.exe 43 PID 2780 wrote to memory of 2912 2780 rrllrrf.exe 44 PID 2780 wrote to memory of 2912 2780 rrllrrf.exe 44 PID 2780 wrote to memory of 2912 2780 rrllrrf.exe 44 PID 2780 wrote to memory of 2912 2780 rrllrrf.exe 44 PID 2912 wrote to memory of 2940 2912 dvddj.exe 45 PID 2912 wrote to memory of 2940 2912 dvddj.exe 45 PID 2912 wrote to memory of 2940 2912 dvddj.exe 45 PID 2912 wrote to memory of 2940 2912 dvddj.exe 45 PID 2940 wrote to memory of 2996 2940 frflllr.exe 46 PID 2940 wrote to memory of 2996 2940 frflllr.exe 46 PID 2940 wrote to memory of 2996 2940 frflllr.exe 46 PID 2940 wrote to memory of 2996 2940 frflllr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe"C:\Users\Admin\AppData\Local\Temp\27c8524482b53671b0f0d4194aa4ba70bb06bc6da78476e3e9ee081a13929373.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\pjdjv.exec:\pjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lxrfffl.exec:\lxrfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tnthhb.exec:\tnthhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vpvjv.exec:\vpvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7lxxxfl.exec:\7lxxxfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tnnntb.exec:\tnnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\1lxxxxf.exec:\1lxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrlflrr.exec:\xrlflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\7tbhtb.exec:\7tbhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\ttnbbn.exec:\ttnbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xlffrxl.exec:\xlffrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nhbthh.exec:\nhbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\rrllrrf.exec:\rrllrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dvddj.exec:\dvddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\frflllr.exec:\frflllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vjdvd.exec:\vjdvd.exe17⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lfrxrrx.exec:\lfrxrrx.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\1bnbhb.exec:\1bnbhb.exe19⤵
- Executes dropped EXE
PID:296 -
\??\c:\vpjjp.exec:\vpjjp.exe20⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9rlxfrx.exec:\9rlxfrx.exe21⤵
- Executes dropped EXE
PID:2368 -
\??\c:\3ntbnh.exec:\3ntbnh.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\llfxlxr.exec:\llfxlxr.exe23⤵
- Executes dropped EXE
PID:1184 -
\??\c:\nnbbhh.exec:\nnbbhh.exe24⤵
- Executes dropped EXE
PID:1116 -
\??\c:\7pjpv.exec:\7pjpv.exe25⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7fxrxff.exec:\7fxrxff.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jjjvp.exec:\jjjvp.exe27⤵
- Executes dropped EXE
PID:688 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe28⤵
- Executes dropped EXE
PID:1920 -
\??\c:\frxrxxf.exec:\frxrxxf.exe29⤵
- Executes dropped EXE
PID:864 -
\??\c:\xrlrllx.exec:\xrlrllx.exe30⤵
- Executes dropped EXE
PID:2484 -
\??\c:\htnnnh.exec:\htnnnh.exe31⤵
- Executes dropped EXE
PID:764 -
\??\c:\fxllrxl.exec:\fxllrxl.exe32⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3tnnnn.exec:\3tnnnn.exe33⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe34⤵
- Executes dropped EXE
PID:1532 -
\??\c:\3ttnbt.exec:\3ttnbt.exe35⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1httbb.exec:\1httbb.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ddjjp.exec:\ddjjp.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lrlrffr.exec:\lrlrffr.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ththhb.exec:\ththhb.exe39⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnbhtb.exec:\tnbhtb.exe40⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpddj.exec:\vpddj.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1fxxlfl.exec:\1fxxlfl.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhhnhn.exec:\nhhnhn.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thhhhh.exec:\thhhhh.exe44⤵
- Executes dropped EXE
PID:1264 -
\??\c:\1djjj.exec:\1djjj.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ffxflrf.exec:\ffxflrf.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tnbttn.exec:\tnbttn.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hbnntn.exec:\hbnntn.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jvppv.exec:\jvppv.exe49⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tntbhh.exec:\tntbhh.exe51⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vvjdp.exec:\vvjdp.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3rllxxl.exec:\3rllxxl.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xxxfllx.exec:\xxxfllx.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nnhnnt.exec:\nnhnnt.exe55⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3dvvj.exec:\3dvvj.exe56⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjppv.exec:\pjppv.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9frrffr.exec:\9frrffr.exe58⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9ntnbh.exec:\9ntnbh.exe59⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9hbbhh.exec:\9hbbhh.exe60⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjvdj.exec:\pjvdj.exe61⤵
- Executes dropped EXE
PID:316 -
\??\c:\1lxlllr.exec:\1lxlllr.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9nbbtn.exec:\9nbbtn.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\5dvdp.exec:\5dvdp.exe64⤵
- Executes dropped EXE
PID:628 -
\??\c:\5pjpp.exec:\5pjpp.exe65⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7frrrxx.exec:\7frrrxx.exe66⤵PID:1716
-
\??\c:\5thhhh.exec:\5thhhh.exe67⤵PID:1356
-
\??\c:\jvjjp.exec:\jvjjp.exe68⤵PID:888
-
\??\c:\pjddd.exec:\pjddd.exe69⤵PID:820
-
\??\c:\lfxxffl.exec:\lfxxffl.exe70⤵PID:1460
-
\??\c:\nhhntt.exec:\nhhntt.exe71⤵PID:2424
-
\??\c:\pjjjv.exec:\pjjjv.exe72⤵PID:1636
-
\??\c:\lffllrx.exec:\lffllrx.exe73⤵PID:2344
-
\??\c:\hbtthh.exec:\hbtthh.exe74⤵PID:2412
-
\??\c:\nbthtb.exec:\nbthtb.exe75⤵PID:1776
-
\??\c:\dvpdj.exec:\dvpdj.exe76⤵PID:2864
-
\??\c:\ffrxxfr.exec:\ffrxxfr.exe77⤵PID:2852
-
\??\c:\7rfflrf.exec:\7rfflrf.exe78⤵PID:2860
-
\??\c:\nthbbt.exec:\nthbbt.exe79⤵PID:2728
-
\??\c:\5pjdd.exec:\5pjdd.exe80⤵PID:2664
-
\??\c:\5lxfffr.exec:\5lxfffr.exe81⤵PID:2688
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe82⤵PID:2960
-
\??\c:\5nbhnn.exec:\5nbhnn.exe83⤵PID:2580
-
\??\c:\jdpvv.exec:\jdpvv.exe84⤵PID:2648
-
\??\c:\vjvpp.exec:\vjvpp.exe85⤵PID:2456
-
\??\c:\lfffflx.exec:\lfffflx.exe86⤵PID:2100
-
\??\c:\lfxrlll.exec:\lfxrlll.exe87⤵PID:2404
-
\??\c:\nbnnbn.exec:\nbnnbn.exe88⤵PID:2436
-
\??\c:\1pjpv.exec:\1pjpv.exe89⤵PID:1348
-
\??\c:\5flfxxf.exec:\5flfxxf.exe90⤵PID:2784
-
\??\c:\1lxxlff.exec:\1lxxlff.exe91⤵PID:1728
-
\??\c:\tnhntb.exec:\tnhntb.exe92⤵PID:2760
-
\??\c:\dpjpd.exec:\dpjpd.exe93⤵PID:1416
-
\??\c:\dvjdj.exec:\dvjdj.exe94⤵PID:2892
-
\??\c:\lfrxflx.exec:\lfrxflx.exe95⤵PID:2884
-
\??\c:\nhbbht.exec:\nhbbht.exe96⤵PID:328
-
\??\c:\1jddp.exec:\1jddp.exe97⤵PID:592
-
\??\c:\ddjpv.exec:\ddjpv.exe98⤵PID:2140
-
\??\c:\9xffrrx.exec:\9xffrrx.exe99⤵PID:1096
-
\??\c:\nbnnnh.exec:\nbnnnh.exe100⤵PID:1972
-
\??\c:\7jdjv.exec:\7jdjv.exe101⤵PID:1724
-
\??\c:\vpvpv.exec:\vpvpv.exe102⤵PID:2556
-
\??\c:\rfrfffl.exec:\rfrfffl.exe103⤵PID:1740
-
\??\c:\bhbbhb.exec:\bhbbhb.exe104⤵PID:2268
-
\??\c:\vjpdd.exec:\vjpdd.exe105⤵PID:1296
-
\??\c:\9lfrflr.exec:\9lfrflr.exe106⤵PID:1280
-
\??\c:\xrxfffl.exec:\xrxfffl.exe107⤵PID:1180
-
\??\c:\tbhhnn.exec:\tbhhnn.exe108⤵PID:1980
-
\??\c:\dpjdd.exec:\dpjdd.exe109⤵PID:848
-
\??\c:\dvjjp.exec:\dvjjp.exe110⤵PID:268
-
\??\c:\5frxfxx.exec:\5frxfxx.exe111⤵PID:2524
-
\??\c:\bnbhnn.exec:\bnbhnn.exe112⤵PID:292
-
\??\c:\9jvdd.exec:\9jvdd.exe113⤵PID:1412
-
\??\c:\vpddp.exec:\vpddp.exe114⤵PID:1780
-
\??\c:\3flfffl.exec:\3flfffl.exe115⤵PID:764
-
\??\c:\bthnbh.exec:\bthnbh.exe116⤵PID:2192
-
\??\c:\ddppv.exec:\ddppv.exe117⤵PID:2660
-
\??\c:\pdvdp.exec:\pdvdp.exe118⤵PID:1564
-
\??\c:\9fxxlrf.exec:\9fxxlrf.exe119⤵PID:2848
-
\??\c:\5thbbh.exec:\5thbbh.exe120⤵PID:2856
-
\??\c:\ddvvd.exec:\ddvvd.exe121⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-