Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
85s -
max time network
78s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 19:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe
Resource
win7-20240215-en
0 signatures
150 seconds
General
-
Target
4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe
-
Size
92KB
-
MD5
1658c60369d01179657c8c0b0658d07f
-
SHA1
d4ad848cf2d23c0928e763ecba17778eb9275fbc
-
SHA256
4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84
-
SHA512
6adecbc41a8224e51ab68381c5c61fcad72e8d9d489d606c6035ba88a94a825e1e1f62737a88730431b0c8f11c875314335fe7a345d7381c67c587b7d496b90b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrA3:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnrI
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral2/memory/4048-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-248-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-393-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-396-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 59 IoCs
resource yara_rule behavioral2/memory/4048-3-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3960-10-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3960-14-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4144-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4144-20-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2856-29-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/228-39-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-44-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-56-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4884-65-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1016-72-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1380-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1380-80-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3540-87-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1252-94-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/872-101-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-122-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2264-127-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5000-131-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4348-139-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4276-144-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3664-152-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1384-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2428-173-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1892-176-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1892-179-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-193-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-198-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3892-200-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2308-207-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/908-220-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1036-236-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1036-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1108-248-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2936-253-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1856-261-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3544-269-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2076-287-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/116-286-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2076-290-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2276-299-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2276-297-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4868-304-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4260-308-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1616-313-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-330-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2516-332-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1448-336-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4284-355-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2944-368-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3800-381-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3012-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/408-393-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/208-396-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2824-400-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2200-404-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3960 xxxrrll.exe 4144 ffrlfxf.exe 2856 5bbbbt.exe 228 jdvvj.exe 2936 frxrllf.exe 5020 ppvdj.exe 2432 7hhhbh.exe 4884 xlrlrrf.exe 1016 bbnntb.exe 1380 9flfxxx.exe 3540 7jpjd.exe 1252 btttnn.exe 872 rrrxrxx.exe 2280 ntbbtt.exe 984 ppvpd.exe 2264 fffxxxx.exe 5000 hbttnn.exe 4348 7frrllf.exe 4276 jjvdj.exe 3664 xlffxxx.exe 1408 3hhhbb.exe 1384 nhbbtt.exe 2428 ppjdp.exe 1892 nhtbtt.exe 1420 jddvd.exe 4480 fxxrrrr.exe 3892 tnntnn.exe 2308 7djdp.exe 2572 3tnhtn.exe 908 jpjjj.exe 4824 nhbtbb.exe 3636 rrrrxxr.exe 1036 tbnnnh.exe 1700 djjpj.exe 1108 bnnnhh.exe 2936 pjddp.exe 2180 bbbbbb.exe 1856 3fxrfxl.exe 3544 9htnnh.exe 4884 3rxrrll.exe 3212 ppvvv.exe 2632 9xrlffx.exe 116 dpppv.exe 2076 rlfrfxr.exe 1324 tntnnn.exe 2276 fxrfrff.exe 4868 fxrlxrl.exe 4260 vpddj.exe 1616 xfrxxll.exe 4508 hhbbtn.exe 4500 jpvpj.exe 5096 htbtnt.exe 2516 dpdvp.exe 1448 rrxlxrf.exe 3288 hbhhhh.exe 1940 lflxfxf.exe 1588 bbttbb.exe 4284 5dddv.exe 2292 bttnhb.exe 1892 3lffrrl.exe 2944 bhbthb.exe 3560 lrrrllf.exe 2012 hhtttn.exe 3800 frfxfrl.exe -
resource yara_rule behavioral2/memory/4048-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-248-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-269-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-297-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-332-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-355-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-368-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-381-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-393-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-396-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-404-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4048 wrote to memory of 3960 4048 4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe 90 PID 4048 wrote to memory of 3960 4048 4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe 90 PID 4048 wrote to memory of 3960 4048 4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe 90 PID 3960 wrote to memory of 4144 3960 xxxrrll.exe 91 PID 3960 wrote to memory of 4144 3960 xxxrrll.exe 91 PID 3960 wrote to memory of 4144 3960 xxxrrll.exe 91 PID 4144 wrote to memory of 2856 4144 ffrlfxf.exe 92 PID 4144 wrote to memory of 2856 4144 ffrlfxf.exe 92 PID 4144 wrote to memory of 2856 4144 ffrlfxf.exe 92 PID 2856 wrote to memory of 228 2856 5bbbbt.exe 93 PID 2856 wrote to memory of 228 2856 5bbbbt.exe 93 PID 2856 wrote to memory of 228 2856 5bbbbt.exe 93 PID 228 wrote to memory of 2936 228 jdvvj.exe 94 PID 228 wrote to memory of 2936 228 jdvvj.exe 94 PID 228 wrote to memory of 2936 228 jdvvj.exe 94 PID 2936 wrote to memory of 5020 2936 frxrllf.exe 95 PID 2936 wrote to memory of 5020 2936 frxrllf.exe 95 PID 2936 wrote to memory of 5020 2936 frxrllf.exe 95 PID 5020 wrote to memory of 2432 5020 ppvdj.exe 96 PID 5020 wrote to memory of 2432 5020 ppvdj.exe 96 PID 5020 wrote to memory of 2432 5020 ppvdj.exe 96 PID 2432 wrote to memory of 4884 2432 7hhhbh.exe 97 PID 2432 wrote to memory of 4884 2432 7hhhbh.exe 97 PID 2432 wrote to memory of 4884 2432 7hhhbh.exe 97 PID 4884 wrote to memory of 1016 4884 xlrlrrf.exe 98 PID 4884 wrote to memory of 1016 4884 xlrlrrf.exe 98 PID 4884 wrote to memory of 1016 4884 xlrlrrf.exe 98 PID 1016 wrote to memory of 1380 1016 bbnntb.exe 99 PID 1016 wrote to memory of 1380 1016 bbnntb.exe 99 PID 1016 wrote to memory of 1380 1016 bbnntb.exe 99 PID 1380 wrote to memory of 3540 1380 9flfxxx.exe 100 PID 1380 wrote to memory of 3540 1380 9flfxxx.exe 100 PID 1380 wrote to memory of 3540 1380 9flfxxx.exe 100 PID 3540 wrote to memory of 1252 3540 7jpjd.exe 101 PID 3540 wrote to memory of 1252 3540 7jpjd.exe 101 PID 3540 wrote to memory of 1252 3540 7jpjd.exe 101 PID 1252 wrote to memory of 872 1252 btttnn.exe 102 PID 1252 wrote to memory of 872 1252 btttnn.exe 102 PID 1252 wrote to memory of 872 1252 btttnn.exe 102 PID 872 wrote to memory of 2280 872 rrrxrxx.exe 103 PID 872 wrote to memory of 2280 872 rrrxrxx.exe 103 PID 872 wrote to memory of 2280 872 rrrxrxx.exe 103 PID 2280 wrote to memory of 984 2280 ntbbtt.exe 104 PID 2280 wrote to memory of 984 2280 ntbbtt.exe 104 PID 2280 wrote to memory of 984 2280 ntbbtt.exe 104 PID 984 wrote to memory of 2264 984 ppvpd.exe 105 PID 984 wrote to memory of 2264 984 ppvpd.exe 105 PID 984 wrote to memory of 2264 984 ppvpd.exe 105 PID 2264 wrote to memory of 5000 2264 fffxxxx.exe 106 PID 2264 wrote to memory of 5000 2264 fffxxxx.exe 106 PID 2264 wrote to memory of 5000 2264 fffxxxx.exe 106 PID 5000 wrote to memory of 4348 5000 hbttnn.exe 107 PID 5000 wrote to memory of 4348 5000 hbttnn.exe 107 PID 5000 wrote to memory of 4348 5000 hbttnn.exe 107 PID 4348 wrote to memory of 4276 4348 7frrllf.exe 108 PID 4348 wrote to memory of 4276 4348 7frrllf.exe 108 PID 4348 wrote to memory of 4276 4348 7frrllf.exe 108 PID 4276 wrote to memory of 3664 4276 jjvdj.exe 109 PID 4276 wrote to memory of 3664 4276 jjvdj.exe 109 PID 4276 wrote to memory of 3664 4276 jjvdj.exe 109 PID 3664 wrote to memory of 1408 3664 xlffxxx.exe 110 PID 3664 wrote to memory of 1408 3664 xlffxxx.exe 110 PID 3664 wrote to memory of 1408 3664 xlffxxx.exe 110 PID 1408 wrote to memory of 1384 1408 3hhhbb.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe"C:\Users\Admin\AppData\Local\Temp\4c31a848fc556ee78e8c3966349a2ed28083316d09134b794f2dad65e36f7c84.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\xxxrrll.exec:\xxxrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\ffrlfxf.exec:\ffrlfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\5bbbbt.exec:\5bbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jdvvj.exec:\jdvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\frxrllf.exec:\frxrllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppvdj.exec:\ppvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\7hhhbh.exec:\7hhhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xlrlrrf.exec:\xlrlrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\bbnntb.exec:\bbnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\9flfxxx.exec:\9flfxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\7jpjd.exec:\7jpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\btttnn.exec:\btttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\rrrxrxx.exec:\rrrxrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\ntbbtt.exec:\ntbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\ppvpd.exec:\ppvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\fffxxxx.exec:\fffxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbttnn.exec:\hbttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\7frrllf.exec:\7frrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\jjvdj.exec:\jjvdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\xlffxxx.exec:\xlffxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\3hhhbb.exec:\3hhhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\nhbbtt.exec:\nhbbtt.exe23⤵
- Executes dropped EXE
PID:1384 -
\??\c:\ppjdp.exec:\ppjdp.exe24⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nhtbtt.exec:\nhtbtt.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jddvd.exec:\jddvd.exe26⤵
- Executes dropped EXE
PID:1420 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe27⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tnntnn.exec:\tnntnn.exe28⤵
- Executes dropped EXE
PID:3892 -
\??\c:\7djdp.exec:\7djdp.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3tnhtn.exec:\3tnhtn.exe30⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jpjjj.exec:\jpjjj.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhbtbb.exec:\nhbtbb.exe32⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe33⤵
- Executes dropped EXE
PID:3636 -
\??\c:\tbnnnh.exec:\tbnnnh.exe34⤵
- Executes dropped EXE
PID:1036 -
\??\c:\djjpj.exec:\djjpj.exe35⤵
- Executes dropped EXE
PID:1700 -
\??\c:\bnnnhh.exec:\bnnnhh.exe36⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pjddp.exec:\pjddp.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bbbbbb.exec:\bbbbbb.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3fxrfxl.exec:\3fxrfxl.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9htnnh.exec:\9htnnh.exe40⤵
- Executes dropped EXE
PID:3544 -
\??\c:\3rxrrll.exec:\3rxrrll.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\ppvvv.exec:\ppvvv.exe42⤵
- Executes dropped EXE
PID:3212 -
\??\c:\9xrlffx.exec:\9xrlffx.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dpppv.exec:\dpppv.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\rlfrfxr.exec:\rlfrfxr.exe45⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tntnnn.exec:\tntnnn.exe46⤵
- Executes dropped EXE
PID:1324 -
\??\c:\fxrfrff.exec:\fxrfrff.exe47⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe48⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vpddj.exec:\vpddj.exe49⤵
- Executes dropped EXE
PID:4260 -
\??\c:\xfrxxll.exec:\xfrxxll.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hhbbtn.exec:\hhbbtn.exe51⤵
- Executes dropped EXE
PID:4508 -
\??\c:\jpvpj.exec:\jpvpj.exe52⤵
- Executes dropped EXE
PID:4500 -
\??\c:\htbtnt.exec:\htbtnt.exe53⤵
- Executes dropped EXE
PID:5096 -
\??\c:\dpdvp.exec:\dpdvp.exe54⤵
- Executes dropped EXE
PID:2516 -
\??\c:\rrxlxrf.exec:\rrxlxrf.exe55⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbhhhh.exec:\hbhhhh.exe56⤵
- Executes dropped EXE
PID:3288 -
\??\c:\lflxfxf.exec:\lflxfxf.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbttbb.exec:\bbttbb.exe58⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5dddv.exec:\5dddv.exe59⤵
- Executes dropped EXE
PID:4284 -
\??\c:\bttnhb.exec:\bttnhb.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3lffrrl.exec:\3lffrrl.exe61⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bhbthb.exec:\bhbthb.exe62⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lrrrllf.exec:\lrrrllf.exe63⤵
- Executes dropped EXE
PID:3560 -
\??\c:\hhtttn.exec:\hhtttn.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\frfxfrl.exec:\frfxfrl.exe65⤵
- Executes dropped EXE
PID:3800 -
\??\c:\9nbnbb.exec:\9nbnbb.exe66⤵PID:3012
-
\??\c:\5pvvj.exec:\5pvvj.exe67⤵PID:408
-
\??\c:\ttnthb.exec:\ttnthb.exe68⤵PID:208
-
\??\c:\vvjdj.exec:\vvjdj.exe69⤵PID:2824
-
\??\c:\thbnnn.exec:\thbnnn.exe70⤵PID:2200
-
\??\c:\vpvpd.exec:\vpvpd.exe71⤵PID:884
-
\??\c:\nbhbtt.exec:\nbhbtt.exe72⤵PID:2972
-
\??\c:\dvppj.exec:\dvppj.exe73⤵PID:3148
-
\??\c:\hnnbtn.exec:\hnnbtn.exe74⤵PID:2180
-
\??\c:\rflfffx.exec:\rflfffx.exe75⤵PID:4588
-
\??\c:\fxffllr.exec:\fxffllr.exe76⤵PID:4884
-
\??\c:\7bnntn.exec:\7bnntn.exe77⤵PID:3212
-
\??\c:\xrxrrfx.exec:\xrxrrfx.exe78⤵PID:4724
-
\??\c:\1nhhtn.exec:\1nhhtn.exe79⤵PID:1096
-
\??\c:\1ppjd.exec:\1ppjd.exe80⤵PID:3568
-
\??\c:\hhhhtb.exec:\hhhhtb.exe81⤵PID:1388
-
\??\c:\5vjvd.exec:\5vjvd.exe82⤵PID:2280
-
\??\c:\9tnbnh.exec:\9tnbnh.exe83⤵PID:4260
-
\??\c:\3xrlrlx.exec:\3xrlrlx.exe84⤵PID:4804
-
\??\c:\thbthb.exec:\thbthb.exe85⤵PID:2612
-
\??\c:\dvppv.exec:\dvppv.exe86⤵PID:4276
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe87⤵PID:3752
-
\??\c:\tbtbbh.exec:\tbtbbh.exe88⤵PID:3288
-
\??\c:\vddvv.exec:\vddvv.exe89⤵PID:2960
-
\??\c:\tnhbnh.exec:\tnhbnh.exe90⤵PID:444
-
\??\c:\jvvdp.exec:\jvvdp.exe91⤵PID:2456
-
\??\c:\xllflfr.exec:\xllflfr.exe92⤵PID:2784
-
\??\c:\jdjvj.exec:\jdjvj.exe93⤵PID:3868
-
\??\c:\bbbbhb.exec:\bbbbhb.exe94⤵PID:1604
-
\??\c:\pjjdp.exec:\pjjdp.exe95⤵PID:4932
-
\??\c:\lxlrlxl.exec:\lxlrlxl.exe96⤵PID:4824
-
\??\c:\5rlfxrf.exec:\5rlfxrf.exe97⤵PID:4412
-
\??\c:\thbnnh.exec:\thbnnh.exe98⤵PID:2200
-
\??\c:\jvvdp.exec:\jvvdp.exe99⤵PID:2476
-
\??\c:\lxfxlrf.exec:\lxfxlrf.exe100⤵PID:216
-
\??\c:\htthtn.exec:\htthtn.exe101⤵PID:5104
-
\??\c:\fllflfx.exec:\fllflfx.exe102⤵PID:740
-
\??\c:\btnbnh.exec:\btnbnh.exe103⤵PID:4588
-
\??\c:\vjdpv.exec:\vjdpv.exe104⤵PID:4884
-
\??\c:\tnbthb.exec:\tnbthb.exe105⤵PID:3212
-
\??\c:\dvjdp.exec:\dvjdp.exe106⤵PID:4432
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe107⤵PID:3300
-
\??\c:\hnttnh.exec:\hnttnh.exe108⤵PID:2788
-
\??\c:\vpjvj.exec:\vpjvj.exe109⤵PID:2264
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe110⤵PID:2280
-
\??\c:\dvvpj.exec:\dvvpj.exe111⤵PID:4348
-
\??\c:\rxxlrlx.exec:\rxxlrlx.exe112⤵PID:3912
-
\??\c:\nbhbnn.exec:\nbhbnn.exe113⤵PID:5032
-
\??\c:\pjpdj.exec:\pjpdj.exe114⤵PID:3468
-
\??\c:\5fxlxrl.exec:\5fxlxrl.exe115⤵PID:844
-
\??\c:\tnnbtn.exec:\tnnbtn.exe116⤵PID:4224
-
\??\c:\jvvpd.exec:\jvvpd.exe117⤵PID:3384
-
\??\c:\9nhbnn.exec:\9nhbnn.exe118⤵PID:1888
-
\??\c:\pdjdp.exec:\pdjdp.exe119⤵PID:1892
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe120⤵PID:4828
-
\??\c:\7djvp.exec:\7djvp.exe121⤵PID:2308
-
\??\c:\xllffxx.exec:\xllffxx.exe122⤵PID:2100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-