Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe
-
Size
312KB
-
MD5
affbbe9b24f78ab4da6fdb9a52e56667
-
SHA1
9d482d2ccdf1ebb5d23e92f026b1da1994fff423
-
SHA256
c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8
-
SHA512
e9ce8f7d5785b1527bff05c809ca00a49ca1624ec448d88759cfc2bf6ad7c539fc0e4b3a183a1bd2ee1af77cbfd8e2fac1ad7835c88c8b9c9d27a680c243c5f8
-
SSDEEP
6144:n3C9BRo/AIX2h97aUzpbBj3+b2ziJC39QS8hDJd+Q7ZLbjwu:n3C9uDC97aUFbZ42ziM39QS8hDJd+Q77
Malware Config
Signatures
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral2/memory/4364-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/456-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-334-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-356-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-373-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-379-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-388-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-446-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 60 IoCs
resource yara_rule behavioral2/memory/4364-2-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4364-4-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1396-18-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1396-19-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2444-26-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-34-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-33-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3288-38-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1644-41-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/220-48-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/220-50-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5080-62-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5108-70-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1836-76-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1836-78-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-86-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4480-84-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1824-92-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1824-96-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5060-105-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5116-113-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2356-120-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4012-132-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4420-141-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3700-148-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2384-154-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2292-163-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5056-167-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3576-174-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/816-191-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2060-195-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2072-201-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2072-204-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/556-209-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/556-210-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3360-223-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4644-231-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4620-241-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2612-249-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/456-254-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1780-259-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2600-278-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2924-292-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2136-312-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3248-331-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-334-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4220-336-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3188-344-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1272-349-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2896-356-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3692-359-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/1276-369-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4132-373-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4284-379-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/2620-388-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3572-405-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/5044-423-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/4840-436-0x0000000000400000-0x0000000000429000-memory.dmp UPX behavioral2/memory/3132-446-0x0000000000400000-0x0000000000429000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 216 fxxrllf.exe 1396 ppjdv.exe 2444 bthbbh.exe 3288 vppjd.exe 1644 htnhhb.exe 220 vdjdd.exe 3428 htbbbh.exe 5080 rlrrrxx.exe 5108 1btnnb.exe 1836 rlrrllf.exe 4480 vjvpp.exe 1824 hhbhhh.exe 3248 rflfxxx.exe 5060 dpvvv.exe 5116 hbthnh.exe 2356 djvvd.exe 1272 ttttth.exe 4012 9lrlllr.exe 4420 hbbtnn.exe 3700 ffxrlxr.exe 2384 hbthbn.exe 2292 3flxlrr.exe 5056 rrrfxlx.exe 3576 dvppj.exe 468 bbbbbb.exe 816 rrlllxf.exe 2060 tbttnh.exe 2072 bnhbbb.exe 556 jdppp.exe 968 tbnhhn.exe 3360 dvpjd.exe 4644 3dpjj.exe 4588 rrrrrrr.exe 4620 9ppjj.exe 448 rrrlffx.exe 2612 ppppj.exe 456 bnnnnn.exe 1780 vjppp.exe 4956 lxflflr.exe 2528 1vdvp.exe 2024 3lrlllr.exe 2600 vjjvp.exe 2580 rllxrlf.exe 4884 jpvjd.exe 2924 frxrfrf.exe 2740 dvpdv.exe 856 3xrlxrf.exe 3020 hnthth.exe 1788 rrfxllf.exe 2136 jjpjv.exe 4968 rfrfffr.exe 3836 hhhbtt.exe 2196 lxxrffx.exe 3248 1pjdv.exe 4220 flrlflx.exe 2480 jvdvp.exe 3188 rxrfrlf.exe 1272 tnthnt.exe 2896 rlrrlrl.exe 3692 vjjdp.exe 3260 1nnbnn.exe 1276 lxxlxrf.exe 4132 hbhttn.exe 4284 ffxrfrl.exe -
resource yara_rule behavioral2/memory/4364-2-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/456-254-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-334-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-336-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-344-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1272-349-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-356-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-359-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-369-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-373-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-379-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-388-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-405-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-423-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-436-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-446-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 216 4364 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 86 PID 4364 wrote to memory of 216 4364 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 86 PID 4364 wrote to memory of 216 4364 c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe 86 PID 216 wrote to memory of 1396 216 fxxrllf.exe 87 PID 216 wrote to memory of 1396 216 fxxrllf.exe 87 PID 216 wrote to memory of 1396 216 fxxrllf.exe 87 PID 1396 wrote to memory of 2444 1396 ppjdv.exe 88 PID 1396 wrote to memory of 2444 1396 ppjdv.exe 88 PID 1396 wrote to memory of 2444 1396 ppjdv.exe 88 PID 2444 wrote to memory of 3288 2444 bthbbh.exe 89 PID 2444 wrote to memory of 3288 2444 bthbbh.exe 89 PID 2444 wrote to memory of 3288 2444 bthbbh.exe 89 PID 3288 wrote to memory of 1644 3288 vppjd.exe 90 PID 3288 wrote to memory of 1644 3288 vppjd.exe 90 PID 3288 wrote to memory of 1644 3288 vppjd.exe 90 PID 1644 wrote to memory of 220 1644 htnhhb.exe 91 PID 1644 wrote to memory of 220 1644 htnhhb.exe 91 PID 1644 wrote to memory of 220 1644 htnhhb.exe 91 PID 220 wrote to memory of 3428 220 vdjdd.exe 92 PID 220 wrote to memory of 3428 220 vdjdd.exe 92 PID 220 wrote to memory of 3428 220 vdjdd.exe 92 PID 3428 wrote to memory of 5080 3428 htbbbh.exe 93 PID 3428 wrote to memory of 5080 3428 htbbbh.exe 93 PID 3428 wrote to memory of 5080 3428 htbbbh.exe 93 PID 5080 wrote to memory of 5108 5080 rlrrrxx.exe 94 PID 5080 wrote to memory of 5108 5080 rlrrrxx.exe 94 PID 5080 wrote to memory of 5108 5080 rlrrrxx.exe 94 PID 5108 wrote to memory of 1836 5108 1btnnb.exe 95 PID 5108 wrote to memory of 1836 5108 1btnnb.exe 95 PID 5108 wrote to memory of 1836 5108 1btnnb.exe 95 PID 1836 wrote to memory of 4480 1836 rlrrllf.exe 96 PID 1836 wrote to memory of 4480 1836 rlrrllf.exe 96 PID 1836 wrote to memory of 4480 1836 rlrrllf.exe 96 PID 4480 wrote to memory of 1824 4480 vjvpp.exe 97 PID 4480 wrote to memory of 1824 4480 vjvpp.exe 97 PID 4480 wrote to memory of 1824 4480 vjvpp.exe 97 PID 1824 wrote to memory of 3248 1824 hhbhhh.exe 98 PID 1824 wrote to memory of 3248 1824 hhbhhh.exe 98 PID 1824 wrote to memory of 3248 1824 hhbhhh.exe 98 PID 3248 wrote to memory of 5060 3248 rflfxxx.exe 99 PID 3248 wrote to memory of 5060 3248 rflfxxx.exe 99 PID 3248 wrote to memory of 5060 3248 rflfxxx.exe 99 PID 5060 wrote to memory of 5116 5060 dpvvv.exe 100 PID 5060 wrote to memory of 5116 5060 dpvvv.exe 100 PID 5060 wrote to memory of 5116 5060 dpvvv.exe 100 PID 5116 wrote to memory of 2356 5116 hbthnh.exe 101 PID 5116 wrote to memory of 2356 5116 hbthnh.exe 101 PID 5116 wrote to memory of 2356 5116 hbthnh.exe 101 PID 2356 wrote to memory of 1272 2356 djvvd.exe 102 PID 2356 wrote to memory of 1272 2356 djvvd.exe 102 PID 2356 wrote to memory of 1272 2356 djvvd.exe 102 PID 1272 wrote to memory of 4012 1272 ttttth.exe 103 PID 1272 wrote to memory of 4012 1272 ttttth.exe 103 PID 1272 wrote to memory of 4012 1272 ttttth.exe 103 PID 4012 wrote to memory of 4420 4012 9lrlllr.exe 104 PID 4012 wrote to memory of 4420 4012 9lrlllr.exe 104 PID 4012 wrote to memory of 4420 4012 9lrlllr.exe 104 PID 4420 wrote to memory of 3700 4420 hbbtnn.exe 105 PID 4420 wrote to memory of 3700 4420 hbbtnn.exe 105 PID 4420 wrote to memory of 3700 4420 hbbtnn.exe 105 PID 3700 wrote to memory of 2384 3700 ffxrlxr.exe 107 PID 3700 wrote to memory of 2384 3700 ffxrlxr.exe 107 PID 3700 wrote to memory of 2384 3700 ffxrlxr.exe 107 PID 2384 wrote to memory of 2292 2384 hbthbn.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe"C:\Users\Admin\AppData\Local\Temp\c4b7ee6a2163b116d839f72ff38c6c0774ed6e83324664966a371fd416480de8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\fxxrllf.exec:\fxxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\ppjdv.exec:\ppjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\bthbbh.exec:\bthbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vppjd.exec:\vppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\htnhhb.exec:\htnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vdjdd.exec:\vdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\htbbbh.exec:\htbbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\1btnnb.exec:\1btnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\rlrrllf.exec:\rlrrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\vjvpp.exec:\vjvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\hhbhhh.exec:\hhbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rflfxxx.exec:\rflfxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\dpvvv.exec:\dpvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hbthnh.exec:\hbthnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\djvvd.exec:\djvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ttttth.exec:\ttttth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\9lrlllr.exec:\9lrlllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\hbbtnn.exec:\hbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\ffxrlxr.exec:\ffxrlxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\hbthbn.exec:\hbthbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\3flxlrr.exec:\3flxlrr.exe23⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rrrfxlx.exec:\rrrfxlx.exe24⤵
- Executes dropped EXE
PID:5056 -
\??\c:\dvppj.exec:\dvppj.exe25⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbbbbb.exec:\bbbbbb.exe26⤵
- Executes dropped EXE
PID:468 -
\??\c:\rrlllxf.exec:\rrlllxf.exe27⤵
- Executes dropped EXE
PID:816 -
\??\c:\tbttnh.exec:\tbttnh.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\bnhbbb.exec:\bnhbbb.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jdppp.exec:\jdppp.exe30⤵
- Executes dropped EXE
PID:556 -
\??\c:\tbnhhn.exec:\tbnhhn.exe31⤵
- Executes dropped EXE
PID:968 -
\??\c:\dvpjd.exec:\dvpjd.exe32⤵
- Executes dropped EXE
PID:3360 -
\??\c:\3dpjj.exec:\3dpjj.exe33⤵
- Executes dropped EXE
PID:4644 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe34⤵
- Executes dropped EXE
PID:4588 -
\??\c:\9ppjj.exec:\9ppjj.exe35⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rrrlffx.exec:\rrrlffx.exe36⤵
- Executes dropped EXE
PID:448 -
\??\c:\ppppj.exec:\ppppj.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bnnnnn.exec:\bnnnnn.exe38⤵
- Executes dropped EXE
PID:456 -
\??\c:\vjppp.exec:\vjppp.exe39⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lxflflr.exec:\lxflflr.exe40⤵
- Executes dropped EXE
PID:4956 -
\??\c:\1vdvp.exec:\1vdvp.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3lrlllr.exec:\3lrlllr.exe42⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjjvp.exec:\vjjvp.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rllxrlf.exec:\rllxrlf.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jpvjd.exec:\jpvjd.exe45⤵
- Executes dropped EXE
PID:4884 -
\??\c:\frxrfrf.exec:\frxrfrf.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvpdv.exec:\dvpdv.exe47⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3xrlxrf.exec:\3xrlxrf.exe48⤵
- Executes dropped EXE
PID:856 -
\??\c:\hnthth.exec:\hnthth.exe49⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrfxllf.exec:\rrfxllf.exe50⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jjpjv.exec:\jjpjv.exe51⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rfrfffr.exec:\rfrfffr.exe52⤵
- Executes dropped EXE
PID:4968 -
\??\c:\hhhbtt.exec:\hhhbtt.exe53⤵
- Executes dropped EXE
PID:3836 -
\??\c:\lxxrffx.exec:\lxxrffx.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1pjdv.exec:\1pjdv.exe55⤵
- Executes dropped EXE
PID:3248 -
\??\c:\flrlflx.exec:\flrlflx.exe56⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jvdvp.exec:\jvdvp.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rxrfrlf.exec:\rxrfrlf.exe58⤵
- Executes dropped EXE
PID:3188 -
\??\c:\tnthnt.exec:\tnthnt.exe59⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe60⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjjdp.exec:\vjjdp.exe61⤵
- Executes dropped EXE
PID:3692 -
\??\c:\1nnbnn.exec:\1nnbnn.exe62⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lxxlxrf.exec:\lxxlxrf.exe63⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbhttn.exec:\hbhttn.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\ffxrfrl.exec:\ffxrfrl.exe65⤵
- Executes dropped EXE
PID:4284 -
\??\c:\5bthth.exec:\5bthth.exe66⤵PID:1828
-
\??\c:\lrxlxxl.exec:\lrxlxxl.exe67⤵PID:2620
-
\??\c:\tbbthb.exec:\tbbthb.exe68⤵PID:2564
-
\??\c:\lxlffxl.exec:\lxlffxl.exe69⤵PID:4908
-
\??\c:\pvjvj.exec:\pvjvj.exe70⤵PID:3580
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe71⤵PID:3572
-
\??\c:\bhnhtn.exec:\bhnhtn.exe72⤵PID:3536
-
\??\c:\7lrlfff.exec:\7lrlfff.exe73⤵PID:4952
-
\??\c:\hbtbtb.exec:\hbtbtb.exe74⤵PID:496
-
\??\c:\lrllfrf.exec:\lrllfrf.exe75⤵PID:5044
-
\??\c:\bhnbtn.exec:\bhnbtn.exe76⤵PID:4812
-
\??\c:\5ddvv.exec:\5ddvv.exe77⤵PID:4268
-
\??\c:\ntnhtn.exec:\ntnhtn.exe78⤵PID:4840
-
\??\c:\dvdjv.exec:\dvdjv.exe79⤵PID:2524
-
\??\c:\3htnhb.exec:\3htnhb.exe80⤵PID:3132
-
\??\c:\7jpvv.exec:\7jpvv.exe81⤵PID:1696
-
\??\c:\lrxfrrf.exec:\lrxfrrf.exe82⤵PID:2232
-
\??\c:\3hnbtn.exec:\3hnbtn.exe83⤵PID:5100
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe84⤵PID:1408
-
\??\c:\thbttn.exec:\thbttn.exe85⤵PID:2212
-
\??\c:\pvvpj.exec:\pvvpj.exe86⤵PID:2724
-
\??\c:\9rlrfrf.exec:\9rlrfrf.exe87⤵PID:3252
-
\??\c:\nttnbt.exec:\nttnbt.exe88⤵PID:732
-
\??\c:\1tnhtn.exec:\1tnhtn.exe89⤵PID:640
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe90⤵PID:1236
-
\??\c:\hnbtht.exec:\hnbtht.exe91⤵PID:856
-
\??\c:\jvpvp.exec:\jvpvp.exe92⤵PID:3020
-
\??\c:\tnnhhh.exec:\tnnhhh.exe93⤵PID:3912
-
\??\c:\3pjvp.exec:\3pjvp.exe94⤵PID:4456
-
\??\c:\xffxlfx.exec:\xffxlfx.exe95⤵PID:3560
-
\??\c:\dvvpj.exec:\dvvpj.exe96⤵PID:4780
-
\??\c:\llxfxrr.exec:\llxfxrr.exe97⤵PID:1660
-
\??\c:\vjdvp.exec:\vjdvp.exe98⤵PID:452
-
\??\c:\rffxlfx.exec:\rffxlfx.exe99⤵PID:3340
-
\??\c:\3vvpd.exec:\3vvpd.exe100⤵PID:1628
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe101⤵PID:3468
-
\??\c:\5nbbtt.exec:\5nbbtt.exe102⤵PID:684
-
\??\c:\dpjdv.exec:\dpjdv.exe103⤵PID:1716
-
\??\c:\xfxlflf.exec:\xfxlflf.exe104⤵PID:4132
-
\??\c:\thhbnh.exec:\thhbnh.exe105⤵PID:5056
-
\??\c:\rrxlxrr.exec:\rrxlxrr.exe106⤵PID:1828
-
\??\c:\thhbnh.exec:\thhbnh.exe107⤵PID:4340
-
\??\c:\dvvdv.exec:\dvvdv.exe108⤵PID:468
-
\??\c:\xlxlrlx.exec:\xlxlrlx.exe109⤵PID:4544
-
\??\c:\3tbnbt.exec:\3tbnbt.exe110⤵PID:3128
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe111⤵PID:2144
-
\??\c:\bnnbtn.exec:\bnnbtn.exe112⤵PID:556
-
\??\c:\dpjvj.exec:\dpjvj.exe113⤵PID:4952
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe114⤵PID:496
-
\??\c:\djpdv.exec:\djpdv.exe115⤵PID:5044
-
\??\c:\lrxrrxx.exec:\lrxrrxx.exe116⤵PID:4812
-
\??\c:\pjpvd.exec:\pjpvd.exe117⤵PID:3844
-
\??\c:\xrffxrl.exec:\xrffxrl.exe118⤵PID:4004
-
\??\c:\jvpjj.exec:\jvpjj.exe119⤵PID:4504
-
\??\c:\3vpdp.exec:\3vpdp.exe120⤵PID:3304
-
\??\c:\rffrfxr.exec:\rffrfxr.exe121⤵PID:2232
-
\??\c:\jdpjd.exec:\jdpjd.exe122⤵PID:3420
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-