Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 01:57
Behavioral task
behavioral1
Sample
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe
Resource
win7-20240220-en
6 signatures
150 seconds
General
-
Target
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe
-
Size
540KB
-
MD5
872ee778dd8ae35319bc127011e734ee
-
SHA1
78aea52817427d1d8b24f2828a6fcbd617e44507
-
SHA256
9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b
-
SHA512
4fa12ddd2db2c858909ce2ed380e17dc632a899b692d04bea8ebe094626abbca450f17c1ff5ec19f9b3d5475b2318d63b5efe9a5d40ecaa2fc44583ba4a29cc3
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoDxL:i4wFHoSEsIR7seFaKHpv/VycgE81lg2
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4920-15-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3896-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3040-5-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3024-23-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1848-25-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4200-37-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3224-32-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/464-44-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4052-55-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4872-49-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3936-65-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3292-68-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5020-78-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4936-106-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2596-105-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2980-104-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/408-92-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/116-74-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1932-115-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2248-121-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4960-130-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1300-146-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4944-152-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3216-155-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2040-160-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3908-171-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3740-182-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2408-186-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4000-195-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3864-197-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/744-201-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2448-204-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5024-211-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1572-222-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3344-226-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3024-240-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4424-241-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4504-245-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1676-264-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2576-268-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2876-270-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4952-276-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2028-297-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3168-301-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/676-308-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4528-328-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3032-346-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3144-362-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3400-365-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1312-371-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2256-393-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/824-408-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4464-412-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3868-440-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4204-447-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2024-472-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2696-498-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2492-505-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2492-509-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3124-567-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3416-595-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4220-617-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4676-648-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4932-701-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
UPX dump on OEP (original entry point) 64 IoCs
resource yara_rule behavioral2/memory/3040-0-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000a00000002343c-3.dat UPX behavioral2/files/0x0008000000023444-10.dat UPX behavioral2/files/0x0008000000023447-16.dat UPX behavioral2/memory/4920-15-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3896-8-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3040-5-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023448-24.dat UPX behavioral2/memory/3024-23-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/1848-25-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0005000000022ae3-28.dat UPX behavioral2/files/0x0007000000023449-34.dat UPX behavioral2/memory/4200-37-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3224-32-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0004000000022ae4-40.dat UPX behavioral2/memory/464-44-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344a-46.dat UPX behavioral2/files/0x000700000002344b-52.dat UPX behavioral2/memory/4052-55-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344c-58.dat UPX behavioral2/memory/4872-49-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344d-63.dat UPX behavioral2/memory/3936-65-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344e-70.dat UPX behavioral2/memory/3292-68-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0008000000023445-76.dat UPX behavioral2/memory/5020-78-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002344f-83.dat UPX behavioral2/files/0x0007000000023450-89.dat UPX behavioral2/files/0x0007000000023451-94.dat UPX behavioral2/files/0x0007000000023452-99.dat UPX behavioral2/files/0x0007000000023453-103.dat UPX behavioral2/memory/4936-106-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2596-105-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/2980-104-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/408-92-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/116-74-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023454-111.dat UPX behavioral2/memory/1932-115-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000500000001e368-118.dat UPX behavioral2/memory/2248-121-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0008000000023455-123.dat UPX behavioral2/files/0x0008000000023457-128.dat UPX behavioral2/memory/4960-130-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023458-135.dat UPX behavioral2/files/0x0007000000023459-138.dat UPX behavioral2/files/0x000700000002345a-143.dat UPX behavioral2/memory/1300-146-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002345b-150.dat UPX behavioral2/memory/4944-152-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3216-155-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000700000002345e-157.dat UPX behavioral2/memory/2040-160-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000800000002345c-164.dat UPX behavioral2/memory/3908-171-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x000800000002345f-169.dat UPX behavioral2/files/0x0007000000023460-174.dat UPX behavioral2/files/0x0007000000023461-179.dat UPX behavioral2/memory/3740-182-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/files/0x0007000000023462-187.dat UPX behavioral2/memory/2408-186-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/4000-195-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/3864-197-0x0000000000400000-0x0000000000435000-memory.dmp UPX behavioral2/memory/744-201-0x0000000000400000-0x0000000000435000-memory.dmp UPX -
Executes dropped EXE 64 IoCs
pid Process 3896 lrllfxl.exe 4920 bttnhh.exe 3024 jvpjv.exe 1848 jddpj.exe 3224 jpvjj.exe 4200 pjpjd.exe 464 xfrrrrr.exe 4872 tttntn.exe 4052 vjjjd.exe 3936 rflfffx.exe 3292 7lxrxfr.exe 116 btttnh.exe 5020 pjppv.exe 1732 lxxrlfx.exe 408 1fxxrrr.exe 2596 btntnt.exe 2980 rfllxxl.exe 4936 3lllflf.exe 1932 hbbthb.exe 2248 rrlfxrx.exe 4960 bbtnnh.exe 3892 ffflffl.exe 4244 jjppj.exe 1300 9hbbtb.exe 4944 fflrrll.exe 3216 xffrllf.exe 2040 nbnhbt.exe 3908 vpppj.exe 3032 jjjjd.exe 3740 pdjdd.exe 2408 vjppj.exe 2472 fxxrllf.exe 4000 nbhbhb.exe 3864 3lrlrlr.exe 744 lxfffxf.exe 2448 btnbtt.exe 5024 pjdvv.exe 5068 9xxlffx.exe 1476 fxfxffl.exe 1572 tttnhb.exe 3344 7jjjd.exe 312 lrrllff.exe 4480 bhbhnt.exe 4444 bnnbtt.exe 3024 fxlfxxr.exe 4424 9tnbtt.exe 4504 vjjpj.exe 2484 xrrlffr.exe 1304 3tbtth.exe 4860 pjppp.exe 4104 frfxllf.exe 1676 bntbhh.exe 2576 vpddp.exe 2876 dppjd.exe 4952 rxrlllr.exe 1112 hnbbnn.exe 3672 jdvjd.exe 5020 lflffxx.exe 224 7tbtnh.exe 1420 vvddv.exe 2028 frfxxrl.exe 3168 1tbbbt.exe 876 pdvvp.exe 676 flrrlfx.exe -
resource yara_rule behavioral2/memory/3040-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000a00000002343c-3.dat upx behavioral2/files/0x0008000000023444-10.dat upx behavioral2/files/0x0008000000023447-16.dat upx behavioral2/memory/4920-15-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3896-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3040-5-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023448-24.dat upx behavioral2/memory/3024-23-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1848-25-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0005000000022ae3-28.dat upx behavioral2/files/0x0007000000023449-34.dat upx behavioral2/memory/4200-37-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3224-32-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0004000000022ae4-40.dat upx behavioral2/memory/464-44-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344a-46.dat upx behavioral2/files/0x000700000002344b-52.dat upx behavioral2/memory/4052-55-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344c-58.dat upx behavioral2/memory/4872-49-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344d-63.dat upx behavioral2/memory/3936-65-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344e-70.dat upx behavioral2/memory/3292-68-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0008000000023445-76.dat upx behavioral2/memory/5020-78-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344f-83.dat upx behavioral2/files/0x0007000000023450-89.dat upx behavioral2/files/0x0007000000023451-94.dat upx behavioral2/files/0x0007000000023452-99.dat upx behavioral2/files/0x0007000000023453-103.dat upx behavioral2/memory/4936-106-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2596-105-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2980-104-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/408-92-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/116-74-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023454-111.dat upx behavioral2/memory/1932-115-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000500000001e368-118.dat upx behavioral2/memory/2248-121-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0008000000023455-123.dat upx behavioral2/files/0x0008000000023457-128.dat upx behavioral2/memory/4960-130-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023458-135.dat upx behavioral2/files/0x0007000000023459-138.dat upx behavioral2/files/0x000700000002345a-143.dat upx behavioral2/memory/1300-146-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002345b-150.dat upx behavioral2/memory/4944-152-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3216-155-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002345e-157.dat upx behavioral2/memory/2040-160-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000800000002345c-164.dat upx behavioral2/memory/3908-171-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000800000002345f-169.dat upx behavioral2/files/0x0007000000023460-174.dat upx behavioral2/files/0x0007000000023461-179.dat upx behavioral2/memory/3740-182-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023462-187.dat upx behavioral2/memory/2408-186-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4000-195-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3864-197-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/744-201-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 3896 3040 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 80 PID 3040 wrote to memory of 3896 3040 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 80 PID 3040 wrote to memory of 3896 3040 9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe 80 PID 3896 wrote to memory of 4920 3896 lrllfxl.exe 81 PID 3896 wrote to memory of 4920 3896 lrllfxl.exe 81 PID 3896 wrote to memory of 4920 3896 lrllfxl.exe 81 PID 4920 wrote to memory of 3024 4920 bttnhh.exe 82 PID 4920 wrote to memory of 3024 4920 bttnhh.exe 82 PID 4920 wrote to memory of 3024 4920 bttnhh.exe 82 PID 3024 wrote to memory of 1848 3024 jvpjv.exe 86 PID 3024 wrote to memory of 1848 3024 jvpjv.exe 86 PID 3024 wrote to memory of 1848 3024 jvpjv.exe 86 PID 1848 wrote to memory of 3224 1848 jddpj.exe 87 PID 1848 wrote to memory of 3224 1848 jddpj.exe 87 PID 1848 wrote to memory of 3224 1848 jddpj.exe 87 PID 3224 wrote to memory of 4200 3224 jpvjj.exe 88 PID 3224 wrote to memory of 4200 3224 jpvjj.exe 88 PID 3224 wrote to memory of 4200 3224 jpvjj.exe 88 PID 4200 wrote to memory of 464 4200 pjpjd.exe 89 PID 4200 wrote to memory of 464 4200 pjpjd.exe 89 PID 4200 wrote to memory of 464 4200 pjpjd.exe 89 PID 464 wrote to memory of 4872 464 xfrrrrr.exe 90 PID 464 wrote to memory of 4872 464 xfrrrrr.exe 90 PID 464 wrote to memory of 4872 464 xfrrrrr.exe 90 PID 4872 wrote to memory of 4052 4872 tttntn.exe 91 PID 4872 wrote to memory of 4052 4872 tttntn.exe 91 PID 4872 wrote to memory of 4052 4872 tttntn.exe 91 PID 4052 wrote to memory of 3936 4052 vjjjd.exe 92 PID 4052 wrote to memory of 3936 4052 vjjjd.exe 92 PID 4052 wrote to memory of 3936 4052 vjjjd.exe 92 PID 3936 wrote to memory of 3292 3936 rflfffx.exe 93 PID 3936 wrote to memory of 3292 3936 rflfffx.exe 93 PID 3936 wrote to memory of 3292 3936 rflfffx.exe 93 PID 3292 wrote to memory of 116 3292 7lxrxfr.exe 94 PID 3292 wrote to memory of 116 3292 7lxrxfr.exe 94 PID 3292 wrote to memory of 116 3292 7lxrxfr.exe 94 PID 116 wrote to memory of 5020 116 btttnh.exe 95 PID 116 wrote to memory of 5020 116 btttnh.exe 95 PID 116 wrote to memory of 5020 116 btttnh.exe 95 PID 5020 wrote to memory of 1732 5020 pjppv.exe 96 PID 5020 wrote to memory of 1732 5020 pjppv.exe 96 PID 5020 wrote to memory of 1732 5020 pjppv.exe 96 PID 1732 wrote to memory of 408 1732 lxxrlfx.exe 97 PID 1732 wrote to memory of 408 1732 lxxrlfx.exe 97 PID 1732 wrote to memory of 408 1732 lxxrlfx.exe 97 PID 408 wrote to memory of 2596 408 1fxxrrr.exe 98 PID 408 wrote to memory of 2596 408 1fxxrrr.exe 98 PID 408 wrote to memory of 2596 408 1fxxrrr.exe 98 PID 2596 wrote to memory of 2980 2596 btntnt.exe 99 PID 2596 wrote to memory of 2980 2596 btntnt.exe 99 PID 2596 wrote to memory of 2980 2596 btntnt.exe 99 PID 2980 wrote to memory of 4936 2980 rfllxxl.exe 100 PID 2980 wrote to memory of 4936 2980 rfllxxl.exe 100 PID 2980 wrote to memory of 4936 2980 rfllxxl.exe 100 PID 4936 wrote to memory of 1932 4936 3lllflf.exe 101 PID 4936 wrote to memory of 1932 4936 3lllflf.exe 101 PID 4936 wrote to memory of 1932 4936 3lllflf.exe 101 PID 1932 wrote to memory of 2248 1932 hbbthb.exe 102 PID 1932 wrote to memory of 2248 1932 hbbthb.exe 102 PID 1932 wrote to memory of 2248 1932 hbbthb.exe 102 PID 2248 wrote to memory of 4960 2248 rrlfxrx.exe 103 PID 2248 wrote to memory of 4960 2248 rrlfxrx.exe 103 PID 2248 wrote to memory of 4960 2248 rrlfxrx.exe 103 PID 4960 wrote to memory of 3892 4960 bbtnnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe"C:\Users\Admin\AppData\Local\Temp\9d5f805044b2032451c47a12c8c9baf3bda38d9670ddf62bcd30e465e9164e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lrllfxl.exec:\lrllfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\bttnhh.exec:\bttnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\jvpjv.exec:\jvpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jddpj.exec:\jddpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jpvjj.exec:\jpvjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\tttntn.exec:\tttntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\vjjjd.exec:\vjjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\rflfffx.exec:\rflfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\7lxrxfr.exec:\7lxrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\btttnh.exec:\btttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\pjppv.exec:\pjppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\1fxxrrr.exec:\1fxxrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\btntnt.exec:\btntnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rfllxxl.exec:\rfllxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3lllflf.exec:\3lllflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\hbbthb.exec:\hbbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\bbtnnh.exec:\bbtnnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\ffflffl.exec:\ffflffl.exe23⤵
- Executes dropped EXE
PID:3892 -
\??\c:\jjppj.exec:\jjppj.exe24⤵
- Executes dropped EXE
PID:4244 -
\??\c:\9hbbtb.exec:\9hbbtb.exe25⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fflrrll.exec:\fflrrll.exe26⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xffrllf.exec:\xffrllf.exe27⤵
- Executes dropped EXE
PID:3216 -
\??\c:\nbnhbt.exec:\nbnhbt.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vpppj.exec:\vpppj.exe29⤵
- Executes dropped EXE
PID:3908 -
\??\c:\jjjjd.exec:\jjjjd.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pdjdd.exec:\pdjdd.exe31⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vjppj.exec:\vjppj.exe32⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fxxrllf.exec:\fxxrllf.exe33⤵
- Executes dropped EXE
PID:2472 -
\??\c:\nbhbhb.exec:\nbhbhb.exe34⤵
- Executes dropped EXE
PID:4000 -
\??\c:\3lrlrlr.exec:\3lrlrlr.exe35⤵
- Executes dropped EXE
PID:3864 -
\??\c:\lxfffxf.exec:\lxfffxf.exe36⤵
- Executes dropped EXE
PID:744 -
\??\c:\btnbtt.exec:\btnbtt.exe37⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pjdvv.exec:\pjdvv.exe38⤵
- Executes dropped EXE
PID:5024 -
\??\c:\9xxlffx.exec:\9xxlffx.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fxfxffl.exec:\fxfxffl.exe40⤵
- Executes dropped EXE
PID:1476 -
\??\c:\tttnhb.exec:\tttnhb.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7jjjd.exec:\7jjjd.exe42⤵
- Executes dropped EXE
PID:3344 -
\??\c:\lrrllff.exec:\lrrllff.exe43⤵
- Executes dropped EXE
PID:312 -
\??\c:\bhbhnt.exec:\bhbhnt.exe44⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bnnbtt.exec:\bnnbtt.exe45⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9tnbtt.exec:\9tnbtt.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vjjpj.exec:\vjjpj.exe48⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xrrlffr.exec:\xrrlffr.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3tbtth.exec:\3tbtth.exe50⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pjppp.exec:\pjppp.exe51⤵
- Executes dropped EXE
PID:4860 -
\??\c:\frfxllf.exec:\frfxllf.exe52⤵
- Executes dropped EXE
PID:4104 -
\??\c:\bntbhh.exec:\bntbhh.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vpddp.exec:\vpddp.exe54⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dppjd.exec:\dppjd.exe55⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxrlllr.exec:\rxrlllr.exe56⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hnbbnn.exec:\hnbbnn.exe57⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jdvjd.exec:\jdvjd.exe58⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lflffxx.exec:\lflffxx.exe59⤵
- Executes dropped EXE
PID:5020 -
\??\c:\7tbtnh.exec:\7tbtnh.exe60⤵
- Executes dropped EXE
PID:224 -
\??\c:\vvddv.exec:\vvddv.exe61⤵
- Executes dropped EXE
PID:1420 -
\??\c:\frfxxrl.exec:\frfxxrl.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1tbbbt.exec:\1tbbbt.exe63⤵
- Executes dropped EXE
PID:3168 -
\??\c:\pdvvp.exec:\pdvvp.exe64⤵
- Executes dropped EXE
PID:876 -
\??\c:\flrrlfx.exec:\flrrlfx.exe65⤵
- Executes dropped EXE
PID:676 -
\??\c:\1thhhn.exec:\1thhhn.exe66⤵PID:1932
-
\??\c:\3pvdj.exec:\3pvdj.exe67⤵PID:4112
-
\??\c:\ddvpj.exec:\ddvpj.exe68⤵PID:5012
-
\??\c:\frrlfxr.exec:\frrlfxr.exe69⤵PID:3892
-
\??\c:\nttnnn.exec:\nttnnn.exe70⤵PID:1744
-
\??\c:\jdjdd.exec:\jdjdd.exe71⤵PID:4516
-
\??\c:\3djdv.exec:\3djdv.exe72⤵PID:4528
-
\??\c:\rfrllfl.exec:\rfrllfl.exe73⤵PID:2652
-
\??\c:\hbtntt.exec:\hbtntt.exe74⤵PID:4412
-
\??\c:\3nthhh.exec:\3nthhh.exe75⤵PID:3424
-
\??\c:\7djvp.exec:\7djvp.exe76⤵PID:4032
-
\??\c:\5rfxxxr.exec:\5rfxxxr.exe77⤵PID:3032
-
\??\c:\btbttb.exec:\btbttb.exe78⤵PID:1020
-
\??\c:\djppj.exec:\djppj.exe79⤵PID:436
-
\??\c:\dpvpj.exec:\dpvpj.exe80⤵PID:4404
-
\??\c:\xxffxrr.exec:\xxffxrr.exe81⤵PID:3144
-
\??\c:\5nbhhh.exec:\5nbhhh.exe82⤵PID:3400
-
\??\c:\5vjpp.exec:\5vjpp.exe83⤵PID:2604
-
\??\c:\jvddv.exec:\jvddv.exe84⤵PID:1312
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe85⤵PID:3372
-
\??\c:\bthbtt.exec:\bthbtt.exe86⤵PID:4656
-
\??\c:\jdpdd.exec:\jdpdd.exe87⤵PID:2392
-
\??\c:\pddpp.exec:\pddpp.exe88⤵PID:4492
-
\??\c:\lfrlrxx.exec:\lfrlrxx.exe89⤵PID:4648
-
\??\c:\bnnnhh.exec:\bnnnhh.exe90⤵PID:4316
-
\??\c:\nhnnnt.exec:\nhnnnt.exe91⤵PID:2256
-
\??\c:\pjpjp.exec:\pjpjp.exe92⤵PID:1584
-
\??\c:\flrlfxx.exec:\flrlfxx.exe93⤵PID:4044
-
\??\c:\bbnnbb.exec:\bbnnbb.exe94⤵PID:3128
-
\??\c:\7jddv.exec:\7jddv.exe95⤵PID:824
-
\??\c:\jdddv.exec:\jdddv.exe96⤵PID:4464
-
\??\c:\bhbbbh.exec:\bhbbbh.exe97⤵PID:3224
-
\??\c:\hnbtnh.exec:\hnbtnh.exe98⤵PID:2628
-
\??\c:\vpdvd.exec:\vpdvd.exe99⤵PID:1188
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe100⤵PID:2668
-
\??\c:\5rfrxxf.exec:\5rfrxxf.exe101⤵PID:896
-
\??\c:\tnbbbt.exec:\tnbbbt.exe102⤵PID:4860
-
\??\c:\3pddj.exec:\3pddj.exe103⤵PID:4924
-
\??\c:\lxffxxr.exec:\lxffxxr.exe104⤵PID:4052
-
\??\c:\bnttnn.exec:\bnttnn.exe105⤵PID:3868
-
\??\c:\bbnnhh.exec:\bbnnhh.exe106⤵PID:4704
-
\??\c:\jjddv.exec:\jjddv.exe107⤵PID:4204
-
\??\c:\7rrrlrl.exec:\7rrrlrl.exe108⤵PID:1684
-
\??\c:\tnnbtt.exec:\tnnbtt.exe109⤵PID:4800
-
\??\c:\pjppj.exec:\pjppj.exe110⤵PID:2204
-
\??\c:\vjppd.exec:\vjppd.exe111⤵PID:4596
-
\??\c:\rflrllf.exec:\rflrllf.exe112⤵PID:2272
-
\??\c:\htbtnn.exec:\htbtnn.exe113⤵PID:4700
-
\??\c:\7djdv.exec:\7djdv.exe114⤵PID:2016
-
\??\c:\vvppj.exec:\vvppj.exe115⤵PID:2024
-
\??\c:\btbtbt.exec:\btbtbt.exe116⤵PID:3168
-
\??\c:\vpppj.exec:\vpppj.exe117⤵PID:1880
-
\??\c:\rflfrrf.exec:\rflfrrf.exe118⤵PID:368
-
\??\c:\btbthh.exec:\btbthh.exe119⤵PID:3552
-
\??\c:\lfllrfl.exec:\lfllrfl.exe120⤵PID:3980
-
\??\c:\vdpjd.exec:\vdpjd.exe121⤵PID:1364
-
\??\c:\lrxrlff.exec:\lrxrlff.exe122⤵PID:3376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-