Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 20:14
Behavioral task
behavioral1
Sample
2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe
Resource
win7-20240708-en
General
-
Target
2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe
-
Size
119KB
-
MD5
dac5536ad06f6bc26aa4073d1a40881f
-
SHA1
5fc0bae656e3f22f6eaa596fc2d7baabddd40ee3
-
SHA256
2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab
-
SHA512
e66e31b2d188e7bd1530b98dc41e6cc91641b2bc7d7f02b8f185a9cefa2f4d19d81e326776da67236e99d782be2e538bfe8d6fadd2bc4a79fde4faaa5561fcc7
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH48h:kcm4FmowdHoSphraHcpOFltH42
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3608-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1868-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-713-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 djdvv.exe 3256 dvvpp.exe 4736 rflfxff.exe 4368 5tbtbt.exe 3076 tnnnnh.exe 3060 xffxlfr.exe 2920 htbhhb.exe 4436 tbbtbh.exe 1692 pjjjj.exe 3192 1rxxrxx.exe 3712 pddvp.exe 2740 dpvvp.exe 1576 xrfxxxf.exe 4996 9jpjd.exe 2484 1ffxxfl.exe 1268 hhnhbb.exe 2440 ffflllr.exe 2488 xxfxxxx.exe 1016 tbtthh.exe 3472 dddvv.exe 4488 xrffxxx.exe 1572 ttnbnt.exe 224 btbtnt.exe 5080 dvjdv.exe 3816 rfrxxlx.exe 4648 lffrxfl.exe 4240 1tbhhn.exe 3580 jpddv.exe 2668 jjdvv.exe 3380 fxfxxrr.exe 3340 hbtntt.exe 2792 pjjdv.exe 2392 fffffff.exe 3080 nhnhhh.exe 4804 5hnttt.exe 3028 pjppp.exe 4128 hnhhnt.exe 3760 vpjvp.exe 4920 jjppv.exe 1632 rrflxxx.exe 3344 xrrxrxf.exe 1648 hbnhtt.exe 3256 hhbbbt.exe 2536 jpvpv.exe 2280 rlxffff.exe 5096 tbbtnn.exe 4540 ddpvv.exe 1004 1lrrrxx.exe 5092 1rrrrxx.exe 4680 ttnnbt.exe 4436 nbhhbn.exe 3948 dvdjj.exe 2152 lllfrlr.exe 4324 rlrxrlr.exe 3176 hthbtn.exe 2836 vjjjd.exe 432 frfxrrr.exe 3444 tthbht.exe 1448 9jpjj.exe 4996 pdvdv.exe 1652 lrflxxr.exe 3356 tnnhhh.exe 4588 tttbnt.exe 2756 jdvjd.exe -
resource yara_rule behavioral2/memory/3608-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023483-3.dat upx behavioral2/memory/3608-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1696-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234de-10.dat upx behavioral2/memory/3256-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-22.dat upx behavioral2/memory/4736-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234df-18.dat upx behavioral2/files/0x00070000000234e1-29.dat upx behavioral2/memory/3076-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e2-35.dat upx behavioral2/memory/3076-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e3-42.dat upx behavioral2/memory/2920-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3060-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e4-48.dat upx behavioral2/files/0x00070000000234e5-54.dat upx behavioral2/memory/4436-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e6-59.dat upx behavioral2/files/0x00070000000234e7-64.dat upx behavioral2/files/0x00070000000234e8-69.dat upx behavioral2/memory/3712-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e9-75.dat upx behavioral2/memory/2740-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ea-80.dat upx behavioral2/memory/1576-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234eb-86.dat upx behavioral2/memory/4996-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ec-92.dat upx behavioral2/memory/2484-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ed-98.dat upx behavioral2/memory/2440-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ee-104.dat upx behavioral2/memory/2488-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-111.dat upx behavioral2/files/0x00070000000234f1-115.dat upx behavioral2/memory/3472-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f2-122.dat upx behavioral2/memory/4488-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f3-127.dat upx behavioral2/files/0x00070000000234f6-151.dat upx behavioral2/files/0x00070000000234f7-158.dat upx behavioral2/files/0x00070000000234f8-163.dat upx behavioral2/files/0x00070000000234f9-168.dat upx behavioral2/memory/4240-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4648-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3816-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f5-146.dat upx behavioral2/memory/5080-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f4-140.dat upx behavioral2/memory/224-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234db-134.dat upx behavioral2/files/0x00070000000234fa-174.dat upx behavioral2/memory/3380-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fb-180.dat upx behavioral2/files/0x00070000000234fc-183.dat upx behavioral2/memory/2792-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2392-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3080-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4804-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3028-205-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3608 wrote to memory of 1696 3608 2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe 84 PID 3608 wrote to memory of 1696 3608 2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe 84 PID 3608 wrote to memory of 1696 3608 2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe 84 PID 1696 wrote to memory of 3256 1696 djdvv.exe 85 PID 1696 wrote to memory of 3256 1696 djdvv.exe 85 PID 1696 wrote to memory of 3256 1696 djdvv.exe 85 PID 3256 wrote to memory of 4736 3256 dvvpp.exe 86 PID 3256 wrote to memory of 4736 3256 dvvpp.exe 86 PID 3256 wrote to memory of 4736 3256 dvvpp.exe 86 PID 4736 wrote to memory of 4368 4736 rflfxff.exe 87 PID 4736 wrote to memory of 4368 4736 rflfxff.exe 87 PID 4736 wrote to memory of 4368 4736 rflfxff.exe 87 PID 4368 wrote to memory of 3076 4368 5tbtbt.exe 88 PID 4368 wrote to memory of 3076 4368 5tbtbt.exe 88 PID 4368 wrote to memory of 3076 4368 5tbtbt.exe 88 PID 3076 wrote to memory of 3060 3076 tnnnnh.exe 89 PID 3076 wrote to memory of 3060 3076 tnnnnh.exe 89 PID 3076 wrote to memory of 3060 3076 tnnnnh.exe 89 PID 3060 wrote to memory of 2920 3060 xffxlfr.exe 90 PID 3060 wrote to memory of 2920 3060 xffxlfr.exe 90 PID 3060 wrote to memory of 2920 3060 xffxlfr.exe 90 PID 2920 wrote to memory of 4436 2920 htbhhb.exe 91 PID 2920 wrote to memory of 4436 2920 htbhhb.exe 91 PID 2920 wrote to memory of 4436 2920 htbhhb.exe 91 PID 4436 wrote to memory of 1692 4436 tbbtbh.exe 92 PID 4436 wrote to memory of 1692 4436 tbbtbh.exe 92 PID 4436 wrote to memory of 1692 4436 tbbtbh.exe 92 PID 1692 wrote to memory of 3192 1692 pjjjj.exe 93 PID 1692 wrote to memory of 3192 1692 pjjjj.exe 93 PID 1692 wrote to memory of 3192 1692 pjjjj.exe 93 PID 3192 wrote to memory of 3712 3192 1rxxrxx.exe 94 PID 3192 wrote to memory of 3712 3192 1rxxrxx.exe 94 PID 3192 wrote to memory of 3712 3192 1rxxrxx.exe 94 PID 3712 wrote to memory of 2740 3712 pddvp.exe 95 PID 3712 wrote to memory of 2740 3712 pddvp.exe 95 PID 3712 wrote to memory of 2740 3712 pddvp.exe 95 PID 2740 wrote to memory of 1576 2740 dpvvp.exe 96 PID 2740 wrote to memory of 1576 2740 dpvvp.exe 96 PID 2740 wrote to memory of 1576 2740 dpvvp.exe 96 PID 1576 wrote to memory of 4996 1576 xrfxxxf.exe 97 PID 1576 wrote to memory of 4996 1576 xrfxxxf.exe 97 PID 1576 wrote to memory of 4996 1576 xrfxxxf.exe 97 PID 4996 wrote to memory of 2484 4996 9jpjd.exe 98 PID 4996 wrote to memory of 2484 4996 9jpjd.exe 98 PID 4996 wrote to memory of 2484 4996 9jpjd.exe 98 PID 2484 wrote to memory of 1268 2484 1ffxxfl.exe 99 PID 2484 wrote to memory of 1268 2484 1ffxxfl.exe 99 PID 2484 wrote to memory of 1268 2484 1ffxxfl.exe 99 PID 1268 wrote to memory of 2440 1268 hhnhbb.exe 100 PID 1268 wrote to memory of 2440 1268 hhnhbb.exe 100 PID 1268 wrote to memory of 2440 1268 hhnhbb.exe 100 PID 2440 wrote to memory of 2488 2440 ffflllr.exe 101 PID 2440 wrote to memory of 2488 2440 ffflllr.exe 101 PID 2440 wrote to memory of 2488 2440 ffflllr.exe 101 PID 2488 wrote to memory of 1016 2488 xxfxxxx.exe 102 PID 2488 wrote to memory of 1016 2488 xxfxxxx.exe 102 PID 2488 wrote to memory of 1016 2488 xxfxxxx.exe 102 PID 1016 wrote to memory of 3472 1016 tbtthh.exe 103 PID 1016 wrote to memory of 3472 1016 tbtthh.exe 103 PID 1016 wrote to memory of 3472 1016 tbtthh.exe 103 PID 3472 wrote to memory of 4488 3472 dddvv.exe 104 PID 3472 wrote to memory of 4488 3472 dddvv.exe 104 PID 3472 wrote to memory of 4488 3472 dddvv.exe 104 PID 4488 wrote to memory of 1572 4488 xrffxxx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe"C:\Users\Admin\AppData\Local\Temp\2f34bf410c832b7e6edd1e20a26bb22ecfbc1ff7b3d81a736eb086b3232cf6ab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\djdvv.exec:\djdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\dvvpp.exec:\dvvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\rflfxff.exec:\rflfxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\5tbtbt.exec:\5tbtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\tnnnnh.exec:\tnnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\xffxlfr.exec:\xffxlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\htbhhb.exec:\htbhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\tbbtbh.exec:\tbbtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\pjjjj.exec:\pjjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\1rxxrxx.exec:\1rxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\9jpjd.exec:\9jpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\1ffxxfl.exec:\1ffxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\hhnhbb.exec:\hhnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\ffflllr.exec:\ffflllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\tbtthh.exec:\tbtthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\dddvv.exec:\dddvv.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\xrffxxx.exec:\xrffxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\ttnbnt.exec:\ttnbnt.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\btbtnt.exec:\btbtnt.exe24⤵
- Executes dropped EXE
PID:224 -
\??\c:\dvjdv.exec:\dvjdv.exe25⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rfrxxlx.exec:\rfrxxlx.exe26⤵
- Executes dropped EXE
PID:3816 -
\??\c:\lffrxfl.exec:\lffrxfl.exe27⤵
- Executes dropped EXE
PID:4648 -
\??\c:\1tbhhn.exec:\1tbhhn.exe28⤵
- Executes dropped EXE
PID:4240 -
\??\c:\jpddv.exec:\jpddv.exe29⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jjdvv.exec:\jjdvv.exe30⤵
- Executes dropped EXE
PID:2668 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe31⤵
- Executes dropped EXE
PID:3380 -
\??\c:\hbtntt.exec:\hbtntt.exe32⤵
- Executes dropped EXE
PID:3340 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fffffff.exec:\fffffff.exe34⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhnhhh.exec:\nhnhhh.exe35⤵
- Executes dropped EXE
PID:3080 -
\??\c:\5hnttt.exec:\5hnttt.exe36⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjppp.exec:\pjppp.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hnhhnt.exec:\hnhhnt.exe38⤵
- Executes dropped EXE
PID:4128 -
\??\c:\vpjvp.exec:\vpjvp.exe39⤵
- Executes dropped EXE
PID:3760 -
\??\c:\jjppv.exec:\jjppv.exe40⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rrflxxx.exec:\rrflxxx.exe41⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrrxrxf.exec:\xrrxrxf.exe42⤵
- Executes dropped EXE
PID:3344 -
\??\c:\hbnhtt.exec:\hbnhtt.exe43⤵
- Executes dropped EXE
PID:1648 -
\??\c:\hhbbbt.exec:\hhbbbt.exe44⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jpvpv.exec:\jpvpv.exe45⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlxffff.exec:\rlxffff.exe46⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tbbtnn.exec:\tbbtnn.exe47⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ddpvv.exec:\ddpvv.exe48⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe49⤵
- Executes dropped EXE
PID:1004 -
\??\c:\1rrrrxx.exec:\1rrrrxx.exe50⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ttnnbt.exec:\ttnnbt.exe51⤵
- Executes dropped EXE
PID:4680 -
\??\c:\nbhhbn.exec:\nbhhbn.exe52⤵
- Executes dropped EXE
PID:4436 -
\??\c:\dvdjj.exec:\dvdjj.exe53⤵
- Executes dropped EXE
PID:3948 -
\??\c:\lllfrlr.exec:\lllfrlr.exe54⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rlrxrlr.exec:\rlrxrlr.exe55⤵
- Executes dropped EXE
PID:4324 -
\??\c:\hthbtn.exec:\hthbtn.exe56⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vjjjd.exec:\vjjjd.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\frfxrrr.exec:\frfxrrr.exe58⤵
- Executes dropped EXE
PID:432 -
\??\c:\tthbht.exec:\tthbht.exe59⤵
- Executes dropped EXE
PID:3444 -
\??\c:\9jpjj.exec:\9jpjj.exe60⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pdvdv.exec:\pdvdv.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\lrflxxr.exec:\lrflxxr.exe62⤵
- Executes dropped EXE
PID:1652 -
\??\c:\tnnhhh.exec:\tnnhhh.exe63⤵
- Executes dropped EXE
PID:3356 -
\??\c:\tttbnt.exec:\tttbnt.exe64⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jdvjd.exec:\jdvjd.exe65⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9lllfll.exec:\9lllfll.exe66⤵PID:2336
-
\??\c:\xxrrllf.exec:\xxrrllf.exe67⤵PID:4196
-
\??\c:\nbhnnn.exec:\nbhnnn.exe68⤵PID:4864
-
\??\c:\3pjdd.exec:\3pjdd.exe69⤵PID:5104
-
\??\c:\pdvvv.exec:\pdvvv.exe70⤵PID:2252
-
\??\c:\1lrrlll.exec:\1lrrlll.exe71⤵PID:1868
-
\??\c:\xrrlffx.exec:\xrrlffx.exe72⤵PID:224
-
\??\c:\nhhntn.exec:\nhhntn.exe73⤵PID:5080
-
\??\c:\hnbbhn.exec:\hnbbhn.exe74⤵PID:2776
-
\??\c:\1dvvp.exec:\1dvvp.exe75⤵PID:2168
-
\??\c:\dvddv.exec:\dvddv.exe76⤵PID:4560
-
\??\c:\rrxrlll.exec:\rrxrlll.exe77⤵PID:4280
-
\??\c:\tnbbtn.exec:\tnbbtn.exe78⤵PID:3024
-
\??\c:\bnbbtb.exec:\bnbbtb.exe79⤵PID:5108
-
\??\c:\7vvvp.exec:\7vvvp.exe80⤵PID:1384
-
\??\c:\dpdvp.exec:\dpdvp.exe81⤵PID:4020
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe82⤵PID:4652
-
\??\c:\xrlllrf.exec:\xrlllrf.exe83⤵PID:2628
-
\??\c:\7bnntb.exec:\7bnntb.exe84⤵PID:4564
-
\??\c:\vjpjj.exec:\vjpjj.exe85⤵PID:2364
-
\??\c:\bbtttb.exec:\bbtttb.exe86⤵PID:2372
-
\??\c:\5tbbhn.exec:\5tbbhn.exe87⤵PID:3080
-
\??\c:\pjjdd.exec:\pjjdd.exe88⤵PID:1304
-
\??\c:\vvddv.exec:\vvddv.exe89⤵PID:4640
-
\??\c:\rrrllll.exec:\rrrllll.exe90⤵PID:464
-
\??\c:\nnbthh.exec:\nnbthh.exe91⤵PID:3952
-
\??\c:\bntnnn.exec:\bntnnn.exe92⤵PID:3500
-
\??\c:\djvvp.exec:\djvvp.exe93⤵PID:2564
-
\??\c:\5dvpj.exec:\5dvpj.exe94⤵PID:4712
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe95⤵PID:700
-
\??\c:\rlrrllf.exec:\rlrrllf.exe96⤵PID:4368
-
\??\c:\tntnhh.exec:\tntnhh.exe97⤵PID:1968
-
\??\c:\1dppp.exec:\1dppp.exe98⤵PID:3092
-
\??\c:\fxlfffx.exec:\fxlfffx.exe99⤵PID:3644
-
\??\c:\llrlfxx.exec:\llrlfxx.exe100⤵PID:4896
-
\??\c:\nbbttt.exec:\nbbttt.exe101⤵PID:1776
-
\??\c:\pjddv.exec:\pjddv.exe102⤵PID:4068
-
\??\c:\vpppj.exec:\vpppj.exe103⤵PID:5116
-
\??\c:\xfrrlll.exec:\xfrrlll.exe104⤵PID:1624
-
\??\c:\htnnnt.exec:\htnnnt.exe105⤵PID:1680
-
\??\c:\nhhbtt.exec:\nhhbtt.exe106⤵PID:1036
-
\??\c:\djjpj.exec:\djjpj.exe107⤵PID:3192
-
\??\c:\jjvvd.exec:\jjvvd.exe108⤵PID:3572
-
\??\c:\rffxrll.exec:\rffxrll.exe109⤵PID:2952
-
\??\c:\xrxrlll.exec:\xrxrlll.exe110⤵PID:432
-
\??\c:\bnnhhh.exec:\bnnhhh.exe111⤵PID:3408
-
\??\c:\vvvpd.exec:\vvvpd.exe112⤵PID:4448
-
\??\c:\ddjvp.exec:\ddjvp.exe113⤵PID:2028
-
\??\c:\nhnnnn.exec:\nhnnnn.exe114⤵PID:1324
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:5004
-
\??\c:\vvvdd.exec:\vvvdd.exe116⤵PID:2396
-
\??\c:\5rxrlll.exec:\5rxrlll.exe117⤵PID:3140
-
\??\c:\xflxxlf.exec:\xflxxlf.exe118⤵PID:2336
-
\??\c:\bbttnn.exec:\bbttnn.exe119⤵PID:4204
-
\??\c:\bbbtbt.exec:\bbbtbt.exe120⤵PID:4488
-
\??\c:\vdpdj.exec:\vdpdj.exe121⤵PID:4008
-
\??\c:\lxlxrfx.exec:\lxlxrfx.exe122⤵PID:4252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-