Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 00:19
Behavioral task
behavioral1
Sample
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe
Resource
win7-20240704-en
General
-
Target
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe
-
Size
97KB
-
MD5
c8dd2de9de02be15cb92e19c4784696b
-
SHA1
ec779af1992fb8f8ae339260ea4a7b86752c9623
-
SHA256
91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689
-
SHA512
6a06ed02a504efa443b3da4248faae187a183dd1aa0b75e58ee48a7235afc7fc6143435406401d858cf10a6bddc1f6327915d1693ebee11e45bce492474fa812
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutyaVszyKd+XqQPdf5NS1:9cm4FmowdHoSyAszBd+aQNS1
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3768-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4572-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/620-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-580-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-735-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3248 7lxlxrx.exe 4504 bnttnn.exe 4392 tthntt.exe 2844 dvvdv.exe 3332 vjvpj.exe 1604 lllfffx.exe 3488 3bnntb.exe 2296 jdppj.exe 4812 djddv.exe 3340 ffffxxx.exe 3624 1bnhhh.exe 4936 dpjjd.exe 4892 jjvvp.exe 1920 llllllr.exe 1608 7ttnhn.exe 4188 nbnnnt.exe 2364 vddjv.exe 3044 htnnbh.exe 4872 nttnhh.exe 5016 dpppv.exe 4428 rlxllxr.exe 4944 jvddv.exe 4588 9xflrxx.exe 3936 1nbbhh.exe 4572 ddppj.exe 940 7rrrlrr.exe 4896 htnnhh.exe 4084 tthnnn.exe 824 pjpjj.exe 2268 ffffflx.exe 2028 hhttnt.exe 1252 nttnhh.exe 4336 pdppp.exe 636 dvvpj.exe 1360 llllfll.exe 4020 lflrlrl.exe 4552 nhhhhh.exe 3600 bbtttt.exe 4388 jdjdd.exe 2412 dvddp.exe 4000 lxfrrxx.exe 2080 hthhhh.exe 1456 nbtnhh.exe 4716 ppdjd.exe 4768 rrrrlll.exe 2076 ntttnt.exe 1380 htttbb.exe 4824 vpjdj.exe 2092 pjvvp.exe 4936 lxlflrf.exe 1436 rllfffx.exe 1776 hntnhh.exe 2768 nhhhnn.exe 3528 pjjdp.exe 4804 7bbbtb.exe 1452 jjjjv.exe 1468 1frrrxx.exe 1784 llrxxff.exe 1716 5nttnn.exe 4872 nnhntt.exe 620 pppjp.exe 4428 lfrlrrr.exe 2856 llxrffr.exe 5028 nhnbtt.exe -
resource yara_rule behavioral2/memory/3768-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233d7-3.dat upx behavioral2/memory/3768-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-9.dat upx behavioral2/files/0x0007000000023437-13.dat upx behavioral2/memory/3248-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-23.dat upx behavioral2/files/0x0007000000023439-28.dat upx behavioral2/files/0x000700000002343a-33.dat upx behavioral2/memory/1604-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2844-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-39.dat upx behavioral2/files/0x000700000002343c-44.dat upx behavioral2/memory/3488-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-50.dat upx behavioral2/memory/2296-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4812-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-55.dat upx behavioral2/files/0x000700000002343f-60.dat upx behavioral2/memory/3340-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3624-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-67.dat upx behavioral2/memory/4936-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-72.dat upx behavioral2/memory/4892-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-80.dat upx behavioral2/memory/1920-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-84.dat upx behavioral2/memory/1608-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-91.dat upx behavioral2/memory/4188-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023445-97.dat upx behavioral2/memory/4188-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-103.dat upx behavioral2/memory/2364-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3044-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-108.dat upx behavioral2/files/0x0007000000023448-113.dat upx behavioral2/memory/4872-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023449-119.dat upx behavioral2/memory/5016-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-125.dat upx behavioral2/files/0x000700000002344b-132.dat upx behavioral2/memory/4944-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344c-137.dat upx behavioral2/files/0x000700000002344d-141.dat upx behavioral2/memory/3936-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-149.dat upx behavioral2/memory/4572-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023433-154.dat upx behavioral2/memory/4896-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/940-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344f-161.dat upx behavioral2/files/0x0007000000023450-167.dat upx behavioral2/files/0x0007000000023451-171.dat upx behavioral2/files/0x0007000000023452-176.dat upx behavioral2/memory/2028-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-181.dat upx behavioral2/memory/4336-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1360-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4552-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-209-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3768 wrote to memory of 3248 3768 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 84 PID 3768 wrote to memory of 3248 3768 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 84 PID 3768 wrote to memory of 3248 3768 91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe 84 PID 3248 wrote to memory of 4504 3248 7lxlxrx.exe 85 PID 3248 wrote to memory of 4504 3248 7lxlxrx.exe 85 PID 3248 wrote to memory of 4504 3248 7lxlxrx.exe 85 PID 4504 wrote to memory of 4392 4504 bnttnn.exe 86 PID 4504 wrote to memory of 4392 4504 bnttnn.exe 86 PID 4504 wrote to memory of 4392 4504 bnttnn.exe 86 PID 4392 wrote to memory of 2844 4392 tthntt.exe 87 PID 4392 wrote to memory of 2844 4392 tthntt.exe 87 PID 4392 wrote to memory of 2844 4392 tthntt.exe 87 PID 2844 wrote to memory of 3332 2844 dvvdv.exe 88 PID 2844 wrote to memory of 3332 2844 dvvdv.exe 88 PID 2844 wrote to memory of 3332 2844 dvvdv.exe 88 PID 3332 wrote to memory of 1604 3332 vjvpj.exe 89 PID 3332 wrote to memory of 1604 3332 vjvpj.exe 89 PID 3332 wrote to memory of 1604 3332 vjvpj.exe 89 PID 1604 wrote to memory of 3488 1604 lllfffx.exe 90 PID 1604 wrote to memory of 3488 1604 lllfffx.exe 90 PID 1604 wrote to memory of 3488 1604 lllfffx.exe 90 PID 3488 wrote to memory of 2296 3488 3bnntb.exe 91 PID 3488 wrote to memory of 2296 3488 3bnntb.exe 91 PID 3488 wrote to memory of 2296 3488 3bnntb.exe 91 PID 2296 wrote to memory of 4812 2296 jdppj.exe 92 PID 2296 wrote to memory of 4812 2296 jdppj.exe 92 PID 2296 wrote to memory of 4812 2296 jdppj.exe 92 PID 4812 wrote to memory of 3340 4812 djddv.exe 93 PID 4812 wrote to memory of 3340 4812 djddv.exe 93 PID 4812 wrote to memory of 3340 4812 djddv.exe 93 PID 3340 wrote to memory of 3624 3340 ffffxxx.exe 94 PID 3340 wrote to memory of 3624 3340 ffffxxx.exe 94 PID 3340 wrote to memory of 3624 3340 ffffxxx.exe 94 PID 3624 wrote to memory of 4936 3624 1bnhhh.exe 95 PID 3624 wrote to memory of 4936 3624 1bnhhh.exe 95 PID 3624 wrote to memory of 4936 3624 1bnhhh.exe 95 PID 4936 wrote to memory of 4892 4936 dpjjd.exe 96 PID 4936 wrote to memory of 4892 4936 dpjjd.exe 96 PID 4936 wrote to memory of 4892 4936 dpjjd.exe 96 PID 4892 wrote to memory of 1920 4892 jjvvp.exe 97 PID 4892 wrote to memory of 1920 4892 jjvvp.exe 97 PID 4892 wrote to memory of 1920 4892 jjvvp.exe 97 PID 1920 wrote to memory of 1608 1920 llllllr.exe 98 PID 1920 wrote to memory of 1608 1920 llllllr.exe 98 PID 1920 wrote to memory of 1608 1920 llllllr.exe 98 PID 1608 wrote to memory of 4188 1608 7ttnhn.exe 99 PID 1608 wrote to memory of 4188 1608 7ttnhn.exe 99 PID 1608 wrote to memory of 4188 1608 7ttnhn.exe 99 PID 4188 wrote to memory of 2364 4188 nbnnnt.exe 100 PID 4188 wrote to memory of 2364 4188 nbnnnt.exe 100 PID 4188 wrote to memory of 2364 4188 nbnnnt.exe 100 PID 2364 wrote to memory of 3044 2364 vddjv.exe 101 PID 2364 wrote to memory of 3044 2364 vddjv.exe 101 PID 2364 wrote to memory of 3044 2364 vddjv.exe 101 PID 3044 wrote to memory of 4872 3044 htnnbh.exe 102 PID 3044 wrote to memory of 4872 3044 htnnbh.exe 102 PID 3044 wrote to memory of 4872 3044 htnnbh.exe 102 PID 4872 wrote to memory of 5016 4872 nttnhh.exe 104 PID 4872 wrote to memory of 5016 4872 nttnhh.exe 104 PID 4872 wrote to memory of 5016 4872 nttnhh.exe 104 PID 5016 wrote to memory of 4428 5016 dpppv.exe 105 PID 5016 wrote to memory of 4428 5016 dpppv.exe 105 PID 5016 wrote to memory of 4428 5016 dpppv.exe 105 PID 4428 wrote to memory of 4944 4428 rlxllxr.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe"C:\Users\Admin\AppData\Local\Temp\91f0ef372d99748d24a4c8abcf6c55705ba37ecae6a3f5a05a277789d85c5689.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\7lxlxrx.exec:\7lxlxrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\bnttnn.exec:\bnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\tthntt.exec:\tthntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\dvvdv.exec:\dvvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vjvpj.exec:\vjvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\lllfffx.exec:\lllfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\3bnntb.exec:\3bnntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\jdppj.exec:\jdppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\djddv.exec:\djddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\ffffxxx.exec:\ffffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\1bnhhh.exec:\1bnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\dpjjd.exec:\dpjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jjvvp.exec:\jjvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\llllllr.exec:\llllllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\7ttnhn.exec:\7ttnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nbnnnt.exec:\nbnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\vddjv.exec:\vddjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\htnnbh.exec:\htnnbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nttnhh.exec:\nttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\dpppv.exec:\dpppv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\rlxllxr.exec:\rlxllxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jvddv.exec:\jvddv.exe23⤵
- Executes dropped EXE
PID:4944 -
\??\c:\9xflrxx.exec:\9xflrxx.exe24⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1nbbhh.exec:\1nbbhh.exe25⤵
- Executes dropped EXE
PID:3936 -
\??\c:\ddppj.exec:\ddppj.exe26⤵
- Executes dropped EXE
PID:4572 -
\??\c:\7rrrlrr.exec:\7rrrlrr.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\htnnhh.exec:\htnnhh.exe28⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tthnnn.exec:\tthnnn.exe29⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pjpjj.exec:\pjpjj.exe30⤵
- Executes dropped EXE
PID:824 -
\??\c:\ffffflx.exec:\ffffflx.exe31⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhttnt.exec:\hhttnt.exe32⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nttnhh.exec:\nttnhh.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pdppp.exec:\pdppp.exe34⤵
- Executes dropped EXE
PID:4336 -
\??\c:\dvvpj.exec:\dvvpj.exe35⤵
- Executes dropped EXE
PID:636 -
\??\c:\llllfll.exec:\llllfll.exe36⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lflrlrl.exec:\lflrlrl.exe37⤵
- Executes dropped EXE
PID:4020 -
\??\c:\nhhhhh.exec:\nhhhhh.exe38⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bbtttt.exec:\bbtttt.exe39⤵
- Executes dropped EXE
PID:3600 -
\??\c:\jdjdd.exec:\jdjdd.exe40⤵
- Executes dropped EXE
PID:4388 -
\??\c:\dvddp.exec:\dvddp.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lxfrrxx.exec:\lxfrrxx.exe42⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hthhhh.exec:\hthhhh.exe43⤵
- Executes dropped EXE
PID:2080 -
\??\c:\nbtnhh.exec:\nbtnhh.exe44⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ppdjd.exec:\ppdjd.exe45⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rrrrlll.exec:\rrrrlll.exe46⤵
- Executes dropped EXE
PID:4768 -
\??\c:\ntttnt.exec:\ntttnt.exe47⤵
- Executes dropped EXE
PID:2076 -
\??\c:\htttbb.exec:\htttbb.exe48⤵
- Executes dropped EXE
PID:1380 -
\??\c:\vpjdj.exec:\vpjdj.exe49⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pjvvp.exec:\pjvvp.exe50⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lxlflrf.exec:\lxlflrf.exe51⤵
- Executes dropped EXE
PID:4936 -
\??\c:\rllfffx.exec:\rllfffx.exe52⤵
- Executes dropped EXE
PID:1436 -
\??\c:\hntnhh.exec:\hntnhh.exe53⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nhhhnn.exec:\nhhhnn.exe54⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pjjdp.exec:\pjjdp.exe55⤵
- Executes dropped EXE
PID:3528 -
\??\c:\7bbbtb.exec:\7bbbtb.exe56⤵
- Executes dropped EXE
PID:4804 -
\??\c:\jjjjv.exec:\jjjjv.exe57⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1frrrxx.exec:\1frrrxx.exe58⤵
- Executes dropped EXE
PID:1468 -
\??\c:\llrxxff.exec:\llrxxff.exe59⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5nttnn.exec:\5nttnn.exe60⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nnhntt.exec:\nnhntt.exe61⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pppjp.exec:\pppjp.exe62⤵
- Executes dropped EXE
PID:620 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe63⤵
- Executes dropped EXE
PID:4428 -
\??\c:\llxrffr.exec:\llxrffr.exe64⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhnbtt.exec:\nhnbtt.exe65⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hhbtnt.exec:\hhbtnt.exe66⤵PID:3640
-
\??\c:\vpvdv.exec:\vpvdv.exe67⤵PID:3128
-
\??\c:\pdjjj.exec:\pdjjj.exe68⤵PID:4960
-
\??\c:\5rxrlll.exec:\5rxrlll.exe69⤵PID:4456
-
\??\c:\rlflrxl.exec:\rlflrxl.exe70⤵PID:3188
-
\??\c:\bnbbht.exec:\bnbbht.exe71⤵PID:3504
-
\??\c:\dvjjj.exec:\dvjjj.exe72⤵PID:2840
-
\??\c:\7jjdd.exec:\7jjdd.exe73⤵PID:4084
-
\??\c:\rffxxff.exec:\rffxxff.exe74⤵PID:3660
-
\??\c:\tttttt.exec:\tttttt.exe75⤵PID:5112
-
\??\c:\hbtnnn.exec:\hbtnnn.exe76⤵PID:1836
-
\??\c:\dppjd.exec:\dppjd.exe77⤵PID:2316
-
\??\c:\rrffrxx.exec:\rrffrxx.exe78⤵PID:1252
-
\??\c:\ntbbbh.exec:\ntbbbh.exe79⤵PID:3784
-
\??\c:\5tttnt.exec:\5tttnt.exe80⤵PID:3224
-
\??\c:\pvvjp.exec:\pvvjp.exe81⤵PID:3896
-
\??\c:\1dpjp.exec:\1dpjp.exe82⤵PID:2800
-
\??\c:\xfxxllx.exec:\xfxxllx.exe83⤵PID:2820
-
\??\c:\bbbbtt.exec:\bbbbtt.exe84⤵PID:64
-
\??\c:\ppvvp.exec:\ppvvp.exe85⤵PID:2844
-
\??\c:\dvjpd.exec:\dvjpd.exe86⤵PID:2780
-
\??\c:\3xlllll.exec:\3xlllll.exe87⤵PID:4528
-
\??\c:\lllllrf.exec:\lllllrf.exe88⤵PID:1524
-
\??\c:\nhhnhn.exec:\nhhnhn.exe89⤵PID:3488
-
\??\c:\pdpjp.exec:\pdpjp.exe90⤵PID:4652
-
\??\c:\pdvvp.exec:\pdvvp.exe91⤵PID:4256
-
\??\c:\fflxxxx.exec:\fflxxxx.exe92⤵PID:5076
-
\??\c:\1xlrxrx.exec:\1xlrxrx.exe93⤵PID:3268
-
\??\c:\3bnttn.exec:\3bnttn.exe94⤵PID:4940
-
\??\c:\btttnt.exec:\btttnt.exe95⤵PID:1764
-
\??\c:\pvvvv.exec:\pvvvv.exe96⤵PID:3376
-
\??\c:\lflrxxx.exec:\lflrxxx.exe97⤵PID:4936
-
\??\c:\7rrfffl.exec:\7rrfffl.exe98⤵PID:408
-
\??\c:\btttnt.exec:\btttnt.exe99⤵PID:4496
-
\??\c:\vpdjd.exec:\vpdjd.exe100⤵PID:3288
-
\??\c:\jvjjp.exec:\jvjjp.exe101⤵PID:3528
-
\??\c:\xxfffrl.exec:\xxfffrl.exe102⤵PID:4112
-
\??\c:\xfffffx.exec:\xfffffx.exe103⤵PID:4792
-
\??\c:\5bnhnh.exec:\5bnhnh.exe104⤵PID:4784
-
\??\c:\nhhbnn.exec:\nhhbnn.exe105⤵PID:3236
-
\??\c:\vpvjd.exec:\vpvjd.exe106⤵PID:1784
-
\??\c:\djvjp.exec:\djvjp.exe107⤵PID:3092
-
\??\c:\rffxllf.exec:\rffxllf.exe108⤵PID:3988
-
\??\c:\fxlxffl.exec:\fxlxffl.exe109⤵PID:1028
-
\??\c:\hbbnhh.exec:\hbbnhh.exe110⤵PID:5108
-
\??\c:\tnhbbt.exec:\tnhbbt.exe111⤵PID:1696
-
\??\c:\3ddvj.exec:\3ddvj.exe112⤵PID:4944
-
\??\c:\vdvvj.exec:\vdvvj.exe113⤵PID:4676
-
\??\c:\5lrrffx.exec:\5lrrffx.exe114⤵PID:2752
-
\??\c:\ffrxlxx.exec:\ffrxlxx.exe115⤵PID:4984
-
\??\c:\thtnhb.exec:\thtnhb.exe116⤵PID:4520
-
\??\c:\9hhbtb.exec:\9hhbtb.exe117⤵PID:2892
-
\??\c:\jpdpv.exec:\jpdpv.exe118⤵PID:3596
-
\??\c:\3fllrlr.exec:\3fllrlr.exe119⤵PID:4468
-
\??\c:\ffxxffr.exec:\ffxxffr.exe120⤵PID:2744
-
\??\c:\bnbbbb.exec:\bnbbbb.exe121⤵PID:1512
-
\??\c:\1vpjd.exec:\1vpjd.exe122⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-