Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
24/07/2024, 03:47
Behavioral task
behavioral1
Sample
45419a2b1c836cf7420af92256160300N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
45419a2b1c836cf7420af92256160300N.exe
-
Size
282KB
-
MD5
45419a2b1c836cf7420af92256160300
-
SHA1
71797c68af9ef388779b1b634f27696c210156f7
-
SHA256
b2db0913cc6b5d83616679cd612134e96dca3468f8438346f39ca4f5e238b05c
-
SHA512
59ba4038060f274dfff261adffb9efdb1a981bc0e2d7a03413ab5487853879e7719dcd9193725187eb3af7b375e7ab5aa0ef5f3a11bf25332c411d4ff0df84cd
-
SSDEEP
3072:LhOmTsF93UYfwC6GIoutVwT0JOfZKldUIbvpynrSPu/+//uGK:Lcm4FmowdHoSVwT+aZKlumArSPBXuGK
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1068-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2264-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2724-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/592-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/600-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4624 jjvjp.exe 840 rxfffxf.exe 3460 nnbtnt.exe 4744 vvddp.exe 2264 lxlllrx.exe 3124 hbthhb.exe 4724 xfffrrf.exe 3656 xlxxrrl.exe 1716 btbhbh.exe 408 jpjdv.exe 4480 ffxrllf.exe 1236 jjjjd.exe 4296 rxxxrxx.exe 3108 1ntnhn.exe 1768 ddddv.exe 3464 fxlllll.exe 5076 hbnnnt.exe 2588 jdddv.exe 636 lxxlrxr.exe 3592 tnhbtt.exe 1744 jvpjj.exe 1544 lxrlrff.exe 3164 xlrrrrf.exe 3380 hntnhb.exe 320 lfllflf.exe 1404 htbbbb.exe 3896 frxxxxx.exe 1880 lllrrlf.exe 1284 bhhtnb.exe 1532 flxxlrr.exe 816 hbnnhb.exe 4960 ppdjd.exe 548 djjvv.exe 4672 xrrfflr.exe 1712 xlxrrll.exe 3852 nnntnn.exe 1628 pdvdd.exe 5036 lxfffff.exe 1060 bntnhh.exe 2896 hhttnn.exe 1112 jjpjd.exe 2208 xrlfxrl.exe 4804 bntttb.exe 2280 ttntnb.exe 2724 pjjdd.exe 840 xfrrrrr.exe 2300 fxlxfll.exe 4744 hthnbt.exe 4792 djjjj.exe 3760 xfllrxf.exe 3616 nhnbtn.exe 4908 djvvj.exe 5016 xxrfrfr.exe 592 rlffffl.exe 3208 hntttt.exe 4600 vjdjj.exe 2120 frlrrrr.exe 1856 nnhbbb.exe 4480 9jdvv.exe 2100 rfffxlx.exe 440 hhbbbt.exe 3604 hbhtnt.exe 2760 9pjpv.exe 4244 rxlrrlr.exe -
resource yara_rule behavioral2/memory/1068-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1068-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002344c-3.dat upx behavioral2/files/0x00070000000234a8-10.dat upx behavioral2/memory/4624-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234a9-15.dat upx behavioral2/files/0x00070000000234aa-20.dat upx behavioral2/memory/4744-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ab-25.dat upx behavioral2/files/0x00070000000234ac-30.dat upx behavioral2/memory/3124-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ad-36.dat upx behavioral2/memory/4724-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3656-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234af-47.dat upx behavioral2/memory/1716-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b0-52.dat upx behavioral2/files/0x00070000000234b1-55.dat upx behavioral2/files/0x00070000000234b2-61.dat upx behavioral2/memory/4480-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4296-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b4-72.dat upx behavioral2/memory/4296-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b5-76.dat upx behavioral2/memory/1768-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3464-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b7-85.dat upx behavioral2/files/0x00070000000234b6-80.dat upx behavioral2/memory/5076-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ba-101.dat upx behavioral2/memory/3592-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bc-111.dat upx behavioral2/memory/1544-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234be-121.dat upx behavioral2/memory/3164-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bf-125.dat upx behavioral2/files/0x00070000000234bd-115.dat upx behavioral2/memory/320-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c1-133.dat upx behavioral2/memory/1880-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1284-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c4-148.dat upx behavioral2/files/0x00070000000234c6-159.dat upx behavioral2/memory/4960-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1712-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1628-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3852-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c5-154.dat upx behavioral2/memory/5036-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2896-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1112-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c3-143.dat upx behavioral2/files/0x00070000000234c2-139.dat upx behavioral2/memory/1404-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c0-130.dat upx behavioral2/memory/4804-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1744-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234a5-106.dat upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxrrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 4624 1068 45419a2b1c836cf7420af92256160300N.exe 84 PID 1068 wrote to memory of 4624 1068 45419a2b1c836cf7420af92256160300N.exe 84 PID 1068 wrote to memory of 4624 1068 45419a2b1c836cf7420af92256160300N.exe 84 PID 4624 wrote to memory of 840 4624 jjvjp.exe 132 PID 4624 wrote to memory of 840 4624 jjvjp.exe 132 PID 4624 wrote to memory of 840 4624 jjvjp.exe 132 PID 840 wrote to memory of 3460 840 rxfffxf.exe 86 PID 840 wrote to memory of 3460 840 rxfffxf.exe 86 PID 840 wrote to memory of 3460 840 rxfffxf.exe 86 PID 3460 wrote to memory of 4744 3460 nnbtnt.exe 134 PID 3460 wrote to memory of 4744 3460 nnbtnt.exe 134 PID 3460 wrote to memory of 4744 3460 nnbtnt.exe 134 PID 4744 wrote to memory of 2264 4744 vvddp.exe 88 PID 4744 wrote to memory of 2264 4744 vvddp.exe 88 PID 4744 wrote to memory of 2264 4744 vvddp.exe 88 PID 2264 wrote to memory of 3124 2264 lxlllrx.exe 90 PID 2264 wrote to memory of 3124 2264 lxlllrx.exe 90 PID 2264 wrote to memory of 3124 2264 lxlllrx.exe 90 PID 3124 wrote to memory of 4724 3124 hbthhb.exe 91 PID 3124 wrote to memory of 4724 3124 hbthhb.exe 91 PID 3124 wrote to memory of 4724 3124 hbthhb.exe 91 PID 4724 wrote to memory of 3656 4724 xfffrrf.exe 92 PID 4724 wrote to memory of 3656 4724 xfffrrf.exe 92 PID 4724 wrote to memory of 3656 4724 xfffrrf.exe 92 PID 3656 wrote to memory of 1716 3656 xlxxrrl.exe 93 PID 3656 wrote to memory of 1716 3656 xlxxrrl.exe 93 PID 3656 wrote to memory of 1716 3656 xlxxrrl.exe 93 PID 1716 wrote to memory of 408 1716 btbhbh.exe 95 PID 1716 wrote to memory of 408 1716 btbhbh.exe 95 PID 1716 wrote to memory of 408 1716 btbhbh.exe 95 PID 408 wrote to memory of 4480 408 jpjdv.exe 145 PID 408 wrote to memory of 4480 408 jpjdv.exe 145 PID 408 wrote to memory of 4480 408 jpjdv.exe 145 PID 4480 wrote to memory of 1236 4480 ffxrllf.exe 98 PID 4480 wrote to memory of 1236 4480 ffxrllf.exe 98 PID 4480 wrote to memory of 1236 4480 ffxrllf.exe 98 PID 1236 wrote to memory of 4296 1236 jjjjd.exe 99 PID 1236 wrote to memory of 4296 1236 jjjjd.exe 99 PID 1236 wrote to memory of 4296 1236 jjjjd.exe 99 PID 4296 wrote to memory of 3108 4296 rxxxrxx.exe 100 PID 4296 wrote to memory of 3108 4296 rxxxrxx.exe 100 PID 4296 wrote to memory of 3108 4296 rxxxrxx.exe 100 PID 3108 wrote to memory of 1768 3108 1ntnhn.exe 101 PID 3108 wrote to memory of 1768 3108 1ntnhn.exe 101 PID 3108 wrote to memory of 1768 3108 1ntnhn.exe 101 PID 1768 wrote to memory of 3464 1768 ddddv.exe 152 PID 1768 wrote to memory of 3464 1768 ddddv.exe 152 PID 1768 wrote to memory of 3464 1768 ddddv.exe 152 PID 3464 wrote to memory of 5076 3464 fxlllll.exe 103 PID 3464 wrote to memory of 5076 3464 fxlllll.exe 103 PID 3464 wrote to memory of 5076 3464 fxlllll.exe 103 PID 5076 wrote to memory of 2588 5076 hbnnnt.exe 104 PID 5076 wrote to memory of 2588 5076 hbnnnt.exe 104 PID 5076 wrote to memory of 2588 5076 hbnnnt.exe 104 PID 2588 wrote to memory of 636 2588 jdddv.exe 157 PID 2588 wrote to memory of 636 2588 jdddv.exe 157 PID 2588 wrote to memory of 636 2588 jdddv.exe 157 PID 636 wrote to memory of 3592 636 lxxlrxr.exe 106 PID 636 wrote to memory of 3592 636 lxxlrxr.exe 106 PID 636 wrote to memory of 3592 636 lxxlrxr.exe 106 PID 3592 wrote to memory of 1744 3592 tnhbtt.exe 107 PID 3592 wrote to memory of 1744 3592 tnhbtt.exe 107 PID 3592 wrote to memory of 1744 3592 tnhbtt.exe 107 PID 1744 wrote to memory of 1544 1744 jvpjj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\45419a2b1c836cf7420af92256160300N.exe"C:\Users\Admin\AppData\Local\Temp\45419a2b1c836cf7420af92256160300N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jjvjp.exec:\jjvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\rxfffxf.exec:\rxfffxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\nnbtnt.exec:\nnbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\vvddp.exec:\vvddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\lxlllrx.exec:\lxlllrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hbthhb.exec:\hbthhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\xfffrrf.exec:\xfffrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\xlxxrrl.exec:\xlxxrrl.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\btbhbh.exec:\btbhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\jpjdv.exec:\jpjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\ffxrllf.exec:\ffxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jjjjd.exec:\jjjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\1ntnhn.exec:\1ntnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\ddddv.exec:\ddddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\fxlllll.exec:\fxlllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\hbnnnt.exec:\hbnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\jdddv.exec:\jdddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lxxlrxr.exec:\lxxlrxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tnhbtt.exec:\tnhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\jvpjj.exec:\jvpjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\lxrlrff.exec:\lxrlrff.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\hntnhb.exec:\hntnhb.exe25⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lfllflf.exec:\lfllflf.exe26⤵
- Executes dropped EXE
PID:320 -
\??\c:\htbbbb.exec:\htbbbb.exe27⤵
- Executes dropped EXE
PID:1404 -
\??\c:\frxxxxx.exec:\frxxxxx.exe28⤵
- Executes dropped EXE
PID:3896 -
\??\c:\lllrrlf.exec:\lllrrlf.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bhhtnb.exec:\bhhtnb.exe30⤵
- Executes dropped EXE
PID:1284 -
\??\c:\flxxlrr.exec:\flxxlrr.exe31⤵
- Executes dropped EXE
PID:1532 -
\??\c:\hbnnhb.exec:\hbnnhb.exe32⤵
- Executes dropped EXE
PID:816 -
\??\c:\ppdjd.exec:\ppdjd.exe33⤵
- Executes dropped EXE
PID:4960 -
\??\c:\djjvv.exec:\djjvv.exe34⤵
- Executes dropped EXE
PID:548 -
\??\c:\xrrfflr.exec:\xrrfflr.exe35⤵
- Executes dropped EXE
PID:4672 -
\??\c:\xlxrrll.exec:\xlxrrll.exe36⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nnntnn.exec:\nnntnn.exe37⤵
- Executes dropped EXE
PID:3852 -
\??\c:\pdvdd.exec:\pdvdd.exe38⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lxfffff.exec:\lxfffff.exe39⤵
- Executes dropped EXE
PID:5036 -
\??\c:\bntnhh.exec:\bntnhh.exe40⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hhttnn.exec:\hhttnn.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jjpjd.exec:\jjpjd.exe42⤵
- Executes dropped EXE
PID:1112 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bntttb.exec:\bntttb.exe44⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ttntnb.exec:\ttntnb.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pjjdd.exec:\pjjdd.exe46⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe47⤵
- Executes dropped EXE
PID:840 -
\??\c:\fxlxfll.exec:\fxlxfll.exe48⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hthnbt.exec:\hthnbt.exe49⤵
- Executes dropped EXE
PID:4744 -
\??\c:\djjjj.exec:\djjjj.exe50⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xfllrxf.exec:\xfllrxf.exe51⤵
- Executes dropped EXE
PID:3760 -
\??\c:\nhnbtn.exec:\nhnbtn.exe52⤵
- Executes dropped EXE
PID:3616 -
\??\c:\djvvj.exec:\djvvj.exe53⤵
- Executes dropped EXE
PID:4908 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe54⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rlffffl.exec:\rlffffl.exe55⤵
- Executes dropped EXE
PID:592 -
\??\c:\hntttt.exec:\hntttt.exe56⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vjdjj.exec:\vjdjj.exe57⤵
- Executes dropped EXE
PID:4600 -
\??\c:\frlrrrr.exec:\frlrrrr.exe58⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nnhbbb.exec:\nnhbbb.exe59⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9jdvv.exec:\9jdvv.exe60⤵
- Executes dropped EXE
PID:4480 -
\??\c:\rfffxlx.exec:\rfffxlx.exe61⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hhbbbt.exec:\hhbbbt.exe62⤵
- Executes dropped EXE
PID:440 -
\??\c:\hbhtnt.exec:\hbhtnt.exe63⤵
- Executes dropped EXE
PID:3604 -
\??\c:\9pjpv.exec:\9pjpv.exe64⤵
- Executes dropped EXE
PID:2760 -
\??\c:\rxlrrlr.exec:\rxlrrlr.exe65⤵
- Executes dropped EXE
PID:4244 -
\??\c:\5bbtbh.exec:\5bbtbh.exe66⤵PID:2440
-
\??\c:\hbthbb.exec:\hbthbb.exe67⤵PID:3464
-
\??\c:\jpvdj.exec:\jpvdj.exe68⤵PID:4964
-
\??\c:\frllxxx.exec:\frllxxx.exe69⤵PID:2348
-
\??\c:\bbbbbh.exec:\bbbbbh.exe70⤵PID:3752
-
\??\c:\3thhtb.exec:\3thhtb.exe71⤵PID:4920
-
\??\c:\djvjp.exec:\djvjp.exe72⤵PID:636
-
\??\c:\xxrllxx.exec:\xxrllxx.exe73⤵PID:4236
-
\??\c:\rflfxxr.exec:\rflfxxr.exe74⤵PID:1260
-
\??\c:\bttnnh.exec:\bttnnh.exe75⤵PID:4612
-
\??\c:\pvvvj.exec:\pvvvj.exe76⤵PID:2216
-
\??\c:\pdppp.exec:\pdppp.exe77⤵PID:3164
-
\??\c:\3lrrrrf.exec:\3lrrrrf.exe78⤵PID:1044
-
\??\c:\tthhbb.exec:\tthhbb.exe79⤵PID:4812
-
\??\c:\ntbbbb.exec:\ntbbbb.exe80⤵PID:4736
-
\??\c:\jvdvv.exec:\jvdvv.exe81⤵PID:4016
-
\??\c:\rlxxrxr.exec:\rlxxrxr.exe82⤵PID:1056
-
\??\c:\9hbbbb.exec:\9hbbbb.exe83⤵PID:1588
-
\??\c:\nhnbtn.exec:\nhnbtn.exe84⤵PID:1928
-
\??\c:\ppdjv.exec:\ppdjv.exe85⤵PID:600
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe86⤵PID:1284
-
\??\c:\btbhhb.exec:\btbhhb.exe87⤵PID:4948
-
\??\c:\vpppp.exec:\vpppp.exe88⤵PID:2748
-
\??\c:\jdvjp.exec:\jdvjp.exe89⤵PID:2728
-
\??\c:\nbnbbt.exec:\nbnbbt.exe90⤵PID:1784
-
\??\c:\jpddd.exec:\jpddd.exe91⤵PID:772
-
\??\c:\xrflrrf.exec:\xrflrrf.exe92⤵PID:232
-
\??\c:\hhnnnt.exec:\hhnnnt.exe93⤵PID:4876
-
\??\c:\vvddv.exec:\vvddv.exe94⤵PID:4672
-
\??\c:\1jdjd.exec:\1jdjd.exe95⤵PID:780
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe96⤵PID:3852
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe97⤵PID:4524
-
\??\c:\hthhnb.exec:\hthhnb.exe98⤵PID:2964
-
\??\c:\vvddp.exec:\vvddp.exe99⤵PID:3868
-
\??\c:\ffrlffl.exec:\ffrlffl.exe100⤵PID:3996
-
\??\c:\fxxxflr.exec:\fxxxflr.exe101⤵PID:2344
-
\??\c:\1ntttt.exec:\1ntttt.exe102⤵PID:4228
-
\??\c:\9jdpp.exec:\9jdpp.exe103⤵PID:3844
-
\??\c:\vdppd.exec:\vdppd.exe104⤵PID:3712
-
\??\c:\xflxfff.exec:\xflxfff.exe105⤵PID:2280
-
\??\c:\bbhhbb.exec:\bbhhbb.exe106⤵PID:4220
-
\??\c:\bhtttb.exec:\bhtttb.exe107⤵PID:4040
-
\??\c:\dpdjj.exec:\dpdjj.exe108⤵PID:2300
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe109⤵PID:3528
-
\??\c:\xrrlfll.exec:\xrrlfll.exe110⤵PID:4792
-
\??\c:\thnhhh.exec:\thnhhh.exe111⤵PID:660
-
\??\c:\jjppp.exec:\jjppp.exe112⤵PID:3524
-
\??\c:\jvddj.exec:\jvddj.exe113⤵PID:1408
-
\??\c:\frxflrl.exec:\frxflrl.exe114⤵PID:3656
-
\??\c:\nbbtbb.exec:\nbbtbb.exe115⤵PID:524
-
\??\c:\jvvpv.exec:\jvvpv.exe116⤵PID:236
-
\??\c:\9frllll.exec:\9frllll.exe117⤵PID:4596
-
\??\c:\lllffff.exec:\lllffff.exe118⤵PID:3408
-
\??\c:\tbbbnt.exec:\tbbbnt.exe119⤵PID:184
-
\??\c:\ppvvd.exec:\ppvvd.exe120⤵PID:1856
-
\??\c:\5fllfrr.exec:\5fllfrr.exe121⤵PID:3584
-
\??\c:\9thtbh.exec:\9thtbh.exe122⤵PID:4284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-