Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
46s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 22:46
Static task
static1
Behavioral task
behavioral1
Sample
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe
Resource
win7-20240704-en
General
-
Target
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe
-
Size
64KB
-
MD5
f72ac762b0aa8a358d48048e892c60f6
-
SHA1
48ce0b25ea916d3271d1acac8f092a3fa6fad58e
-
SHA256
5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144
-
SHA512
c0a6eba162140e0ee8c872e761080ff763a2159cc20e4a6661ed04027e26bc36f710d6074e5b58d0bb63933b2d02641836591935510f0ee2c7dddb387ddf95a3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNYFJ:ymb3NkkiQ3mdBjFIvlpyJ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2564-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1384 rrrrrfx.exe 4752 5nnnhh.exe 1348 xllllxl.exe 3024 hbtttb.exe 4664 llxxrxx.exe 4788 lllrrxx.exe 1644 jvdpv.exe 3432 nhnntb.exe 3672 fffxxrx.exe 2268 hhhbtt.exe 2620 bnbnbh.exe 2628 pvjvj.exe 2264 hhhhhb.exe 4636 ddddv.exe 2440 dvddd.exe 1764 bbntbh.exe 884 rfxlrxl.exe 2292 htttbh.exe 1960 frflxfl.exe 3888 htbtbh.exe 2284 ddddp.exe 3124 vdjvd.exe 3972 bntthn.exe 2028 vddpj.exe 2848 vvpdv.exe 1956 xrlfrlr.exe 4720 nntntn.exe 2984 ttnttb.exe 4012 xxxlflf.exe 3604 dpppv.exe 4840 btbhhn.exe 3964 pvddd.exe 4436 bbbttt.exe 1908 lxlrlxr.exe 1136 hbbnht.exe 2532 bbbttn.exe 5068 btttnn.exe 4900 xflfffx.exe 3936 lfrllrf.exe 4672 dvjpd.exe 2888 xllfxxx.exe 1320 rrlxfrx.exe 4512 vvvdp.exe 3556 1bnhnb.exe 364 xrfxlff.exe 2000 5jdjv.exe 4288 dppjv.exe 4924 hntthb.exe 1168 rlrfxrf.exe 3432 jvjvd.exe 2124 xrxxxff.exe 372 pvdvv.exe 432 nhbnhn.exe 780 lxfrxrl.exe 380 btthtn.exe 5016 rflflll.exe 2648 nntnbh.exe 2592 vvpjd.exe 4432 vpjdv.exe 760 jdjpp.exe 1008 thttbb.exe 5104 llxxlfl.exe 3852 pddvp.exe 552 vpppv.exe -
resource yara_rule behavioral2/memory/2564-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1384 2564 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 85 PID 2564 wrote to memory of 1384 2564 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 85 PID 2564 wrote to memory of 1384 2564 5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe 85 PID 1384 wrote to memory of 4752 1384 rrrrrfx.exe 86 PID 1384 wrote to memory of 4752 1384 rrrrrfx.exe 86 PID 1384 wrote to memory of 4752 1384 rrrrrfx.exe 86 PID 4752 wrote to memory of 1348 4752 5nnnhh.exe 88 PID 4752 wrote to memory of 1348 4752 5nnnhh.exe 88 PID 4752 wrote to memory of 1348 4752 5nnnhh.exe 88 PID 1348 wrote to memory of 3024 1348 xllllxl.exe 89 PID 1348 wrote to memory of 3024 1348 xllllxl.exe 89 PID 1348 wrote to memory of 3024 1348 xllllxl.exe 89 PID 3024 wrote to memory of 4664 3024 hbtttb.exe 90 PID 3024 wrote to memory of 4664 3024 hbtttb.exe 90 PID 3024 wrote to memory of 4664 3024 hbtttb.exe 90 PID 4664 wrote to memory of 4788 4664 llxxrxx.exe 91 PID 4664 wrote to memory of 4788 4664 llxxrxx.exe 91 PID 4664 wrote to memory of 4788 4664 llxxrxx.exe 91 PID 4788 wrote to memory of 1644 4788 lllrrxx.exe 92 PID 4788 wrote to memory of 1644 4788 lllrrxx.exe 92 PID 4788 wrote to memory of 1644 4788 lllrrxx.exe 92 PID 1644 wrote to memory of 3432 1644 jvdpv.exe 93 PID 1644 wrote to memory of 3432 1644 jvdpv.exe 93 PID 1644 wrote to memory of 3432 1644 jvdpv.exe 93 PID 3432 wrote to memory of 3672 3432 nhnntb.exe 94 PID 3432 wrote to memory of 3672 3432 nhnntb.exe 94 PID 3432 wrote to memory of 3672 3432 nhnntb.exe 94 PID 3672 wrote to memory of 2268 3672 fffxxrx.exe 95 PID 3672 wrote to memory of 2268 3672 fffxxrx.exe 95 PID 3672 wrote to memory of 2268 3672 fffxxrx.exe 95 PID 2268 wrote to memory of 2620 2268 hhhbtt.exe 96 PID 2268 wrote to memory of 2620 2268 hhhbtt.exe 96 PID 2268 wrote to memory of 2620 2268 hhhbtt.exe 96 PID 2620 wrote to memory of 2628 2620 bnbnbh.exe 97 PID 2620 wrote to memory of 2628 2620 bnbnbh.exe 97 PID 2620 wrote to memory of 2628 2620 bnbnbh.exe 97 PID 2628 wrote to memory of 2264 2628 pvjvj.exe 98 PID 2628 wrote to memory of 2264 2628 pvjvj.exe 98 PID 2628 wrote to memory of 2264 2628 pvjvj.exe 98 PID 2264 wrote to memory of 4636 2264 hhhhhb.exe 99 PID 2264 wrote to memory of 4636 2264 hhhhhb.exe 99 PID 2264 wrote to memory of 4636 2264 hhhhhb.exe 99 PID 4636 wrote to memory of 2440 4636 ddddv.exe 100 PID 4636 wrote to memory of 2440 4636 ddddv.exe 100 PID 4636 wrote to memory of 2440 4636 ddddv.exe 100 PID 2440 wrote to memory of 1764 2440 dvddd.exe 101 PID 2440 wrote to memory of 1764 2440 dvddd.exe 101 PID 2440 wrote to memory of 1764 2440 dvddd.exe 101 PID 1764 wrote to memory of 884 1764 bbntbh.exe 102 PID 1764 wrote to memory of 884 1764 bbntbh.exe 102 PID 1764 wrote to memory of 884 1764 bbntbh.exe 102 PID 884 wrote to memory of 2292 884 rfxlrxl.exe 103 PID 884 wrote to memory of 2292 884 rfxlrxl.exe 103 PID 884 wrote to memory of 2292 884 rfxlrxl.exe 103 PID 2292 wrote to memory of 1960 2292 htttbh.exe 104 PID 2292 wrote to memory of 1960 2292 htttbh.exe 104 PID 2292 wrote to memory of 1960 2292 htttbh.exe 104 PID 1960 wrote to memory of 3888 1960 frflxfl.exe 105 PID 1960 wrote to memory of 3888 1960 frflxfl.exe 105 PID 1960 wrote to memory of 3888 1960 frflxfl.exe 105 PID 3888 wrote to memory of 2284 3888 htbtbh.exe 152 PID 3888 wrote to memory of 2284 3888 htbtbh.exe 152 PID 3888 wrote to memory of 2284 3888 htbtbh.exe 152 PID 2284 wrote to memory of 3124 2284 ddddp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe"C:\Users\Admin\AppData\Local\Temp\5da15c041a8cae693b0211b0e6205ff6a2d820ba126e5f566e7683ea5a8fc144.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rrrrrfx.exec:\rrrrrfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\5nnnhh.exec:\5nnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\xllllxl.exec:\xllllxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\hbtttb.exec:\hbtttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llxxrxx.exec:\llxxrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\lllrrxx.exec:\lllrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\jvdpv.exec:\jvdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\nhnntb.exec:\nhnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\fffxxrx.exec:\fffxxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\hhhbtt.exec:\hhhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\bnbnbh.exec:\bnbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\pvjvj.exec:\pvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hhhhhb.exec:\hhhhhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\ddddv.exec:\ddddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\dvddd.exec:\dvddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\bbntbh.exec:\bbntbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\rfxlrxl.exec:\rfxlrxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\htttbh.exec:\htttbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\frflxfl.exec:\frflxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\htbtbh.exec:\htbtbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\ddddp.exec:\ddddp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\vdjvd.exec:\vdjvd.exe23⤵
- Executes dropped EXE
PID:3124 -
\??\c:\bntthn.exec:\bntthn.exe24⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vddpj.exec:\vddpj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\vvpdv.exec:\vvpdv.exe26⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrlfrlr.exec:\xrlfrlr.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\nntntn.exec:\nntntn.exe28⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ttnttb.exec:\ttnttb.exe29⤵
- Executes dropped EXE
PID:2984 -
\??\c:\xxxlflf.exec:\xxxlflf.exe30⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dpppv.exec:\dpppv.exe31⤵
- Executes dropped EXE
PID:3604 -
\??\c:\btbhhn.exec:\btbhhn.exe32⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pvddd.exec:\pvddd.exe33⤵
- Executes dropped EXE
PID:3964 -
\??\c:\bbbttt.exec:\bbbttt.exe34⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lxlrlxr.exec:\lxlrlxr.exe35⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbbnht.exec:\hbbnht.exe36⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bbbttn.exec:\bbbttn.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\rflrfxx.exec:\rflrfxx.exe38⤵PID:3176
-
\??\c:\btttnn.exec:\btttnn.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\xflfffx.exec:\xflfffx.exe40⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lfrllrf.exec:\lfrllrf.exe41⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dvjpd.exec:\dvjpd.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4672 -
\??\c:\xllfxxx.exec:\xllfxxx.exe43⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe44⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vvvdp.exec:\vvvdp.exe45⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1bnhnb.exec:\1bnhnb.exe46⤵
- Executes dropped EXE
PID:3556 -
\??\c:\xrfxlff.exec:\xrfxlff.exe47⤵
- Executes dropped EXE
PID:364 -
\??\c:\5jdjv.exec:\5jdjv.exe48⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dppjv.exec:\dppjv.exe49⤵
- Executes dropped EXE
PID:4288 -
\??\c:\hntthb.exec:\hntthb.exe50⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rlrfxrf.exec:\rlrfxrf.exe51⤵
- Executes dropped EXE
PID:1168 -
\??\c:\jvjvd.exec:\jvjvd.exe52⤵
- Executes dropped EXE
PID:3432 -
\??\c:\xrxxxff.exec:\xrxxxff.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pvdvv.exec:\pvdvv.exe54⤵
- Executes dropped EXE
PID:372 -
\??\c:\nhbnhn.exec:\nhbnhn.exe55⤵
- Executes dropped EXE
PID:432 -
\??\c:\lxfrxrl.exec:\lxfrxrl.exe56⤵
- Executes dropped EXE
PID:780 -
\??\c:\btthtn.exec:\btthtn.exe57⤵
- Executes dropped EXE
PID:380 -
\??\c:\rflflll.exec:\rflflll.exe58⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nntnbh.exec:\nntnbh.exe59⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vvpjd.exec:\vvpjd.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpjdv.exec:\vpjdv.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jdjpp.exec:\jdjpp.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\thttbb.exec:\thttbb.exe63⤵
- Executes dropped EXE
PID:1008 -
\??\c:\llxxlfl.exec:\llxxlfl.exe64⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pddvp.exec:\pddvp.exe65⤵
- Executes dropped EXE
PID:3852 -
\??\c:\vpppv.exec:\vpppv.exe66⤵
- Executes dropped EXE
PID:552 -
\??\c:\tnbhnt.exec:\tnbhnt.exe67⤵PID:1548
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe68⤵
- System Location Discovery: System Language Discovery
PID:2284 -
\??\c:\bnhbnb.exec:\bnhbnb.exe69⤵PID:952
-
\??\c:\rlxfxlr.exec:\rlxfxlr.exe70⤵PID:1484
-
\??\c:\frxxxrx.exec:\frxxxrx.exe71⤵PID:1952
-
\??\c:\lxlrxlx.exec:\lxlrxlx.exe72⤵PID:2212
-
\??\c:\tbnbhb.exec:\tbnbhb.exe73⤵PID:2300
-
\??\c:\bhnnnb.exec:\bhnnnb.exe74⤵PID:652
-
\??\c:\5llxllx.exec:\5llxllx.exe75⤵PID:4720
-
\??\c:\djjjp.exec:\djjjp.exe76⤵PID:3664
-
\??\c:\ttbntn.exec:\ttbntn.exe77⤵
- System Location Discovery: System Language Discovery
PID:3592 -
\??\c:\xxfxxxl.exec:\xxfxxxl.exe78⤵PID:244
-
\??\c:\pdjdp.exec:\pdjdp.exe79⤵
- System Location Discovery: System Language Discovery
PID:3876 -
\??\c:\hhnntt.exec:\hhnntt.exe80⤵PID:1572
-
\??\c:\rfrrfff.exec:\rfrrfff.exe81⤵PID:4960
-
\??\c:\hnthbn.exec:\hnthbn.exe82⤵PID:1908
-
\??\c:\lflfrrf.exec:\lflfrrf.exe83⤵
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\ddddv.exec:\ddddv.exe84⤵PID:3220
-
\??\c:\5htbbh.exec:\5htbbh.exe85⤵PID:4420
-
\??\c:\lfxffrf.exec:\lfxffrf.exe86⤵PID:3192
-
\??\c:\5pvdp.exec:\5pvdp.exe87⤵PID:4024
-
\??\c:\rrrlxlr.exec:\rrrlxlr.exe88⤵PID:2564
-
\??\c:\fflfxxf.exec:\fflfxxf.exe89⤵PID:2748
-
\??\c:\3nbtnt.exec:\3nbtnt.exe90⤵PID:1216
-
\??\c:\hbhhth.exec:\hbhhth.exe91⤵PID:4908
-
\??\c:\1xrxxff.exec:\1xrxxff.exe92⤵PID:4308
-
\??\c:\vjdjv.exec:\vjdjv.exe93⤵
- System Location Discovery: System Language Discovery
PID:1912 -
\??\c:\1lxrlll.exec:\1lxrlll.exe94⤵
- System Location Discovery: System Language Discovery
PID:2000 -
\??\c:\dpjjd.exec:\dpjjd.exe95⤵PID:2408
-
\??\c:\nhhntn.exec:\nhhntn.exe96⤵PID:2040
-
\??\c:\jjpdp.exec:\jjpdp.exe97⤵PID:4744
-
\??\c:\tbbbth.exec:\tbbbth.exe98⤵PID:4796
-
\??\c:\xxfrrxl.exec:\xxfrrxl.exe99⤵PID:4044
-
\??\c:\thntbb.exec:\thntbb.exe100⤵PID:3288
-
\??\c:\frflrff.exec:\frflrff.exe101⤵PID:3164
-
\??\c:\thhhbt.exec:\thhhbt.exe102⤵PID:432
-
\??\c:\9xxfxff.exec:\9xxfxff.exe103⤵PID:4476
-
\??\c:\tnhbhn.exec:\tnhbhn.exe104⤵
- System Location Discovery: System Language Discovery
PID:5016 -
\??\c:\lxlffxf.exec:\lxlffxf.exe105⤵PID:3048
-
\??\c:\ddjvj.exec:\ddjvj.exe106⤵PID:3156
-
\??\c:\djpjd.exec:\djpjd.exe107⤵PID:3424
-
\??\c:\bhtbnb.exec:\bhtbnb.exe108⤵PID:3388
-
\??\c:\fllxrfx.exec:\fllxrfx.exe109⤵PID:3760
-
\??\c:\rlrrxll.exec:\rlrrxll.exe110⤵PID:4904
-
\??\c:\7vddj.exec:\7vddj.exe111⤵PID:1696
-
\??\c:\nnnhnt.exec:\nnnhnt.exe112⤵PID:1372
-
\??\c:\9pjjp.exec:\9pjjp.exe113⤵PID:5084
-
\??\c:\hbnnhh.exec:\hbnnhh.exe114⤵PID:3236
-
\??\c:\lrlfffl.exec:\lrlfffl.exe115⤵PID:3996
-
\??\c:\ntbbbh.exec:\ntbbbh.exe116⤵PID:3724
-
\??\c:\rrfrflx.exec:\rrfrflx.exe117⤵PID:2304
-
\??\c:\tnhhbt.exec:\tnhhbt.exe118⤵PID:2256
-
\??\c:\xxllrfl.exec:\xxllrfl.exe119⤵
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\btbbbn.exec:\btbbbn.exe120⤵PID:3204
-
\??\c:\rllfrlx.exec:\rllfrlx.exe121⤵PID:4012
-
\??\c:\pdpvd.exec:\pdpvd.exe122⤵PID:3356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-