Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 03:36
Behavioral task
behavioral1
Sample
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe
Resource
win7-20240704-en
General
-
Target
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe
-
Size
403KB
-
MD5
2d02bbbbee4eca264222060e56c3c259
-
SHA1
68723c3714360dd47f35aea222acc909562b1369
-
SHA256
c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313
-
SHA512
1ec90efebf4a0d7f5c6fce19b19b28dbd0598bb265e2f6edf3c19751d3c8ca851603bf2c5ad9cee51ca0f42438743c23b3b0f4ca24fe4ae9e6b4761132a10b83
-
SSDEEP
6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E3N:T4wFHoSEubD2P3N
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3152-6-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3008-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3784-11-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3572-20-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4400-32-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3528-31-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4564-54-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4896-62-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4668-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4684-59-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4216-77-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2428-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4208-96-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/8-103-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2968-108-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4392-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4912-133-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4852-145-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1060-152-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3496-168-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4724-170-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/840-179-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4604-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3676-199-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2976-205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2560-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4700-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3976-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1636-244-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2308-249-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3356-255-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1892-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2420-259-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4392-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4112-280-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2808-287-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1012-322-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3896-339-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/452-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/400-356-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1364-363-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4880-373-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4992-389-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3172-393-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2968-397-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1612-413-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1996-432-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2016-439-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3708-455-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4880-496-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3756-511-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1904-515-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/956-519-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1832-523-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3184-560-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/744-573-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5080-577-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2008-726-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4752-755-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2404-771-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4720-789-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2268-848-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1064-860-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 dpvjp.exe 3784 xxfxrrr.exe 3572 frfxrrr.exe 3528 nbbtbt.exe 4400 3thtbh.exe 2424 btbnnh.exe 3928 bhbthh.exe 4564 hnbbnh.exe 4896 dvvpp.exe 4684 vdjjp.exe 4668 tntbtn.exe 4216 nnhhhh.exe 2428 llxfrrf.exe 1096 fxlfrrr.exe 4208 lflllff.exe 8 lflrxrr.exe 2968 frfxlxx.exe 2032 llxxlxx.exe 4392 llrxlrr.exe 396 ntthhh.exe 4112 bnnnbh.exe 4912 tnbtth.exe 1532 rfxxrxx.exe 4852 ppdvd.exe 1060 vdjdj.exe 3992 flrrlrl.exe 5036 ttbbhn.exe 4724 tthtnn.exe 3496 vdddd.exe 840 vvddp.exe 4604 lfrxlfl.exe 2812 jpdjj.exe 2884 frxrlrr.exe 2368 djjvp.exe 3676 lxrlrfl.exe 2852 ffrxxfr.exe 2976 lfllrxr.exe 2560 hbtbhn.exe 4400 bhbnnb.exe 4996 lllxrrf.exe 4700 nnnnnt.exe 1372 5thnbt.exe 1520 bnttnt.exe 4880 9ppvp.exe 1404 djdjv.exe 3976 thbbhn.exe 1588 tbhhnh.exe 1636 thhnhn.exe 3688 thnttt.exe 2308 tthhbb.exe 3356 bhhbht.exe 2420 1rrlxll.exe 1892 bhbhtb.exe 4360 jvddv.exe 4392 jpvdp.exe 3936 hhtbht.exe 1612 jvjvd.exe 4112 vdvdv.exe 3940 ppvjp.exe 2808 pdjjp.exe 2244 1xxxxxx.exe 3740 xrrxllf.exe 3680 rxrfrfx.exe 1480 bhtnbt.exe -
resource yara_rule behavioral2/memory/3152-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023527-3.dat upx behavioral2/memory/3152-6-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023528-10.dat upx behavioral2/memory/3008-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3784-11-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023529-14.dat upx behavioral2/memory/3572-20-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002352a-22.dat upx behavioral2/memory/3528-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002352b-28.dat upx behavioral2/memory/4400-32-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-31-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002352c-36.dat upx behavioral2/files/0x000700000002352d-40.dat upx behavioral2/files/0x000700000002352e-45.dat upx behavioral2/memory/3928-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002352f-51.dat upx behavioral2/memory/4564-54-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023530-58.dat upx behavioral2/memory/4896-62-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023531-64.dat upx behavioral2/memory/4668-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4684-59-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023532-70.dat upx behavioral2/files/0x0007000000023533-78.dat upx behavioral2/memory/4216-77-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023534-82.dat upx behavioral2/memory/2428-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023535-88.dat upx behavioral2/files/0x0007000000023536-92.dat upx behavioral2/memory/8-94-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4208-96-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/8-103-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023538-106.dat upx behavioral2/files/0x0009000000023483-112.dat upx behavioral2/memory/2968-108-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023537-100.dat upx behavioral2/memory/4392-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002353a-123.dat upx behavioral2/files/0x0007000000023539-117.dat upx behavioral2/files/0x0008000000023482-127.dat upx behavioral2/files/0x000800000002353b-134.dat upx behavioral2/memory/4912-133-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000800000002353d-138.dat upx behavioral2/files/0x000700000002353e-143.dat upx behavioral2/memory/4852-145-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002353f-150.dat upx behavioral2/memory/1060-152-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023541-156.dat upx behavioral2/files/0x000400000001e75e-160.dat upx behavioral2/files/0x000a0000000233ab-166.dat upx behavioral2/memory/3496-168-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4724-170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000b0000000233c1-173.dat upx behavioral2/memory/840-179-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4604-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0008000000023466-180.dat upx behavioral2/files/0x0008000000023467-186.dat upx behavioral2/memory/2852-200-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3676-199-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2976-205-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2560-211-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4700-221-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frfxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nththh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 3008 3152 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 88 PID 3152 wrote to memory of 3008 3152 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 88 PID 3152 wrote to memory of 3008 3152 c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe 88 PID 3008 wrote to memory of 3784 3008 dpvjp.exe 89 PID 3008 wrote to memory of 3784 3008 dpvjp.exe 89 PID 3008 wrote to memory of 3784 3008 dpvjp.exe 89 PID 3784 wrote to memory of 3572 3784 xxfxrrr.exe 90 PID 3784 wrote to memory of 3572 3784 xxfxrrr.exe 90 PID 3784 wrote to memory of 3572 3784 xxfxrrr.exe 90 PID 3572 wrote to memory of 3528 3572 frfxrrr.exe 91 PID 3572 wrote to memory of 3528 3572 frfxrrr.exe 91 PID 3572 wrote to memory of 3528 3572 frfxrrr.exe 91 PID 3528 wrote to memory of 4400 3528 nbbtbt.exe 92 PID 3528 wrote to memory of 4400 3528 nbbtbt.exe 92 PID 3528 wrote to memory of 4400 3528 nbbtbt.exe 92 PID 4400 wrote to memory of 2424 4400 3thtbh.exe 93 PID 4400 wrote to memory of 2424 4400 3thtbh.exe 93 PID 4400 wrote to memory of 2424 4400 3thtbh.exe 93 PID 2424 wrote to memory of 3928 2424 btbnnh.exe 94 PID 2424 wrote to memory of 3928 2424 btbnnh.exe 94 PID 2424 wrote to memory of 3928 2424 btbnnh.exe 94 PID 3928 wrote to memory of 4564 3928 bhbthh.exe 95 PID 3928 wrote to memory of 4564 3928 bhbthh.exe 95 PID 3928 wrote to memory of 4564 3928 bhbthh.exe 95 PID 4564 wrote to memory of 4896 4564 hnbbnh.exe 96 PID 4564 wrote to memory of 4896 4564 hnbbnh.exe 96 PID 4564 wrote to memory of 4896 4564 hnbbnh.exe 96 PID 4896 wrote to memory of 4684 4896 dvvpp.exe 97 PID 4896 wrote to memory of 4684 4896 dvvpp.exe 97 PID 4896 wrote to memory of 4684 4896 dvvpp.exe 97 PID 4684 wrote to memory of 4668 4684 vdjjp.exe 98 PID 4684 wrote to memory of 4668 4684 vdjjp.exe 98 PID 4684 wrote to memory of 4668 4684 vdjjp.exe 98 PID 4668 wrote to memory of 4216 4668 tntbtn.exe 99 PID 4668 wrote to memory of 4216 4668 tntbtn.exe 99 PID 4668 wrote to memory of 4216 4668 tntbtn.exe 99 PID 4216 wrote to memory of 2428 4216 nnhhhh.exe 100 PID 4216 wrote to memory of 2428 4216 nnhhhh.exe 100 PID 4216 wrote to memory of 2428 4216 nnhhhh.exe 100 PID 2428 wrote to memory of 1096 2428 llxfrrf.exe 101 PID 2428 wrote to memory of 1096 2428 llxfrrf.exe 101 PID 2428 wrote to memory of 1096 2428 llxfrrf.exe 101 PID 1096 wrote to memory of 4208 1096 fxlfrrr.exe 102 PID 1096 wrote to memory of 4208 1096 fxlfrrr.exe 102 PID 1096 wrote to memory of 4208 1096 fxlfrrr.exe 102 PID 4208 wrote to memory of 8 4208 lflllff.exe 103 PID 4208 wrote to memory of 8 4208 lflllff.exe 103 PID 4208 wrote to memory of 8 4208 lflllff.exe 103 PID 8 wrote to memory of 2968 8 lflrxrr.exe 185 PID 8 wrote to memory of 2968 8 lflrxrr.exe 185 PID 8 wrote to memory of 2968 8 lflrxrr.exe 185 PID 2968 wrote to memory of 2032 2968 frfxlxx.exe 105 PID 2968 wrote to memory of 2032 2968 frfxlxx.exe 105 PID 2968 wrote to memory of 2032 2968 frfxlxx.exe 105 PID 2032 wrote to memory of 4392 2032 llxxlxx.exe 188 PID 2032 wrote to memory of 4392 2032 llxxlxx.exe 188 PID 2032 wrote to memory of 4392 2032 llxxlxx.exe 188 PID 4392 wrote to memory of 396 4392 llrxlrr.exe 226 PID 4392 wrote to memory of 396 4392 llrxlrr.exe 226 PID 4392 wrote to memory of 396 4392 llrxlrr.exe 226 PID 396 wrote to memory of 4112 396 ntthhh.exe 147 PID 396 wrote to memory of 4112 396 ntthhh.exe 147 PID 396 wrote to memory of 4112 396 ntthhh.exe 147 PID 4112 wrote to memory of 4912 4112 bnnnbh.exe 191
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe"C:\Users\Admin\AppData\Local\Temp\c6de709f436a31781460b481f89ff98b474b035e83c590f7b7631ac4a8daf313.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dpvjp.exec:\dpvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\frfxrrr.exec:\frfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\nbbtbt.exec:\nbbtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\3thtbh.exec:\3thtbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\btbnnh.exec:\btbnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\bhbthh.exec:\bhbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\hnbbnh.exec:\hnbbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\dvvpp.exec:\dvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\vdjjp.exec:\vdjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\tntbtn.exec:\tntbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\nnhhhh.exec:\nnhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\llxfrrf.exec:\llxfrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\lflllff.exec:\lflllff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\lflrxrr.exec:\lflrxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\frfxlxx.exec:\frfxlxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\llxxlxx.exec:\llxxlxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\llrxlrr.exec:\llrxlrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\ntthhh.exec:\ntthhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\bnnnbh.exec:\bnnnbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\tnbtth.exec:\tnbtth.exe23⤵
- Executes dropped EXE
PID:4912 -
\??\c:\rfxxrxx.exec:\rfxxrxx.exe24⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ppdvd.exec:\ppdvd.exe25⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vdjdj.exec:\vdjdj.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\flrrlrl.exec:\flrrlrl.exe27⤵
- Executes dropped EXE
PID:3992 -
\??\c:\ttbbhn.exec:\ttbbhn.exe28⤵
- Executes dropped EXE
PID:5036 -
\??\c:\tthtnn.exec:\tthtnn.exe29⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vdddd.exec:\vdddd.exe30⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vvddp.exec:\vvddp.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\lfrxlfl.exec:\lfrxlfl.exe32⤵
- Executes dropped EXE
PID:4604 -
\??\c:\jpdjj.exec:\jpdjj.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\frxrlrr.exec:\frxrlrr.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\djjvp.exec:\djjvp.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\lxrlrfl.exec:\lxrlrfl.exe36⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ffrxxfr.exec:\ffrxxfr.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfllrxr.exec:\lfllrxr.exe38⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hbtbhn.exec:\hbtbhn.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bhbnnb.exec:\bhbnnb.exe40⤵
- Executes dropped EXE
PID:4400 -
\??\c:\lllxrrf.exec:\lllxrrf.exe41⤵
- Executes dropped EXE
PID:4996 -
\??\c:\nnnnnt.exec:\nnnnnt.exe42⤵
- Executes dropped EXE
PID:4700 -
\??\c:\5thnbt.exec:\5thnbt.exe43⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bnttnt.exec:\bnttnt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1520 -
\??\c:\9ppvp.exec:\9ppvp.exe45⤵
- Executes dropped EXE
PID:4880 -
\??\c:\djdjv.exec:\djdjv.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1404 -
\??\c:\thbbhn.exec:\thbbhn.exe47⤵
- Executes dropped EXE
PID:3976 -
\??\c:\tbhhnh.exec:\tbhhnh.exe48⤵
- Executes dropped EXE
PID:1588 -
\??\c:\thhnhn.exec:\thhnhn.exe49⤵
- Executes dropped EXE
PID:1636 -
\??\c:\thnttt.exec:\thnttt.exe50⤵
- Executes dropped EXE
PID:3688 -
\??\c:\tthhbb.exec:\tthhbb.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bhhbht.exec:\bhhbht.exe52⤵
- Executes dropped EXE
PID:3356 -
\??\c:\1rrlxll.exec:\1rrlxll.exe53⤵
- Executes dropped EXE
PID:2420 -
\??\c:\bhbhtb.exec:\bhbhtb.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jvddv.exec:\jvddv.exe55⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpvdp.exec:\jpvdp.exe56⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hhtbht.exec:\hhtbht.exe57⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jvjvd.exec:\jvjvd.exe58⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vdvdv.exec:\vdvdv.exe59⤵
- Executes dropped EXE
PID:4112 -
\??\c:\ppvjp.exec:\ppvjp.exe60⤵
- Executes dropped EXE
PID:3940 -
\??\c:\pdjjp.exec:\pdjjp.exe61⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1xxxxxx.exec:\1xxxxxx.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xrrxllf.exec:\xrrxllf.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3740 -
\??\c:\rxrfrfx.exec:\rxrfrfx.exe64⤵
- Executes dropped EXE
PID:3680 -
\??\c:\bhtnbt.exec:\bhtnbt.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\thbhbn.exec:\thbhbn.exe66⤵PID:2980
-
\??\c:\ffffrrl.exec:\ffffrrl.exe67⤵PID:896
-
\??\c:\fxffllr.exec:\fxffllr.exe68⤵PID:4068
-
\??\c:\jppjp.exec:\jppjp.exe69⤵PID:4520
-
\??\c:\pdppv.exec:\pdppv.exe70⤵PID:3144
-
\??\c:\xrrlfff.exec:\xrrlfff.exe71⤵PID:4072
-
\??\c:\vpppj.exec:\vpppj.exe72⤵PID:1012
-
\??\c:\vpjjj.exec:\vpjjj.exe73⤵PID:3708
-
\??\c:\rllrlrx.exec:\rllrlrx.exe74⤵
- System Location Discovery: System Language Discovery
PID:4988 -
\??\c:\vpvvj.exec:\vpvvj.exe75⤵PID:960
-
\??\c:\pvddd.exec:\pvddd.exe76⤵PID:4672
-
\??\c:\lxflrxr.exec:\lxflrxr.exe77⤵PID:4508
-
\??\c:\pdddv.exec:\pdddv.exe78⤵PID:3896
-
\??\c:\ppvdd.exec:\ppvdd.exe79⤵PID:452
-
\??\c:\ntnnbb.exec:\ntnnbb.exe80⤵PID:208
-
\??\c:\9httht.exec:\9httht.exe81⤵PID:2212
-
\??\c:\fxfrllf.exec:\fxfrllf.exe82⤵PID:400
-
\??\c:\lxlrffr.exec:\lxlrffr.exe83⤵PID:4240
-
\??\c:\vdjpd.exec:\vdjpd.exe84⤵PID:1364
-
\??\c:\htbbtb.exec:\htbbtb.exe85⤵PID:1372
-
\??\c:\frxfxlx.exec:\frxfxlx.exe86⤵PID:2068
-
\??\c:\btbhnt.exec:\btbhnt.exe87⤵PID:4880
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe88⤵PID:2468
-
\??\c:\llrrrxf.exec:\llrrrxf.exe89⤵PID:1588
-
\??\c:\flllffl.exec:\flllffl.exe90⤵PID:1636
-
\??\c:\xffrrxl.exec:\xffrrxl.exe91⤵PID:4092
-
\??\c:\llfxrxf.exec:\llfxrxf.exe92⤵PID:4992
-
\??\c:\xfxfrrf.exec:\xfxfrrf.exe93⤵PID:3172
-
\??\c:\9bhnth.exec:\9bhnth.exe94⤵PID:2968
-
\??\c:\3rxrrlf.exec:\3rxrrlf.exe95⤵PID:1124
-
\??\c:\nntntb.exec:\nntntb.exe96⤵PID:4360
-
\??\c:\lrlxfrx.exec:\lrlxfrx.exe97⤵PID:4392
-
\??\c:\9rrxrxx.exec:\9rrxrxx.exe98⤵PID:1088
-
\??\c:\jvjdd.exec:\jvjdd.exe99⤵PID:1612
-
\??\c:\vdvjv.exec:\vdvjv.exe100⤵PID:4912
-
\??\c:\fxxrlff.exec:\fxxrlff.exe101⤵PID:2808
-
\??\c:\5lrxxll.exec:\5lrxxll.exe102⤵PID:4104
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe103⤵PID:4776
-
\??\c:\3vdpd.exec:\3vdpd.exe104⤵PID:1480
-
\??\c:\7lrrrfr.exec:\7lrrrfr.exe105⤵PID:1996
-
\??\c:\ppvpv.exec:\ppvpv.exe106⤵PID:896
-
\??\c:\xfffrrr.exec:\xfffrrr.exe107⤵PID:2016
-
\??\c:\frxlffx.exec:\frxlffx.exe108⤵PID:3672
-
\??\c:\llrlrxx.exec:\llrlrxx.exe109⤵PID:4156
-
\??\c:\rrrllff.exec:\rrrllff.exe110⤵PID:1084
-
\??\c:\dvvjp.exec:\dvvjp.exe111⤵PID:3872
-
\??\c:\dpddj.exec:\dpddj.exe112⤵PID:3708
-
\??\c:\vjjjv.exec:\vjjjv.exe113⤵PID:2920
-
\??\c:\ttbbht.exec:\ttbbht.exe114⤵PID:4720
-
\??\c:\ntbbbh.exec:\ntbbbh.exe115⤵PID:4508
-
\??\c:\rxrllxl.exec:\rxrllxl.exe116⤵PID:3676
-
\??\c:\hhnhth.exec:\hhnhth.exe117⤵PID:3412
-
\??\c:\9fxflfl.exec:\9fxflfl.exe118⤵PID:2212
-
\??\c:\nttbht.exec:\nttbht.exe119⤵PID:4600
-
\??\c:\hbnthn.exec:\hbnthn.exe120⤵PID:4436
-
\??\c:\1rxrlfl.exec:\1rxrlfl.exe121⤵PID:4148
-
\??\c:\xlrrfxr.exec:\xlrrfxr.exe122⤵PID:1580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-