Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2024, 21:32
Behavioral task
behavioral1
Sample
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe
Resource
win7-20240708-en
General
-
Target
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe
-
Size
91KB
-
MD5
9f2a96104054e09ae5d146a6e1a01b0a
-
SHA1
08c80607c4cfedbf39e76c47fb62d313d414787c
-
SHA256
265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837
-
SHA512
f6eaf29b9f4f68c16251800493c27a84a2602fea6b8eedceb620ac4768ce0bb18aa17adf16992006c7a950a4c9f84a118466e28e4f77fd570837121d51b1d1d9
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w801ouAsG9ZoPEudJGdXRKX5etrv:xhOmTsF93UYfwC6GIout03Fv9KdJoQ4z
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4948-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1732-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/772-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-838-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-957-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4948 fxrllfx.exe 5116 tnbnht.exe 4220 7dpdv.exe 3100 dvpjd.exe 2092 xxffrrf.exe 3740 tbbnht.exe 3108 pppdp.exe 2488 pjdvj.exe 988 xlxlxrl.exe 1440 hnnnht.exe 4352 djdpj.exe 1852 xflxllf.exe 436 xfffrll.exe 4048 bhnntt.exe 1824 7nnnbb.exe 4736 dpvpp.exe 4432 frrfrlf.exe 1056 lxlllfl.exe 4468 bttnhh.exe 768 jpvpp.exe 1676 xrrlxll.exe 2992 thhtnn.exe 3232 jdvpd.exe 3924 vddvp.exe 2664 lfrlxxr.exe 1932 btnhbt.exe 876 vdjdv.exe 2484 rfrxffx.exe 1772 lxrxlfr.exe 3316 tbhbhb.exe 2080 dpdjd.exe 4292 xrrxfrr.exe 5036 lxlfrrr.exe 1732 tnhhbb.exe 3828 djdjp.exe 4460 vppjd.exe 2328 flrrlff.exe 5068 rrrlxxl.exe 5020 tnhbtn.exe 2124 dpvjp.exe 2848 vvjvj.exe 1660 7ppdj.exe 4964 fllxlfr.exe 3100 rflllff.exe 2248 tbnnhb.exe 4876 djjdv.exe 5112 5jpdp.exe 892 fxrlffx.exe 212 lxxrlll.exe 216 hhhhtn.exe 4884 nhttnh.exe 4784 jpjdd.exe 4212 rffxxff.exe 956 jpvjp.exe 1500 vjvdj.exe 3948 5ffxlfr.exe 624 tntnhh.exe 1428 vvvjd.exe 540 pvjpj.exe 1824 9xxrrxr.exe 4848 nnbhhn.exe 4912 3ddvd.exe 3192 pppjd.exe 2612 lxxlxrr.exe -
resource yara_rule behavioral2/memory/4800-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c3-4.dat upx behavioral2/memory/4948-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4800-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c4-10.dat upx behavioral2/files/0x00070000000234c5-15.dat upx behavioral2/memory/5116-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4220-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c6-21.dat upx behavioral2/files/0x00070000000234c7-26.dat upx behavioral2/memory/3100-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c8-32.dat upx behavioral2/memory/2092-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3740-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c9-39.dat upx behavioral2/memory/3108-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ca-45.dat upx behavioral2/files/0x00070000000234cb-50.dat upx behavioral2/memory/2488-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cc-56.dat upx behavioral2/memory/1440-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cd-64.dat upx behavioral2/files/0x00070000000234ce-67.dat upx behavioral2/memory/4352-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1852-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cf-74.dat upx behavioral2/memory/436-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d0-81.dat upx behavioral2/memory/436-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d1-88.dat upx behavioral2/files/0x00070000000234d2-93.dat upx behavioral2/memory/1824-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d3-100.dat upx behavioral2/memory/4432-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d4-107.dat upx behavioral2/memory/1056-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1056-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d5-115.dat upx behavioral2/files/0x00070000000234d6-119.dat upx behavioral2/files/0x00070000000234d7-123.dat upx behavioral2/memory/768-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1676-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d8-130.dat upx behavioral2/memory/2992-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234d9-137.dat upx behavioral2/files/0x00070000000234da-141.dat upx behavioral2/files/0x00080000000234db-146.dat upx behavioral2/memory/2664-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234dd-152.dat upx behavioral2/files/0x00070000000234de-158.dat upx behavioral2/memory/876-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234bf-164.dat upx behavioral2/files/0x00070000000234df-168.dat upx behavioral2/memory/2484-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1772-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-176.dat upx behavioral2/memory/3316-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e1-181.dat upx behavioral2/files/0x00070000000234e2-186.dat upx behavioral2/memory/5036-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4292-192-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlfxrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4948 4800 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 84 PID 4800 wrote to memory of 4948 4800 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 84 PID 4800 wrote to memory of 4948 4800 265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe 84 PID 4948 wrote to memory of 5116 4948 fxrllfx.exe 85 PID 4948 wrote to memory of 5116 4948 fxrllfx.exe 85 PID 4948 wrote to memory of 5116 4948 fxrllfx.exe 85 PID 5116 wrote to memory of 4220 5116 tnbnht.exe 86 PID 5116 wrote to memory of 4220 5116 tnbnht.exe 86 PID 5116 wrote to memory of 4220 5116 tnbnht.exe 86 PID 4220 wrote to memory of 3100 4220 7dpdv.exe 87 PID 4220 wrote to memory of 3100 4220 7dpdv.exe 87 PID 4220 wrote to memory of 3100 4220 7dpdv.exe 87 PID 3100 wrote to memory of 2092 3100 dvpjd.exe 88 PID 3100 wrote to memory of 2092 3100 dvpjd.exe 88 PID 3100 wrote to memory of 2092 3100 dvpjd.exe 88 PID 2092 wrote to memory of 3740 2092 xxffrrf.exe 89 PID 2092 wrote to memory of 3740 2092 xxffrrf.exe 89 PID 2092 wrote to memory of 3740 2092 xxffrrf.exe 89 PID 3740 wrote to memory of 3108 3740 tbbnht.exe 91 PID 3740 wrote to memory of 3108 3740 tbbnht.exe 91 PID 3740 wrote to memory of 3108 3740 tbbnht.exe 91 PID 3108 wrote to memory of 2488 3108 pppdp.exe 92 PID 3108 wrote to memory of 2488 3108 pppdp.exe 92 PID 3108 wrote to memory of 2488 3108 pppdp.exe 92 PID 2488 wrote to memory of 988 2488 pjdvj.exe 93 PID 2488 wrote to memory of 988 2488 pjdvj.exe 93 PID 2488 wrote to memory of 988 2488 pjdvj.exe 93 PID 988 wrote to memory of 1440 988 xlxlxrl.exe 94 PID 988 wrote to memory of 1440 988 xlxlxrl.exe 94 PID 988 wrote to memory of 1440 988 xlxlxrl.exe 94 PID 1440 wrote to memory of 4352 1440 hnnnht.exe 95 PID 1440 wrote to memory of 4352 1440 hnnnht.exe 95 PID 1440 wrote to memory of 4352 1440 hnnnht.exe 95 PID 4352 wrote to memory of 1852 4352 djdpj.exe 96 PID 4352 wrote to memory of 1852 4352 djdpj.exe 96 PID 4352 wrote to memory of 1852 4352 djdpj.exe 96 PID 1852 wrote to memory of 436 1852 xflxllf.exe 97 PID 1852 wrote to memory of 436 1852 xflxllf.exe 97 PID 1852 wrote to memory of 436 1852 xflxllf.exe 97 PID 436 wrote to memory of 4048 436 xfffrll.exe 98 PID 436 wrote to memory of 4048 436 xfffrll.exe 98 PID 436 wrote to memory of 4048 436 xfffrll.exe 98 PID 4048 wrote to memory of 1824 4048 bhnntt.exe 99 PID 4048 wrote to memory of 1824 4048 bhnntt.exe 99 PID 4048 wrote to memory of 1824 4048 bhnntt.exe 99 PID 1824 wrote to memory of 4736 1824 7nnnbb.exe 101 PID 1824 wrote to memory of 4736 1824 7nnnbb.exe 101 PID 1824 wrote to memory of 4736 1824 7nnnbb.exe 101 PID 4736 wrote to memory of 4432 4736 dpvpp.exe 102 PID 4736 wrote to memory of 4432 4736 dpvpp.exe 102 PID 4736 wrote to memory of 4432 4736 dpvpp.exe 102 PID 4432 wrote to memory of 1056 4432 frrfrlf.exe 103 PID 4432 wrote to memory of 1056 4432 frrfrlf.exe 103 PID 4432 wrote to memory of 1056 4432 frrfrlf.exe 103 PID 1056 wrote to memory of 4468 1056 lxlllfl.exe 104 PID 1056 wrote to memory of 4468 1056 lxlllfl.exe 104 PID 1056 wrote to memory of 4468 1056 lxlllfl.exe 104 PID 4468 wrote to memory of 768 4468 bttnhh.exe 105 PID 4468 wrote to memory of 768 4468 bttnhh.exe 105 PID 4468 wrote to memory of 768 4468 bttnhh.exe 105 PID 768 wrote to memory of 1676 768 jpvpp.exe 106 PID 768 wrote to memory of 1676 768 jpvpp.exe 106 PID 768 wrote to memory of 1676 768 jpvpp.exe 106 PID 1676 wrote to memory of 2992 1676 xrrlxll.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe"C:\Users\Admin\AppData\Local\Temp\265c56adf4b7ca4194ae622d454b0aa86453d3183794b7be86d85b81f3964837.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\fxrllfx.exec:\fxrllfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\tnbnht.exec:\tnbnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\7dpdv.exec:\7dpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\dvpjd.exec:\dvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\xxffrrf.exec:\xxffrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\tbbnht.exec:\tbbnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\pppdp.exec:\pppdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\pjdvj.exec:\pjdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\hnnnht.exec:\hnnnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\djdpj.exec:\djdpj.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\xflxllf.exec:\xflxllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\xfffrll.exec:\xfffrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\bhnntt.exec:\bhnntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\7nnnbb.exec:\7nnnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\dpvpp.exec:\dpvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\frrfrlf.exec:\frrfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\lxlllfl.exec:\lxlllfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\bttnhh.exec:\bttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\jpvpp.exec:\jpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\xrrlxll.exec:\xrrlxll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\thhtnn.exec:\thhtnn.exe23⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jdvpd.exec:\jdvpd.exe24⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vddvp.exec:\vddvp.exe25⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe26⤵
- Executes dropped EXE
PID:2664 -
\??\c:\btnhbt.exec:\btnhbt.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdjdv.exec:\vdjdv.exe28⤵
- Executes dropped EXE
PID:876 -
\??\c:\rfrxffx.exec:\rfrxffx.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lxrxlfr.exec:\lxrxlfr.exe30⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tbhbhb.exec:\tbhbhb.exe31⤵
- Executes dropped EXE
PID:3316 -
\??\c:\dpdjd.exec:\dpdjd.exe32⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrrxfrr.exec:\xrrxfrr.exe33⤵
- Executes dropped EXE
PID:4292 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe34⤵
- Executes dropped EXE
PID:5036 -
\??\c:\tnhhbb.exec:\tnhhbb.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\djdjp.exec:\djdjp.exe36⤵
- Executes dropped EXE
PID:3828 -
\??\c:\vppjd.exec:\vppjd.exe37⤵
- Executes dropped EXE
PID:4460 -
\??\c:\flrrlff.exec:\flrrlff.exe38⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe39⤵
- Executes dropped EXE
PID:5068 -
\??\c:\tnhbtn.exec:\tnhbtn.exe40⤵
- Executes dropped EXE
PID:5020 -
\??\c:\dpvjp.exec:\dpvjp.exe41⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vvjvj.exec:\vvjvj.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7ppdj.exec:\7ppdj.exe43⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fllxlfr.exec:\fllxlfr.exe44⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rflllff.exec:\rflllff.exe45⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tbnnhb.exec:\tbnnhb.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\djjdv.exec:\djjdv.exe47⤵
- Executes dropped EXE
PID:4876 -
\??\c:\5jpdp.exec:\5jpdp.exe48⤵
- Executes dropped EXE
PID:5112 -
\??\c:\fxrlffx.exec:\fxrlffx.exe49⤵
- Executes dropped EXE
PID:892 -
\??\c:\lxxrlll.exec:\lxxrlll.exe50⤵
- Executes dropped EXE
PID:212 -
\??\c:\hhhhtn.exec:\hhhhtn.exe51⤵
- Executes dropped EXE
PID:216 -
\??\c:\nhttnh.exec:\nhttnh.exe52⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jpjdd.exec:\jpjdd.exe53⤵
- Executes dropped EXE
PID:4784 -
\??\c:\rffxxff.exec:\rffxxff.exe54⤵
- Executes dropped EXE
PID:4212 -
\??\c:\jpvjp.exec:\jpvjp.exe55⤵
- Executes dropped EXE
PID:956 -
\??\c:\vjvdj.exec:\vjvdj.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\5ffxlfr.exec:\5ffxlfr.exe57⤵
- Executes dropped EXE
PID:3948 -
\??\c:\tntnhh.exec:\tntnhh.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\vvvjd.exec:\vvvjd.exe59⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pvjpj.exec:\pvjpj.exe60⤵
- Executes dropped EXE
PID:540 -
\??\c:\9xxrrxr.exec:\9xxrrxr.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\nnbhhn.exec:\nnbhhn.exe62⤵
- Executes dropped EXE
PID:4848 -
\??\c:\3ddvd.exec:\3ddvd.exe63⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pppjd.exec:\pppjd.exe64⤵
- Executes dropped EXE
PID:3192 -
\??\c:\lxxlxrr.exec:\lxxlxrr.exe65⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhhbth.exec:\nhhbth.exe66⤵PID:2160
-
\??\c:\bttnhh.exec:\bttnhh.exe67⤵PID:4468
-
\??\c:\7pjdj.exec:\7pjdj.exe68⤵
- System Location Discovery: System Language Discovery
PID:2552 -
\??\c:\pddjd.exec:\pddjd.exe69⤵PID:3156
-
\??\c:\lffxlfx.exec:\lffxlfx.exe70⤵PID:772
-
\??\c:\llxlxxl.exec:\llxlxxl.exe71⤵PID:4700
-
\??\c:\nbhtnh.exec:\nbhtnh.exe72⤵PID:2008
-
\??\c:\vjvpj.exec:\vjvpj.exe73⤵PID:4052
-
\??\c:\dppjd.exec:\dppjd.exe74⤵PID:2536
-
\??\c:\ffxfflx.exec:\ffxfflx.exe75⤵PID:2664
-
\??\c:\tnttnn.exec:\tnttnn.exe76⤵PID:1816
-
\??\c:\5tthbb.exec:\5tthbb.exe77⤵PID:1492
-
\??\c:\jppjd.exec:\jppjd.exe78⤵PID:4744
-
\??\c:\dppjd.exec:\dppjd.exe79⤵PID:4772
-
\??\c:\lllfrll.exec:\lllfrll.exe80⤵PID:4988
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe81⤵PID:3084
-
\??\c:\tbbtnn.exec:\tbbtnn.exe82⤵PID:1644
-
\??\c:\htthtn.exec:\htthtn.exe83⤵PID:4144
-
\??\c:\9dvdv.exec:\9dvdv.exe84⤵PID:1200
-
\??\c:\5jjvp.exec:\5jjvp.exe85⤵PID:4928
-
\??\c:\5xrfrlx.exec:\5xrfrlx.exe86⤵PID:2556
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe87⤵PID:1560
-
\??\c:\bbhbhh.exec:\bbhbhh.exe88⤵PID:4764
-
\??\c:\jjpvv.exec:\jjpvv.exe89⤵PID:1612
-
\??\c:\pdvdj.exec:\pdvdj.exe90⤵PID:4800
-
\??\c:\3xlfrlf.exec:\3xlfrlf.exe91⤵PID:4788
-
\??\c:\hnnhbt.exec:\hnnhbt.exe92⤵PID:1352
-
\??\c:\bnbnhb.exec:\bnbnhb.exe93⤵PID:1048
-
\??\c:\pjvpv.exec:\pjvpv.exe94⤵PID:1660
-
\??\c:\ppjdd.exec:\ppjdd.exe95⤵PID:4716
-
\??\c:\rllxrlf.exec:\rllxrlf.exe96⤵PID:1052
-
\??\c:\hbhhbb.exec:\hbhhbb.exe97⤵PID:3152
-
\??\c:\jdvpj.exec:\jdvpj.exe98⤵PID:4952
-
\??\c:\pjvpd.exec:\pjvpd.exe99⤵PID:2604
-
\??\c:\lflxxrf.exec:\lflxxrf.exe100⤵PID:2792
-
\??\c:\vvpdp.exec:\vvpdp.exe101⤵PID:2128
-
\??\c:\frrfrlf.exec:\frrfrlf.exe102⤵PID:4924
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe103⤵PID:3580
-
\??\c:\tntbbb.exec:\tntbbb.exe104⤵PID:3872
-
\??\c:\htbbnh.exec:\htbbnh.exe105⤵PID:3876
-
\??\c:\pdjdj.exec:\pdjdj.exe106⤵PID:3052
-
\??\c:\lxrffxl.exec:\lxrffxl.exe107⤵PID:228
-
\??\c:\3lxlxfx.exec:\3lxlxfx.exe108⤵PID:3104
-
\??\c:\tntnhb.exec:\tntnhb.exe109⤵PID:4836
-
\??\c:\jvvpd.exec:\jvvpd.exe110⤵PID:548
-
\??\c:\pppjp.exec:\pppjp.exe111⤵PID:2204
-
\??\c:\rffrfxl.exec:\rffrfxl.exe112⤵PID:1792
-
\??\c:\rflffxf.exec:\rflffxf.exe113⤵PID:3000
-
\??\c:\nbhbbb.exec:\nbhbbb.exe114⤵PID:396
-
\??\c:\bhnhbn.exec:\bhnhbn.exe115⤵PID:3020
-
\??\c:\dppdp.exec:\dppdp.exe116⤵PID:4980
-
\??\c:\ffxlxrr.exec:\ffxlxrr.exe117⤵PID:3192
-
\??\c:\ffrlffx.exec:\ffrlffx.exe118⤵PID:2612
-
\??\c:\bbnttn.exec:\bbnttn.exe119⤵PID:2160
-
\??\c:\jdvpj.exec:\jdvpj.exe120⤵PID:1760
-
\??\c:\ppjvp.exec:\ppjvp.exe121⤵PID:1916
-
\??\c:\xlxfrlr.exec:\xlxfrlr.exe122⤵PID:3284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-