Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/08/2024, 14:27
Behavioral task
behavioral1
Sample
e0b20bad05735c8aecf6143cad631210N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
e0b20bad05735c8aecf6143cad631210N.exe
-
Size
189KB
-
MD5
e0b20bad05735c8aecf6143cad631210
-
SHA1
152430614d0fd9a7c09284b94645f2d3d3320c37
-
SHA256
ee3e49f5e31d3d823aebed06868596b79e5472014b7b5cce976a0533785842bd
-
SHA512
8df3d246aa53537e8eb07986e94e966c69717d9a70e702404e9154aa8007a59cc6c1062f1a0600d7518c26f2e63f423046c4e8b5936717621288dd6bd831bd0b
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t6NDWOH148BqCFPekj:kcm4FmowdHoSphraHcpOFltH4ttj8Bl
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4324-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-479-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-879-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-898-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4324 1vdpj.exe 3288 7jjjd.exe 1788 xxlfllx.exe 2940 nhbtnn.exe 4608 jvppv.exe 4316 rlflxlx.exe 1152 hbtnbb.exe 1560 ppdvp.exe 4832 fxrlllf.exe 4172 lfxrrlf.exe 4084 nntnhh.exe 4612 1pdvv.exe 212 xflfffx.exe 4504 thtbnh.exe 1700 pvvdd.exe 512 pvdvv.exe 2064 5frfllr.exe 404 1tthbb.exe 5032 jddvp.exe 4340 vddvp.exe 2252 fllfrrl.exe 828 rfrlfxx.exe 2660 hbhhhn.exe 860 jddvj.exe 2900 rllfffx.exe 3052 1fxrlfx.exe 2360 1tbbhh.exe 4036 pjdvp.exe 2228 rlfxxxr.exe 208 lllfrrl.exe 2908 nhbttt.exe 2560 jdddp.exe 1872 lfffxxr.exe 4396 lrrrllf.exe 2692 3ttnhh.exe 2332 tntnnh.exe 1892 jvjdp.exe 1716 lrrlfxf.exe 4804 xrrfxxr.exe 760 bnttnn.exe 4608 dvpjv.exe 1488 dpvjd.exe 4596 rfrllfl.exe 4452 7lfxffx.exe 2952 1bhhnh.exe 1420 hbbhbb.exe 1300 pdvpd.exe 2300 3ddvp.exe 3880 jvpjv.exe 4612 rflflrl.exe 2208 lrxrllf.exe 3020 nbntbt.exe 3824 fxfxxff.exe 4060 bbtnnn.exe 2824 hnhtbt.exe 1224 rfrlffx.exe 1188 hhtbtt.exe 404 vjpvv.exe 1320 vdvpp.exe 2368 xrxffff.exe 4464 frllffx.exe 3016 hbnhnh.exe 440 ntbnhh.exe 3000 pjvpd.exe -
resource yara_rule behavioral2/memory/4964-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233fc-3.dat upx behavioral2/files/0x0008000000023459-11.dat upx behavioral2/memory/4324-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4964-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345d-13.dat upx behavioral2/memory/1788-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1788-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345f-21.dat upx behavioral2/memory/2940-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023460-26.dat upx behavioral2/memory/4608-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023461-32.dat upx behavioral2/memory/4608-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023462-37.dat upx behavioral2/memory/4316-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023463-45.dat upx behavioral2/files/0x0007000000023464-48.dat upx behavioral2/memory/1560-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4832-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-55.dat upx behavioral2/files/0x0007000000023466-60.dat upx behavioral2/memory/4172-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023467-66.dat upx behavioral2/memory/4084-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023468-73.dat upx behavioral2/memory/212-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023469-79.dat upx behavioral2/memory/212-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346a-86.dat upx behavioral2/memory/512-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346c-97.dat upx behavioral2/memory/2064-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346b-93.dat upx behavioral2/files/0x000700000002346d-105.dat upx behavioral2/files/0x000700000002346e-108.dat upx behavioral2/memory/5032-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346f-114.dat upx behavioral2/memory/4340-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023470-119.dat upx behavioral2/memory/2252-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023471-126.dat upx behavioral2/memory/828-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023472-132.dat upx behavioral2/memory/2660-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023474-143.dat upx behavioral2/memory/860-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2900-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023473-138.dat upx behavioral2/files/0x0007000000023475-150.dat upx behavioral2/files/0x0007000000023476-154.dat upx behavioral2/memory/2360-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023477-160.dat upx behavioral2/files/0x000800000002345a-166.dat upx behavioral2/files/0x0007000000023478-170.dat upx behavioral2/memory/2228-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/208-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023479-178.dat upx behavioral2/files/0x000700000002347a-182.dat upx behavioral2/memory/1872-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4396-193-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4324 4964 e0b20bad05735c8aecf6143cad631210N.exe 84 PID 4964 wrote to memory of 4324 4964 e0b20bad05735c8aecf6143cad631210N.exe 84 PID 4964 wrote to memory of 4324 4964 e0b20bad05735c8aecf6143cad631210N.exe 84 PID 4324 wrote to memory of 3288 4324 1vdpj.exe 85 PID 4324 wrote to memory of 3288 4324 1vdpj.exe 85 PID 4324 wrote to memory of 3288 4324 1vdpj.exe 85 PID 3288 wrote to memory of 1788 3288 7jjjd.exe 86 PID 3288 wrote to memory of 1788 3288 7jjjd.exe 86 PID 3288 wrote to memory of 1788 3288 7jjjd.exe 86 PID 1788 wrote to memory of 2940 1788 xxlfllx.exe 87 PID 1788 wrote to memory of 2940 1788 xxlfllx.exe 87 PID 1788 wrote to memory of 2940 1788 xxlfllx.exe 87 PID 2940 wrote to memory of 4608 2940 nhbtnn.exe 88 PID 2940 wrote to memory of 4608 2940 nhbtnn.exe 88 PID 2940 wrote to memory of 4608 2940 nhbtnn.exe 88 PID 4608 wrote to memory of 4316 4608 jvppv.exe 89 PID 4608 wrote to memory of 4316 4608 jvppv.exe 89 PID 4608 wrote to memory of 4316 4608 jvppv.exe 89 PID 4316 wrote to memory of 1152 4316 rlflxlx.exe 90 PID 4316 wrote to memory of 1152 4316 rlflxlx.exe 90 PID 4316 wrote to memory of 1152 4316 rlflxlx.exe 90 PID 1152 wrote to memory of 1560 1152 hbtnbb.exe 91 PID 1152 wrote to memory of 1560 1152 hbtnbb.exe 91 PID 1152 wrote to memory of 1560 1152 hbtnbb.exe 91 PID 1560 wrote to memory of 4832 1560 ppdvp.exe 92 PID 1560 wrote to memory of 4832 1560 ppdvp.exe 92 PID 1560 wrote to memory of 4832 1560 ppdvp.exe 92 PID 4832 wrote to memory of 4172 4832 fxrlllf.exe 94 PID 4832 wrote to memory of 4172 4832 fxrlllf.exe 94 PID 4832 wrote to memory of 4172 4832 fxrlllf.exe 94 PID 4172 wrote to memory of 4084 4172 lfxrrlf.exe 95 PID 4172 wrote to memory of 4084 4172 lfxrrlf.exe 95 PID 4172 wrote to memory of 4084 4172 lfxrrlf.exe 95 PID 4084 wrote to memory of 4612 4084 nntnhh.exe 96 PID 4084 wrote to memory of 4612 4084 nntnhh.exe 96 PID 4084 wrote to memory of 4612 4084 nntnhh.exe 96 PID 4612 wrote to memory of 212 4612 1pdvv.exe 97 PID 4612 wrote to memory of 212 4612 1pdvv.exe 97 PID 4612 wrote to memory of 212 4612 1pdvv.exe 97 PID 212 wrote to memory of 4504 212 xflfffx.exe 99 PID 212 wrote to memory of 4504 212 xflfffx.exe 99 PID 212 wrote to memory of 4504 212 xflfffx.exe 99 PID 4504 wrote to memory of 1700 4504 thtbnh.exe 100 PID 4504 wrote to memory of 1700 4504 thtbnh.exe 100 PID 4504 wrote to memory of 1700 4504 thtbnh.exe 100 PID 1700 wrote to memory of 512 1700 pvvdd.exe 101 PID 1700 wrote to memory of 512 1700 pvvdd.exe 101 PID 1700 wrote to memory of 512 1700 pvvdd.exe 101 PID 512 wrote to memory of 2064 512 pvdvv.exe 102 PID 512 wrote to memory of 2064 512 pvdvv.exe 102 PID 512 wrote to memory of 2064 512 pvdvv.exe 102 PID 2064 wrote to memory of 404 2064 5frfllr.exe 103 PID 2064 wrote to memory of 404 2064 5frfllr.exe 103 PID 2064 wrote to memory of 404 2064 5frfllr.exe 103 PID 404 wrote to memory of 5032 404 1tthbb.exe 104 PID 404 wrote to memory of 5032 404 1tthbb.exe 104 PID 404 wrote to memory of 5032 404 1tthbb.exe 104 PID 5032 wrote to memory of 4340 5032 jddvp.exe 105 PID 5032 wrote to memory of 4340 5032 jddvp.exe 105 PID 5032 wrote to memory of 4340 5032 jddvp.exe 105 PID 4340 wrote to memory of 2252 4340 vddvp.exe 106 PID 4340 wrote to memory of 2252 4340 vddvp.exe 106 PID 4340 wrote to memory of 2252 4340 vddvp.exe 106 PID 2252 wrote to memory of 828 2252 fllfrrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b20bad05735c8aecf6143cad631210N.exe"C:\Users\Admin\AppData\Local\Temp\e0b20bad05735c8aecf6143cad631210N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1vdpj.exec:\1vdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\7jjjd.exec:\7jjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\xxlfllx.exec:\xxlfllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\nhbtnn.exec:\nhbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jvppv.exec:\jvppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rlflxlx.exec:\rlflxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\hbtnbb.exec:\hbtnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\ppdvp.exec:\ppdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\fxrlllf.exec:\fxrlllf.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\nntnhh.exec:\nntnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\1pdvv.exec:\1pdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\xflfffx.exec:\xflfffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\thtbnh.exec:\thtbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\pvvdd.exec:\pvvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pvdvv.exec:\pvdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\5frfllr.exec:\5frfllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\1tthbb.exec:\1tthbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jddvp.exec:\jddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vddvp.exec:\vddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\fllfrrl.exec:\fllfrrl.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\hbhhhn.exec:\hbhhhn.exe24⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jddvj.exec:\jddvj.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\rllfffx.exec:\rllfffx.exe26⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1fxrlfx.exec:\1fxrlfx.exe27⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1tbbhh.exec:\1tbbhh.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjdvp.exec:\pjdvp.exe29⤵
- Executes dropped EXE
PID:4036 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lllfrrl.exec:\lllfrrl.exe31⤵
- Executes dropped EXE
PID:208 -
\??\c:\nhbttt.exec:\nhbttt.exe32⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdddp.exec:\jdddp.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lfffxxr.exec:\lfffxxr.exe34⤵
- Executes dropped EXE
PID:1872 -
\??\c:\lrrrllf.exec:\lrrrllf.exe35⤵
- Executes dropped EXE
PID:4396 -
\??\c:\3ttnhh.exec:\3ttnhh.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\tntnnh.exec:\tntnnh.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jvjdp.exec:\jvjdp.exe38⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lrrlfxf.exec:\lrrlfxf.exe39⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe40⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bnttnn.exec:\bnttnn.exe41⤵
- Executes dropped EXE
PID:760 -
\??\c:\dvpjv.exec:\dvpjv.exe42⤵
- Executes dropped EXE
PID:4608 -
\??\c:\dpvjd.exec:\dpvjd.exe43⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rfrllfl.exec:\rfrllfl.exe44⤵
- Executes dropped EXE
PID:4596 -
\??\c:\7lfxffx.exec:\7lfxffx.exe45⤵
- Executes dropped EXE
PID:4452 -
\??\c:\1bhhnh.exec:\1bhhnh.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbbhbb.exec:\hbbhbb.exe47⤵
- Executes dropped EXE
PID:1420 -
\??\c:\pdvpd.exec:\pdvpd.exe48⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3ddvp.exec:\3ddvp.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jvpjv.exec:\jvpjv.exe50⤵
- Executes dropped EXE
PID:3880 -
\??\c:\rflflrl.exec:\rflflrl.exe51⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lrxrllf.exec:\lrxrllf.exe52⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nbntbt.exec:\nbntbt.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxfxxff.exec:\fxfxxff.exe54⤵
- Executes dropped EXE
PID:3824 -
\??\c:\bbtnnn.exec:\bbtnnn.exe55⤵
- Executes dropped EXE
PID:4060 -
\??\c:\hnhtbt.exec:\hnhtbt.exe56⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rfrlffx.exec:\rfrlffx.exe57⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hhtbtt.exec:\hhtbtt.exe58⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vjpvv.exec:\vjpvv.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\vdvpp.exec:\vdvpp.exe60⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xrxffff.exec:\xrxffff.exe61⤵
- Executes dropped EXE
PID:2368 -
\??\c:\frllffx.exec:\frllffx.exe62⤵
- Executes dropped EXE
PID:4464 -
\??\c:\hbnhnh.exec:\hbnhnh.exe63⤵
- Executes dropped EXE
PID:3016 -
\??\c:\ntbnhh.exec:\ntbnhh.exe64⤵
- Executes dropped EXE
PID:440 -
\??\c:\pjvpd.exec:\pjvpd.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9lffxff.exec:\9lffxff.exe66⤵PID:4784
-
\??\c:\3lxxllr.exec:\3lxxllr.exe67⤵
- System Location Discovery: System Language Discovery
PID:4592 -
\??\c:\btnhbb.exec:\btnhbb.exe68⤵PID:3188
-
\??\c:\bbtnhh.exec:\bbtnhh.exe69⤵PID:1160
-
\??\c:\vpjvp.exec:\vpjvp.exe70⤵PID:4896
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe71⤵PID:716
-
\??\c:\rxfffll.exec:\rxfffll.exe72⤵PID:804
-
\??\c:\djvjj.exec:\djvjj.exe73⤵PID:1520
-
\??\c:\xflfxxr.exec:\xflfxxr.exe74⤵PID:4516
-
\??\c:\7rrrlfx.exec:\7rrrlfx.exe75⤵PID:1800
-
\??\c:\5bhbbb.exec:\5bhbbb.exe76⤵PID:436
-
\??\c:\bbttnn.exec:\bbttnn.exe77⤵PID:3436
-
\??\c:\9ppdv.exec:\9ppdv.exe78⤵PID:2760
-
\??\c:\pvdvp.exec:\pvdvp.exe79⤵
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\lrrlrll.exec:\lrrlrll.exe80⤵PID:64
-
\??\c:\3lrlffx.exec:\3lrlffx.exe81⤵PID:4324
-
\??\c:\htbtnn.exec:\htbtnn.exe82⤵PID:1388
-
\??\c:\nhbthh.exec:\nhbthh.exe83⤵PID:2880
-
\??\c:\dvvdv.exec:\dvvdv.exe84⤵PID:924
-
\??\c:\ddddv.exec:\ddddv.exe85⤵PID:4772
-
\??\c:\3xxrrll.exec:\3xxrrll.exe86⤵PID:224
-
\??\c:\nhnbbb.exec:\nhnbbb.exe87⤵PID:1496
-
\??\c:\7ttnhb.exec:\7ttnhb.exe88⤵PID:4608
-
\??\c:\jdddp.exec:\jdddp.exe89⤵PID:1488
-
\??\c:\vjdjp.exec:\vjdjp.exe90⤵PID:1176
-
\??\c:\lrrrlfl.exec:\lrrrlfl.exe91⤵PID:768
-
\??\c:\hhhhhn.exec:\hhhhhn.exe92⤵PID:2952
-
\??\c:\btbtnt.exec:\btbtnt.exe93⤵PID:3736
-
\??\c:\jvdjd.exec:\jvdjd.exe94⤵PID:2372
-
\??\c:\7xxrffl.exec:\7xxrffl.exe95⤵PID:4084
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe96⤵PID:2860
-
\??\c:\tbhhth.exec:\tbhhth.exe97⤵PID:944
-
\??\c:\hbbtnn.exec:\hbbtnn.exe98⤵PID:3020
-
\??\c:\vdjdd.exec:\vdjdd.exe99⤵PID:4740
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe100⤵PID:512
-
\??\c:\xlrlfff.exec:\xlrlfff.exe101⤵PID:3628
-
\??\c:\btbttn.exec:\btbttn.exe102⤵PID:3716
-
\??\c:\thbbtb.exec:\thbbtb.exe103⤵PID:4348
-
\??\c:\dppdv.exec:\dppdv.exe104⤵PID:1712
-
\??\c:\pddjp.exec:\pddjp.exe105⤵PID:4216
-
\??\c:\lfxrxrx.exec:\lfxrxrx.exe106⤵PID:2200
-
\??\c:\hbbttt.exec:\hbbttt.exe107⤵PID:3620
-
\??\c:\bnnhbt.exec:\bnnhbt.exe108⤵
- System Location Discovery: System Language Discovery
PID:4152 -
\??\c:\vjpjp.exec:\vjpjp.exe109⤵PID:3016
-
\??\c:\fxrlllf.exec:\fxrlllf.exe110⤵PID:3296
-
\??\c:\9xrrffx.exec:\9xrrffx.exe111⤵PID:2660
-
\??\c:\rfxrllf.exec:\rfxrllf.exe112⤵PID:1428
-
\??\c:\nhtntt.exec:\nhtntt.exe113⤵PID:3400
-
\??\c:\vddvp.exec:\vddvp.exe114⤵PID:800
-
\??\c:\1vppp.exec:\1vppp.exe115⤵PID:4888
-
\??\c:\frrfrrl.exec:\frrfrrl.exe116⤵PID:4232
-
\??\c:\llllfff.exec:\llllfff.exe117⤵PID:2360
-
\??\c:\hbthhh.exec:\hbthhh.exe118⤵PID:2600
-
\??\c:\9hnbbb.exec:\9hnbbb.exe119⤵PID:4988
-
\??\c:\dppjv.exec:\dppjv.exe120⤵PID:3460
-
\??\c:\7rrlxfx.exec:\7rrlxfx.exe121⤵PID:3852
-
\??\c:\xlxrlfl.exec:\xlxrlfl.exe122⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-