Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:50
Behavioral task
behavioral1
Sample
9493d1dcc93493e7c4cbe614d3e2b530N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
9493d1dcc93493e7c4cbe614d3e2b530N.exe
-
Size
45KB
-
MD5
9493d1dcc93493e7c4cbe614d3e2b530
-
SHA1
6b0d1917c71434951dbf8ef4293c063a94413fc8
-
SHA256
65a6dca3bfba3b8ecdd180f48e6ced08ba168294ead22ee932a05dae89fe2e62
-
SHA512
3609a04a2b6ab9a67105641d323573b2f3cd6bc3dea223c33cf59cee8db13c02cabe59899cee69c206b3d28b27845285037dac1f036b20305030cb36dfee56e2
-
SSDEEP
768:+vQB0ESOGg1UrYShBbgrrMo98l4yOoBDqANhhY/4El6BhGUVTnbcuyD7UNZuVClE:+vQBeOGtrYS3srx93UBWfwC6Ggnouy8+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3884-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-744-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-1123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-978-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-778-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-692-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-585-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-1374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3884 rrxrlll.exe 952 thnbhn.exe 4780 5btthn.exe 2288 5jppp.exe 4172 frxrlll.exe 3992 rrrlffl.exe 380 nhhtth.exe 4304 dvjpd.exe 4944 jvpdv.exe 8 lfllfll.exe 116 flllfff.exe 3896 tnhhhh.exe 4972 ddvdd.exe 4128 xrfxffl.exe 628 hnnnht.exe 2740 tthnbt.exe 2204 ppdvv.exe 516 rrxxxxf.exe 1300 rxfllll.exe 1744 hhnhbh.exe 2784 7vddv.exe 4392 frxxrrr.exe 5028 7rrffxr.exe 4960 nnhhhn.exe 4720 jjpvp.exe 4640 rllrfxr.exe 1880 rxllxfr.exe 3632 tttttb.exe 2796 jjjdv.exe 1824 lxrlflf.exe 3020 llxxrrr.exe 1828 nhnhnn.exe 3056 tnnnhh.exe 3040 pdddv.exe 404 ddjpv.exe 5008 xrfxrrl.exe 2688 xrrlffx.exe 1204 9hhbtb.exe 4932 nhnhbb.exe 4632 pjjdv.exe 4364 lfxrllf.exe 1884 hhnnnn.exe 5024 hhttnn.exe 3308 vvdvd.exe 448 5flfxxr.exe 952 rxxlllf.exe 3460 1nnnnn.exe 3836 bhttnb.exe 2244 dvvvv.exe 3444 3lllfrl.exe 4532 rrrrlfx.exe 380 3bhbth.exe 4552 nbhbhh.exe 4944 vppjv.exe 1608 lfffllx.exe 4088 xrrrrxx.exe 3412 3nnnhh.exe 4588 vvvpj.exe 4972 5vpjj.exe 228 xrrfllx.exe 4036 nnnnhn.exe 1276 tbhtnt.exe 5032 jvvpj.exe 2204 jppdd.exe -
resource yara_rule behavioral2/memory/3736-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023484-3.dat upx behavioral2/memory/3884-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3736-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-12.dat upx behavioral2/memory/952-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234dc-11.dat upx behavioral2/files/0x00070000000234e1-21.dat upx behavioral2/memory/4780-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e3-27.dat upx behavioral2/memory/2288-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4172-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e4-35.dat upx behavioral2/files/0x00070000000234e5-38.dat upx behavioral2/memory/3992-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/380-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e6-46.dat upx behavioral2/files/0x00070000000234e7-53.dat upx behavioral2/memory/4304-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e8-57.dat upx behavioral2/memory/4944-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e9-62.dat upx behavioral2/memory/116-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/8-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ea-69.dat upx behavioral2/memory/116-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3896-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234eb-77.dat upx behavioral2/files/0x00070000000234ed-81.dat upx behavioral2/memory/4972-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ee-88.dat upx behavioral2/memory/4128-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/628-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-94.dat upx behavioral2/files/0x00070000000234f0-99.dat upx behavioral2/memory/2740-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2204-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f1-104.dat upx behavioral2/memory/516-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f2-113.dat upx behavioral2/files/0x00070000000234f3-118.dat upx behavioral2/files/0x00070000000234f4-123.dat upx behavioral2/memory/2784-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f5-128.dat upx behavioral2/files/0x00070000000234f6-133.dat upx behavioral2/files/0x00070000000234f7-140.dat upx behavioral2/memory/5028-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f8-144.dat upx behavioral2/files/0x00070000000234f9-149.dat upx behavioral2/memory/4720-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fa-156.dat upx behavioral2/files/0x00070000000234fb-160.dat upx behavioral2/memory/1880-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fc-166.dat upx behavioral2/memory/3632-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fd-173.dat upx behavioral2/files/0x00070000000234fe-177.dat upx behavioral2/memory/3020-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234dd-185.dat upx behavioral2/memory/1828-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2688-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-210-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 3884 3736 9493d1dcc93493e7c4cbe614d3e2b530N.exe 84 PID 3736 wrote to memory of 3884 3736 9493d1dcc93493e7c4cbe614d3e2b530N.exe 84 PID 3736 wrote to memory of 3884 3736 9493d1dcc93493e7c4cbe614d3e2b530N.exe 84 PID 3884 wrote to memory of 952 3884 rrxrlll.exe 85 PID 3884 wrote to memory of 952 3884 rrxrlll.exe 85 PID 3884 wrote to memory of 952 3884 rrxrlll.exe 85 PID 952 wrote to memory of 4780 952 thnbhn.exe 86 PID 952 wrote to memory of 4780 952 thnbhn.exe 86 PID 952 wrote to memory of 4780 952 thnbhn.exe 86 PID 4780 wrote to memory of 2288 4780 5btthn.exe 87 PID 4780 wrote to memory of 2288 4780 5btthn.exe 87 PID 4780 wrote to memory of 2288 4780 5btthn.exe 87 PID 2288 wrote to memory of 4172 2288 5jppp.exe 88 PID 2288 wrote to memory of 4172 2288 5jppp.exe 88 PID 2288 wrote to memory of 4172 2288 5jppp.exe 88 PID 4172 wrote to memory of 3992 4172 frxrlll.exe 89 PID 4172 wrote to memory of 3992 4172 frxrlll.exe 89 PID 4172 wrote to memory of 3992 4172 frxrlll.exe 89 PID 3992 wrote to memory of 380 3992 rrrlffl.exe 90 PID 3992 wrote to memory of 380 3992 rrrlffl.exe 90 PID 3992 wrote to memory of 380 3992 rrrlffl.exe 90 PID 380 wrote to memory of 4304 380 nhhtth.exe 91 PID 380 wrote to memory of 4304 380 nhhtth.exe 91 PID 380 wrote to memory of 4304 380 nhhtth.exe 91 PID 4304 wrote to memory of 4944 4304 dvjpd.exe 92 PID 4304 wrote to memory of 4944 4304 dvjpd.exe 92 PID 4304 wrote to memory of 4944 4304 dvjpd.exe 92 PID 4944 wrote to memory of 8 4944 jvpdv.exe 93 PID 4944 wrote to memory of 8 4944 jvpdv.exe 93 PID 4944 wrote to memory of 8 4944 jvpdv.exe 93 PID 8 wrote to memory of 116 8 lfllfll.exe 94 PID 8 wrote to memory of 116 8 lfllfll.exe 94 PID 8 wrote to memory of 116 8 lfllfll.exe 94 PID 116 wrote to memory of 3896 116 flllfff.exe 95 PID 116 wrote to memory of 3896 116 flllfff.exe 95 PID 116 wrote to memory of 3896 116 flllfff.exe 95 PID 3896 wrote to memory of 4972 3896 tnhhhh.exe 96 PID 3896 wrote to memory of 4972 3896 tnhhhh.exe 96 PID 3896 wrote to memory of 4972 3896 tnhhhh.exe 96 PID 4972 wrote to memory of 4128 4972 ddvdd.exe 97 PID 4972 wrote to memory of 4128 4972 ddvdd.exe 97 PID 4972 wrote to memory of 4128 4972 ddvdd.exe 97 PID 4128 wrote to memory of 628 4128 xrfxffl.exe 98 PID 4128 wrote to memory of 628 4128 xrfxffl.exe 98 PID 4128 wrote to memory of 628 4128 xrfxffl.exe 98 PID 628 wrote to memory of 2740 628 hnnnht.exe 99 PID 628 wrote to memory of 2740 628 hnnnht.exe 99 PID 628 wrote to memory of 2740 628 hnnnht.exe 99 PID 2740 wrote to memory of 2204 2740 tthnbt.exe 100 PID 2740 wrote to memory of 2204 2740 tthnbt.exe 100 PID 2740 wrote to memory of 2204 2740 tthnbt.exe 100 PID 2204 wrote to memory of 516 2204 ppdvv.exe 101 PID 2204 wrote to memory of 516 2204 ppdvv.exe 101 PID 2204 wrote to memory of 516 2204 ppdvv.exe 101 PID 516 wrote to memory of 1300 516 rrxxxxf.exe 102 PID 516 wrote to memory of 1300 516 rrxxxxf.exe 102 PID 516 wrote to memory of 1300 516 rrxxxxf.exe 102 PID 1300 wrote to memory of 1744 1300 rxfllll.exe 103 PID 1300 wrote to memory of 1744 1300 rxfllll.exe 103 PID 1300 wrote to memory of 1744 1300 rxfllll.exe 103 PID 1744 wrote to memory of 2784 1744 hhnhbh.exe 104 PID 1744 wrote to memory of 2784 1744 hhnhbh.exe 104 PID 1744 wrote to memory of 2784 1744 hhnhbh.exe 104 PID 2784 wrote to memory of 4392 2784 7vddv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9493d1dcc93493e7c4cbe614d3e2b530N.exe"C:\Users\Admin\AppData\Local\Temp\9493d1dcc93493e7c4cbe614d3e2b530N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\rrxrlll.exec:\rrxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\thnbhn.exec:\thnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\5btthn.exec:\5btthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\5jppp.exec:\5jppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\frxrlll.exec:\frxrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\rrrlffl.exec:\rrrlffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\nhhtth.exec:\nhhtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\dvjpd.exec:\dvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\jvpdv.exec:\jvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\lfllfll.exec:\lfllfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\flllfff.exec:\flllfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tnhhhh.exec:\tnhhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\ddvdd.exec:\ddvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\xrfxffl.exec:\xrfxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\hnnnht.exec:\hnnnht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\tthnbt.exec:\tthnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ppdvv.exec:\ppdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\rxfllll.exec:\rxfllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\hhnhbh.exec:\hhnhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\7vddv.exec:\7vddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frxxrrr.exec:\frxxrrr.exe23⤵
- Executes dropped EXE
PID:4392 -
\??\c:\7rrffxr.exec:\7rrffxr.exe24⤵
- Executes dropped EXE
PID:5028 -
\??\c:\nnhhhn.exec:\nnhhhn.exe25⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jjpvp.exec:\jjpvp.exe26⤵
- Executes dropped EXE
PID:4720 -
\??\c:\rllrfxr.exec:\rllrfxr.exe27⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rxllxfr.exec:\rxllxfr.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tttttb.exec:\tttttb.exe29⤵
- Executes dropped EXE
PID:3632 -
\??\c:\jjjdv.exec:\jjjdv.exe30⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxrlflf.exec:\lxrlflf.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\llxxrrr.exec:\llxxrrr.exe32⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nhnhnn.exec:\nhnhnn.exe33⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tnnnhh.exec:\tnnnhh.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\pdddv.exec:\pdddv.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ddjpv.exec:\ddjpv.exe36⤵
- Executes dropped EXE
PID:404 -
\??\c:\xrfxrrl.exec:\xrfxrrl.exe37⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xrrlffx.exec:\xrrlffx.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9hhbtb.exec:\9hhbtb.exe39⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nhnhbb.exec:\nhnhbb.exe40⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pjjdv.exec:\pjjdv.exe41⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lfxrllf.exec:\lfxrllf.exe42⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hhnnnn.exec:\hhnnnn.exe43⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hhttnn.exec:\hhttnn.exe44⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vvdvd.exec:\vvdvd.exe45⤵
- Executes dropped EXE
PID:3308 -
\??\c:\vvjdp.exec:\vvjdp.exe46⤵PID:4288
-
\??\c:\5flfxxr.exec:\5flfxxr.exe47⤵
- Executes dropped EXE
PID:448 -
\??\c:\rxxlllf.exec:\rxxlllf.exe48⤵
- Executes dropped EXE
PID:952 -
\??\c:\1nnnnn.exec:\1nnnnn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3460 -
\??\c:\bhttnb.exec:\bhttnb.exe50⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dvvvv.exec:\dvvvv.exe51⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3lllfrl.exec:\3lllfrl.exe52⤵
- Executes dropped EXE
PID:3444 -
\??\c:\rrrrlfx.exec:\rrrrlfx.exe53⤵
- Executes dropped EXE
PID:4532 -
\??\c:\3bhbth.exec:\3bhbth.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\nbhbhh.exec:\nbhbhh.exe55⤵
- Executes dropped EXE
PID:4552 -
\??\c:\vppjv.exec:\vppjv.exe56⤵
- Executes dropped EXE
PID:4944 -
\??\c:\lfffllx.exec:\lfffllx.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe58⤵
- Executes dropped EXE
PID:4088 -
\??\c:\3nnnhh.exec:\3nnnhh.exe59⤵
- Executes dropped EXE
PID:3412 -
\??\c:\vvvpj.exec:\vvvpj.exe60⤵
- Executes dropped EXE
PID:4588 -
\??\c:\5vpjj.exec:\5vpjj.exe61⤵
- Executes dropped EXE
PID:4972 -
\??\c:\xrrfllx.exec:\xrrfllx.exe62⤵
- Executes dropped EXE
PID:228 -
\??\c:\nnnnhn.exec:\nnnnhn.exe63⤵
- Executes dropped EXE
PID:4036 -
\??\c:\tbhtnt.exec:\tbhtnt.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jvvpj.exec:\jvvpj.exe65⤵
- Executes dropped EXE
PID:5032 -
\??\c:\jppdd.exec:\jppdd.exe66⤵
- Executes dropped EXE
PID:2204 -
\??\c:\tthnnn.exec:\tthnnn.exe67⤵PID:4448
-
\??\c:\btntnh.exec:\btntnh.exe68⤵PID:1764
-
\??\c:\djppp.exec:\djppp.exe69⤵PID:400
-
\??\c:\jdddd.exec:\jdddd.exe70⤵PID:1744
-
\??\c:\flllfrr.exec:\flllfrr.exe71⤵PID:4540
-
\??\c:\ttbbbh.exec:\ttbbbh.exe72⤵PID:452
-
\??\c:\hhbbht.exec:\hhbbht.exe73⤵PID:1516
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:4004
-
\??\c:\xlflxlf.exec:\xlflxlf.exe75⤵PID:4244
-
\??\c:\ttbhhn.exec:\ttbhhn.exe76⤵PID:900
-
\??\c:\hbnnnb.exec:\hbnnnb.exe77⤵PID:3948
-
\??\c:\jdvdd.exec:\jdvdd.exe78⤵PID:3248
-
\??\c:\lrllfll.exec:\lrllfll.exe79⤵PID:1296
-
\??\c:\bnnnnt.exec:\bnnnnt.exe80⤵PID:3632
-
\??\c:\hhnntb.exec:\hhnntb.exe81⤵PID:3216
-
\??\c:\pjdvd.exec:\pjdvd.exe82⤵PID:4496
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe83⤵PID:4412
-
\??\c:\ffflfrr.exec:\ffflfrr.exe84⤵
- System Location Discovery: System Language Discovery
PID:4584 -
\??\c:\hthhtt.exec:\hthhtt.exe85⤵PID:1192
-
\??\c:\1tnnbb.exec:\1tnnbb.exe86⤵PID:3724
-
\??\c:\bbnbht.exec:\bbnbht.exe87⤵PID:4208
-
\??\c:\jpvvv.exec:\jpvvv.exe88⤵PID:2108
-
\??\c:\vjpvv.exec:\vjpvv.exe89⤵PID:4260
-
\??\c:\llllfll.exec:\llllfll.exe90⤵PID:1204
-
\??\c:\lrxfflr.exec:\lrxfflr.exe91⤵PID:724
-
\??\c:\bhnnhb.exec:\bhnnhb.exe92⤵
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\hntttt.exec:\hntttt.exe93⤵PID:4368
-
\??\c:\nhbhhn.exec:\nhbhhn.exe94⤵PID:4952
-
\??\c:\dvdvd.exec:\dvdvd.exe95⤵PID:1596
-
\??\c:\7jdvd.exec:\7jdvd.exe96⤵PID:4348
-
\??\c:\xlxxfll.exec:\xlxxfll.exe97⤵PID:2484
-
\??\c:\7rrlflf.exec:\7rrlflf.exe98⤵PID:3084
-
\??\c:\9bbhnh.exec:\9bbhnh.exe99⤵PID:5040
-
\??\c:\btbbtb.exec:\btbbtb.exe100⤵PID:2328
-
\??\c:\vvjvv.exec:\vvjvv.exe101⤵PID:2608
-
\??\c:\1rlrlxx.exec:\1rlrlxx.exe102⤵PID:3508
-
\??\c:\3rxflrr.exec:\3rxflrr.exe103⤵PID:2424
-
\??\c:\lllrxfl.exec:\lllrxfl.exe104⤵PID:4192
-
\??\c:\hnnnnt.exec:\hnnnnt.exe105⤵PID:4332
-
\??\c:\3tbbhn.exec:\3tbbhn.exe106⤵PID:1060
-
\??\c:\vpvvp.exec:\vpvvp.exe107⤵PID:4500
-
\??\c:\1vvvv.exec:\1vvvv.exe108⤵PID:184
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe109⤵
- System Location Discovery: System Language Discovery
PID:2536 -
\??\c:\lllllll.exec:\lllllll.exe110⤵PID:2012
-
\??\c:\bbbhhh.exec:\bbbhhh.exe111⤵PID:3028
-
\??\c:\ntnnnt.exec:\ntnnnt.exe112⤵PID:4088
-
\??\c:\jjppv.exec:\jjppv.exe113⤵PID:2136
-
\??\c:\vjvpj.exec:\vjvpj.exe114⤵PID:3376
-
\??\c:\xflllrr.exec:\xflllrr.exe115⤵PID:4220
-
\??\c:\rflfllr.exec:\rflfllr.exe116⤵PID:4636
-
\??\c:\7bnhhn.exec:\7bnhhn.exe117⤵PID:1320
-
\??\c:\bbttnt.exec:\bbttnt.exe118⤵PID:4236
-
\??\c:\jpvvj.exec:\jpvvj.exe119⤵PID:4476
-
\??\c:\5jvvj.exec:\5jvvj.exe120⤵PID:1908
-
\??\c:\llrfllr.exec:\llrfllr.exe121⤵PID:4448
-
\??\c:\fxlrxff.exec:\fxlrxff.exe122⤵PID:2304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-