Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 10:29
Behavioral task
behavioral1
Sample
7d74bbe1c3fe59e1793b46572deabfb0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
7d74bbe1c3fe59e1793b46572deabfb0N.exe
-
Size
165KB
-
MD5
7d74bbe1c3fe59e1793b46572deabfb0
-
SHA1
c304e3ac244403ed33f83ef302ee7e39114c185f
-
SHA256
b28326c5b180d3c21df0a0df2ddaa6b133fe53a9bb31d0493e773149e85c68b7
-
SHA512
bd52ea10840eb321b0efb1f05e7d2981f679ad29515d87034fc70c27d8ea5b4fbbd1a199203b1d783299d3c441956b11ec67ca1a078a5c94a7ef3104a1b472d7
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout0fmCiiiXAQ5lpBoGYwNNhu0CzhKPJFt:xcm4FmowdHoSgWrXF5lpKGYV0wh6Jj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3208-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2072-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4796-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4200-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2684-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1148-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 pddvp.exe 4800 frllfff.exe 3616 htbbbb.exe 4140 pjjdj.exe 4956 fxxllfl.exe 3460 bnnnnn.exe 2304 1jpjj.exe 4960 1djjd.exe 3040 lflfrlr.exe 2072 htbtnn.exe 3392 pjdvd.exe 4776 pvdvp.exe 2760 lfrlfxl.exe 1984 nbbthh.exe 2412 9hhbtn.exe 2708 pjjvj.exe 3264 lxfxlrl.exe 3924 hhtnbt.exe 4796 vvpjv.exe 4524 fxffxxx.exe 3312 nbhtnn.exe 1300 dvpdv.exe 2180 dvvjd.exe 4000 lxxrrfx.exe 3268 ttbtbb.exe 1736 jdvpj.exe 4356 rxrrxxl.exe 5044 xlrrxfx.exe 628 flrlffr.exe 2040 bbhbtt.exe 2288 tnbttb.exe 4484 pdppj.exe 3648 pjppv.exe 1148 rxlflrr.exe 1748 nhtntt.exe 3548 ddvdv.exe 2892 7pdpv.exe 688 lffflfx.exe 3564 bhnbtb.exe 4496 tnnhbh.exe 2472 pdjjd.exe 464 lxxfrlf.exe 1488 lrrrxxx.exe 4272 btttnn.exe 3100 hbnbbb.exe 4200 djppp.exe 552 pjjjv.exe 2256 rfxrffl.exe 4020 bnnnhh.exe 4700 dvddv.exe 3484 rfrlfxr.exe 1152 fllrllr.exe 1660 thttnb.exe 2096 nnnbbt.exe 1332 jjdvv.exe 3280 jvjdv.exe 4192 rlffxfx.exe 1768 hnnnnn.exe 2368 3nhbtb.exe 3392 pjpdv.exe 4224 ppjjd.exe 3708 fllrrrf.exe 1512 rxxrlxr.exe 976 thhtnn.exe -
resource yara_rule behavioral2/memory/3208-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002347b-3.dat upx behavioral2/memory/3208-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2268-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234db-9.dat upx behavioral2/files/0x00070000000234df-11.dat upx behavioral2/memory/4800-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3616-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-20.dat upx behavioral2/files/0x00070000000234e1-23.dat upx behavioral2/memory/4140-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e3-28.dat upx behavioral2/memory/4956-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e4-33.dat upx behavioral2/files/0x00070000000234e5-39.dat upx behavioral2/memory/2304-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2304-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3460-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e6-44.dat upx behavioral2/memory/3040-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3040-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e7-49.dat upx behavioral2/memory/2072-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e8-55.dat upx behavioral2/files/0x00070000000234e9-60.dat upx behavioral2/memory/4776-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ea-65.dat upx behavioral2/files/0x00070000000234eb-68.dat upx behavioral2/memory/1984-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ec-74.dat upx behavioral2/memory/2412-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2760-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234dc-80.dat upx behavioral2/memory/2412-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2708-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ed-84.dat upx behavioral2/files/0x00070000000234ee-89.dat upx behavioral2/memory/3264-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3924-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-95.dat upx behavioral2/files/0x00070000000234f0-99.dat upx behavioral2/memory/4796-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f2-105.dat upx behavioral2/memory/4524-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3312-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f3-110.dat upx behavioral2/memory/1300-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f4-116.dat upx behavioral2/memory/2180-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f5-120.dat upx behavioral2/files/0x00070000000234f6-124.dat upx behavioral2/memory/3268-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f7-130.dat upx behavioral2/files/0x00070000000234f8-133.dat upx behavioral2/memory/4356-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f9-138.dat upx behavioral2/files/0x00070000000234fa-142.dat upx behavioral2/memory/5044-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fb-147.dat upx behavioral2/files/0x00070000000234fc-152.dat upx behavioral2/memory/2288-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4484-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fd-157.dat upx behavioral2/memory/628-149-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7d74bbe1c3fe59e1793b46572deabfb0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3208 wrote to memory of 2268 3208 7d74bbe1c3fe59e1793b46572deabfb0N.exe 84 PID 3208 wrote to memory of 2268 3208 7d74bbe1c3fe59e1793b46572deabfb0N.exe 84 PID 3208 wrote to memory of 2268 3208 7d74bbe1c3fe59e1793b46572deabfb0N.exe 84 PID 2268 wrote to memory of 4800 2268 pddvp.exe 85 PID 2268 wrote to memory of 4800 2268 pddvp.exe 85 PID 2268 wrote to memory of 4800 2268 pddvp.exe 85 PID 4800 wrote to memory of 3616 4800 frllfff.exe 86 PID 4800 wrote to memory of 3616 4800 frllfff.exe 86 PID 4800 wrote to memory of 3616 4800 frllfff.exe 86 PID 3616 wrote to memory of 4140 3616 htbbbb.exe 87 PID 3616 wrote to memory of 4140 3616 htbbbb.exe 87 PID 3616 wrote to memory of 4140 3616 htbbbb.exe 87 PID 4140 wrote to memory of 4956 4140 pjjdj.exe 88 PID 4140 wrote to memory of 4956 4140 pjjdj.exe 88 PID 4140 wrote to memory of 4956 4140 pjjdj.exe 88 PID 4956 wrote to memory of 3460 4956 fxxllfl.exe 89 PID 4956 wrote to memory of 3460 4956 fxxllfl.exe 89 PID 4956 wrote to memory of 3460 4956 fxxllfl.exe 89 PID 3460 wrote to memory of 2304 3460 bnnnnn.exe 90 PID 3460 wrote to memory of 2304 3460 bnnnnn.exe 90 PID 3460 wrote to memory of 2304 3460 bnnnnn.exe 90 PID 2304 wrote to memory of 4960 2304 1jpjj.exe 91 PID 2304 wrote to memory of 4960 2304 1jpjj.exe 91 PID 2304 wrote to memory of 4960 2304 1jpjj.exe 91 PID 4960 wrote to memory of 3040 4960 1djjd.exe 92 PID 4960 wrote to memory of 3040 4960 1djjd.exe 92 PID 4960 wrote to memory of 3040 4960 1djjd.exe 92 PID 3040 wrote to memory of 2072 3040 lflfrlr.exe 93 PID 3040 wrote to memory of 2072 3040 lflfrlr.exe 93 PID 3040 wrote to memory of 2072 3040 lflfrlr.exe 93 PID 2072 wrote to memory of 3392 2072 htbtnn.exe 94 PID 2072 wrote to memory of 3392 2072 htbtnn.exe 94 PID 2072 wrote to memory of 3392 2072 htbtnn.exe 94 PID 3392 wrote to memory of 4776 3392 pjdvd.exe 95 PID 3392 wrote to memory of 4776 3392 pjdvd.exe 95 PID 3392 wrote to memory of 4776 3392 pjdvd.exe 95 PID 4776 wrote to memory of 2760 4776 pvdvp.exe 96 PID 4776 wrote to memory of 2760 4776 pvdvp.exe 96 PID 4776 wrote to memory of 2760 4776 pvdvp.exe 96 PID 2760 wrote to memory of 1984 2760 lfrlfxl.exe 97 PID 2760 wrote to memory of 1984 2760 lfrlfxl.exe 97 PID 2760 wrote to memory of 1984 2760 lfrlfxl.exe 97 PID 1984 wrote to memory of 2412 1984 nbbthh.exe 99 PID 1984 wrote to memory of 2412 1984 nbbthh.exe 99 PID 1984 wrote to memory of 2412 1984 nbbthh.exe 99 PID 2412 wrote to memory of 2708 2412 9hhbtn.exe 100 PID 2412 wrote to memory of 2708 2412 9hhbtn.exe 100 PID 2412 wrote to memory of 2708 2412 9hhbtn.exe 100 PID 2708 wrote to memory of 3264 2708 pjjvj.exe 102 PID 2708 wrote to memory of 3264 2708 pjjvj.exe 102 PID 2708 wrote to memory of 3264 2708 pjjvj.exe 102 PID 3264 wrote to memory of 3924 3264 lxfxlrl.exe 103 PID 3264 wrote to memory of 3924 3264 lxfxlrl.exe 103 PID 3264 wrote to memory of 3924 3264 lxfxlrl.exe 103 PID 3924 wrote to memory of 4796 3924 hhtnbt.exe 104 PID 3924 wrote to memory of 4796 3924 hhtnbt.exe 104 PID 3924 wrote to memory of 4796 3924 hhtnbt.exe 104 PID 4796 wrote to memory of 4524 4796 vvpjv.exe 105 PID 4796 wrote to memory of 4524 4796 vvpjv.exe 105 PID 4796 wrote to memory of 4524 4796 vvpjv.exe 105 PID 4524 wrote to memory of 3312 4524 fxffxxx.exe 106 PID 4524 wrote to memory of 3312 4524 fxffxxx.exe 106 PID 4524 wrote to memory of 3312 4524 fxffxxx.exe 106 PID 3312 wrote to memory of 1300 3312 nbhtnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d74bbe1c3fe59e1793b46572deabfb0N.exe"C:\Users\Admin\AppData\Local\Temp\7d74bbe1c3fe59e1793b46572deabfb0N.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\pddvp.exec:\pddvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\frllfff.exec:\frllfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\htbbbb.exec:\htbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\pjjdj.exec:\pjjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\fxxllfl.exec:\fxxllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\bnnnnn.exec:\bnnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\1jpjj.exec:\1jpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1djjd.exec:\1djjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lflfrlr.exec:\lflfrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\htbtnn.exec:\htbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\pjdvd.exec:\pjdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\pvdvp.exec:\pvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\lfrlfxl.exec:\lfrlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nbbthh.exec:\nbbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9hhbtn.exec:\9hhbtn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pjjvj.exec:\pjjvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lxfxlrl.exec:\lxfxlrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\hhtnbt.exec:\hhtnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\vvpjv.exec:\vvpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\fxffxxx.exec:\fxffxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\nbhtnn.exec:\nbhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\dvpdv.exec:\dvpdv.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\dvvjd.exec:\dvvjd.exe24⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lxxrrfx.exec:\lxxrrfx.exe25⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ttbtbb.exec:\ttbtbb.exe26⤵
- Executes dropped EXE
PID:3268 -
\??\c:\jdvpj.exec:\jdvpj.exe27⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rxrrxxl.exec:\rxrrxxl.exe28⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xlrrxfx.exec:\xlrrxfx.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\flrlffr.exec:\flrlffr.exe30⤵
- Executes dropped EXE
PID:628 -
\??\c:\bbhbtt.exec:\bbhbtt.exe31⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tnbttb.exec:\tnbttb.exe32⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pdppj.exec:\pdppj.exe33⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pjppv.exec:\pjppv.exe34⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rxlflrr.exec:\rxlflrr.exe35⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nhtntt.exec:\nhtntt.exe36⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ddvdv.exec:\ddvdv.exe37⤵
- Executes dropped EXE
PID:3548 -
\??\c:\7pdpv.exec:\7pdpv.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lffflfx.exec:\lffflfx.exe39⤵
- Executes dropped EXE
PID:688 -
\??\c:\bhnbtb.exec:\bhnbtb.exe40⤵
- Executes dropped EXE
PID:3564 -
\??\c:\tnnhbh.exec:\tnnhbh.exe41⤵
- Executes dropped EXE
PID:4496 -
\??\c:\pdjjd.exec:\pdjjd.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\lxxfrlf.exec:\lxxfrlf.exe43⤵
- Executes dropped EXE
PID:464 -
\??\c:\lrrrxxx.exec:\lrrrxxx.exe44⤵
- Executes dropped EXE
PID:1488 -
\??\c:\btttnn.exec:\btttnn.exe45⤵
- Executes dropped EXE
PID:4272 -
\??\c:\hbnbbb.exec:\hbnbbb.exe46⤵
- Executes dropped EXE
PID:3100 -
\??\c:\djppp.exec:\djppp.exe47⤵
- Executes dropped EXE
PID:4200 -
\??\c:\pjjjv.exec:\pjjjv.exe48⤵
- Executes dropped EXE
PID:552 -
\??\c:\rfxrffl.exec:\rfxrffl.exe49⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bnnnhh.exec:\bnnnhh.exe50⤵
- Executes dropped EXE
PID:4020 -
\??\c:\dvddv.exec:\dvddv.exe51⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe52⤵
- Executes dropped EXE
PID:3484 -
\??\c:\fllrllr.exec:\fllrllr.exe53⤵
- Executes dropped EXE
PID:1152 -
\??\c:\thttnb.exec:\thttnb.exe54⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnnbbt.exec:\nnnbbt.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jjdvv.exec:\jjdvv.exe56⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jvjdv.exec:\jvjdv.exe57⤵
- Executes dropped EXE
PID:3280 -
\??\c:\rlffxfx.exec:\rlffxfx.exe58⤵
- Executes dropped EXE
PID:4192 -
\??\c:\hnnnnn.exec:\hnnnnn.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3nhbtb.exec:\3nhbtb.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjpdv.exec:\pjpdv.exe61⤵
- Executes dropped EXE
PID:3392 -
\??\c:\ppjjd.exec:\ppjjd.exe62⤵
- Executes dropped EXE
PID:4224 -
\??\c:\fllrrrf.exec:\fllrrrf.exe63⤵
- Executes dropped EXE
PID:3708 -
\??\c:\rxxrlxr.exec:\rxxrlxr.exe64⤵
- Executes dropped EXE
PID:1512 -
\??\c:\thhtnn.exec:\thhtnn.exe65⤵
- Executes dropped EXE
PID:976 -
\??\c:\bhthhb.exec:\bhthhb.exe66⤵PID:4332
-
\??\c:\jvppd.exec:\jvppd.exe67⤵PID:1984
-
\??\c:\jpvjd.exec:\jpvjd.exe68⤵PID:1616
-
\??\c:\rllffxx.exec:\rllffxx.exe69⤵PID:4088
-
\??\c:\lllfxxx.exec:\lllfxxx.exe70⤵PID:4136
-
\??\c:\thhhbb.exec:\thhhbb.exe71⤵PID:1588
-
\??\c:\vvpjd.exec:\vvpjd.exe72⤵PID:2292
-
\??\c:\pvdvj.exec:\pvdvj.exe73⤵PID:1468
-
\??\c:\xfllllf.exec:\xfllllf.exe74⤵PID:2080
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe75⤵PID:3912
-
\??\c:\hbbtnh.exec:\hbbtnh.exe76⤵PID:1592
-
\??\c:\hbtnnn.exec:\hbtnnn.exe77⤵PID:4744
-
\??\c:\3ddvv.exec:\3ddvv.exe78⤵PID:3992
-
\??\c:\lxffxxx.exec:\lxffxxx.exe79⤵PID:5088
-
\??\c:\tbnhbb.exec:\tbnhbb.exe80⤵PID:1344
-
\??\c:\btthbb.exec:\btthbb.exe81⤵PID:4208
-
\??\c:\dvvdj.exec:\dvvdj.exe82⤵PID:3888
-
\??\c:\dpvpd.exec:\dpvpd.exe83⤵PID:2356
-
\??\c:\fffrfxl.exec:\fffrfxl.exe84⤵PID:3292
-
\??\c:\xlrllff.exec:\xlrllff.exe85⤵PID:4652
-
\??\c:\nhbttt.exec:\nhbttt.exe86⤵PID:4236
-
\??\c:\ttbtnh.exec:\ttbtnh.exe87⤵PID:4724
-
\??\c:\pppjj.exec:\pppjj.exe88⤵PID:2936
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe89⤵PID:2684
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe90⤵PID:2008
-
\??\c:\xrrlflf.exec:\xrrlflf.exe91⤵PID:2444
-
\??\c:\htbhnt.exec:\htbhnt.exe92⤵PID:4788
-
\??\c:\vpvpj.exec:\vpvpj.exe93⤵PID:3648
-
\??\c:\7djdj.exec:\7djdj.exe94⤵PID:1148
-
\??\c:\lxxrfff.exec:\lxxrfff.exe95⤵PID:3124
-
\??\c:\hbhbhn.exec:\hbhbhn.exe96⤵PID:3548
-
\??\c:\7tbttt.exec:\7tbttt.exe97⤵PID:3020
-
\??\c:\dpppp.exec:\dpppp.exe98⤵PID:3140
-
\??\c:\jpvvd.exec:\jpvvd.exe99⤵PID:3452
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe100⤵PID:4344
-
\??\c:\tttntt.exec:\tttntt.exe101⤵PID:4672
-
\??\c:\jjpjp.exec:\jjpjp.exe102⤵PID:3208
-
\??\c:\djppj.exec:\djppj.exe103⤵PID:3100
-
\??\c:\llllrlr.exec:\llllrlr.exe104⤵PID:4820
-
\??\c:\rfxlxll.exec:\rfxlxll.exe105⤵PID:392
-
\??\c:\xrffxrr.exec:\xrffxrr.exe106⤵PID:3056
-
\??\c:\nnntbn.exec:\nnntbn.exe107⤵PID:2256
-
\??\c:\dpjvd.exec:\dpjvd.exe108⤵PID:4020
-
\??\c:\jdppp.exec:\jdppp.exe109⤵PID:4956
-
\??\c:\lrrlflf.exec:\lrrlflf.exe110⤵PID:2756
-
\??\c:\lfllflr.exec:\lfllflr.exe111⤵PID:4980
-
\??\c:\nhnhbt.exec:\nhnhbt.exe112⤵PID:1868
-
\??\c:\bnnhhh.exec:\bnnhhh.exe113⤵PID:2096
-
\??\c:\dvdvv.exec:\dvdvv.exe114⤵PID:1332
-
\??\c:\pvjjd.exec:\pvjjd.exe115⤵PID:3280
-
\??\c:\7xlxrrl.exec:\7xlxrrl.exe116⤵PID:4760
-
\??\c:\lffxxxr.exec:\lffxxxr.exe117⤵PID:4844
-
\??\c:\nhttbt.exec:\nhttbt.exe118⤵PID:3232
-
\??\c:\1pjpp.exec:\1pjpp.exe119⤵PID:3044
-
\??\c:\dvddv.exec:\dvddv.exe120⤵PID:4924
-
\??\c:\vpppd.exec:\vpppd.exe121⤵PID:2760
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe122⤵PID:4732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-