Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 01:20
Behavioral task
behavioral1
Sample
ec51c66ee6ae5ecdf48ad751c839aa40N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
ec51c66ee6ae5ecdf48ad751c839aa40N.exe
-
Size
220KB
-
MD5
ec51c66ee6ae5ecdf48ad751c839aa40
-
SHA1
757f813b57a9f76698f207694ebaa2e8e851f082
-
SHA256
c3175ae285183cd2de2e1eabde01bfc39cb169c8814d784216c7d9f8ea34ee12
-
SHA512
c824393943d0332a3e2b581a2e040d8a53f59f921e4965f7e825e2501307748867f93c6a696db88a4c9d6e5e28ebe8ff804b2ba360488ffc13f204e6a8cc8004
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JSCCtGkbuy5yLpr1awC6GIoutz5yKdwqBO:9cm4FmowdHoS4WEkMawdHoSbdwqBO
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2644-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/960-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-728-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-876-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-956-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-987-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-2015-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4600 ddddp.exe 4408 a0608.exe 1980 4460426.exe 2284 htnhtt.exe 4420 u260668.exe 3792 028688.exe 2312 m4682.exe 2208 86606.exe 3548 dvdvd.exe 3088 86662.exe 4744 4048260.exe 2180 w22488.exe 744 rxxrffx.exe 3656 82208.exe 4456 e88644.exe 4056 xrfxlfl.exe 3560 nbbthh.exe 2084 w40842.exe 2776 4886426.exe 4852 226402.exe 3192 rlrlxfl.exe 4528 xrrrxff.exe 1656 nnhtht.exe 2956 264248.exe 2944 280868.exe 2644 4048644.exe 668 206084.exe 4940 042626.exe 3432 k66082.exe 4480 thnbnh.exe 1224 thbnhb.exe 1512 2086686.exe 4800 nhnbtn.exe 4468 02286.exe 752 4240444.exe 1376 82440.exe 1172 4442844.exe 3952 62428.exe 2536 68446.exe 3936 bhhbnh.exe 920 7tnbnh.exe 4484 rxxrfxr.exe 2916 08486.exe 4288 vjpdd.exe 4056 c260804.exe 2028 xrfxffl.exe 3700 w44666.exe 2084 86042.exe 3796 284208.exe 4944 80482.exe 2920 6000824.exe 2292 pjjdd.exe 1464 m0640.exe 3732 dvvjd.exe 4580 3vpjj.exe 3868 1xrlfxf.exe 4336 062464.exe 4104 ntbnhh.exe 2036 dpjjj.exe 4724 9ttbtb.exe 4516 4460044.exe 4000 1xxrffr.exe 1980 fffrxlx.exe 4884 44666.exe -
resource yara_rule behavioral2/memory/2644-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2644-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235e9-11.dat upx behavioral2/files/0x00070000000235ed-13.dat upx behavioral2/memory/1980-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2284-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235ee-23.dat upx behavioral2/memory/4408-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000235e6-4.dat upx behavioral2/files/0x00070000000235ef-29.dat upx behavioral2/memory/2284-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4420-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f0-36.dat upx behavioral2/files/0x00070000000235f1-40.dat upx behavioral2/files/0x00070000000235f3-45.dat upx behavioral2/memory/2312-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f4-51.dat upx behavioral2/memory/2208-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f5-56.dat upx behavioral2/memory/3548-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f6-62.dat upx behavioral2/memory/3088-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f7-70.dat upx behavioral2/memory/4744-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f8-74.dat upx behavioral2/memory/2180-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235fa-87.dat upx behavioral2/memory/3656-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235f9-81.dat upx behavioral2/files/0x00070000000235fb-93.dat upx behavioral2/memory/4456-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000235ea-97.dat upx behavioral2/memory/4056-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235fc-102.dat upx behavioral2/memory/3560-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235fd-107.dat upx behavioral2/memory/2084-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2776-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000235fe-115.dat upx behavioral2/files/0x00070000000235ff-121.dat upx behavioral2/memory/4852-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023600-126.dat upx behavioral2/memory/3192-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4528-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023601-133.dat upx behavioral2/files/0x0007000000023603-137.dat upx behavioral2/files/0x0007000000023604-142.dat upx behavioral2/files/0x0007000000023605-148.dat upx behavioral2/memory/2644-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023606-155.dat upx behavioral2/files/0x0007000000023607-161.dat upx behavioral2/memory/2944-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2956-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023608-166.dat upx behavioral2/memory/3432-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023609-171.dat upx behavioral2/files/0x000700000002360a-176.dat upx behavioral2/files/0x000700000002360b-182.dat upx behavioral2/memory/1512-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1376-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1172-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3952-209-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u648282.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 262406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2844844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 604846.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language i844488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4600 2644 ec51c66ee6ae5ecdf48ad751c839aa40N.exe 91 PID 2644 wrote to memory of 4600 2644 ec51c66ee6ae5ecdf48ad751c839aa40N.exe 91 PID 2644 wrote to memory of 4600 2644 ec51c66ee6ae5ecdf48ad751c839aa40N.exe 91 PID 4600 wrote to memory of 4408 4600 ddddp.exe 92 PID 4600 wrote to memory of 4408 4600 ddddp.exe 92 PID 4600 wrote to memory of 4408 4600 ddddp.exe 92 PID 4408 wrote to memory of 1980 4408 a0608.exe 93 PID 4408 wrote to memory of 1980 4408 a0608.exe 93 PID 4408 wrote to memory of 1980 4408 a0608.exe 93 PID 1980 wrote to memory of 2284 1980 4460426.exe 94 PID 1980 wrote to memory of 2284 1980 4460426.exe 94 PID 1980 wrote to memory of 2284 1980 4460426.exe 94 PID 2284 wrote to memory of 4420 2284 htnhtt.exe 95 PID 2284 wrote to memory of 4420 2284 htnhtt.exe 95 PID 2284 wrote to memory of 4420 2284 htnhtt.exe 95 PID 4420 wrote to memory of 3792 4420 u260668.exe 96 PID 4420 wrote to memory of 3792 4420 u260668.exe 96 PID 4420 wrote to memory of 3792 4420 u260668.exe 96 PID 3792 wrote to memory of 2312 3792 028688.exe 97 PID 3792 wrote to memory of 2312 3792 028688.exe 97 PID 3792 wrote to memory of 2312 3792 028688.exe 97 PID 2312 wrote to memory of 2208 2312 m4682.exe 98 PID 2312 wrote to memory of 2208 2312 m4682.exe 98 PID 2312 wrote to memory of 2208 2312 m4682.exe 98 PID 2208 wrote to memory of 3548 2208 86606.exe 99 PID 2208 wrote to memory of 3548 2208 86606.exe 99 PID 2208 wrote to memory of 3548 2208 86606.exe 99 PID 3548 wrote to memory of 3088 3548 dvdvd.exe 100 PID 3548 wrote to memory of 3088 3548 dvdvd.exe 100 PID 3548 wrote to memory of 3088 3548 dvdvd.exe 100 PID 3088 wrote to memory of 4744 3088 86662.exe 101 PID 3088 wrote to memory of 4744 3088 86662.exe 101 PID 3088 wrote to memory of 4744 3088 86662.exe 101 PID 4744 wrote to memory of 2180 4744 4048260.exe 102 PID 4744 wrote to memory of 2180 4744 4048260.exe 102 PID 4744 wrote to memory of 2180 4744 4048260.exe 102 PID 2180 wrote to memory of 744 2180 w22488.exe 104 PID 2180 wrote to memory of 744 2180 w22488.exe 104 PID 2180 wrote to memory of 744 2180 w22488.exe 104 PID 744 wrote to memory of 3656 744 rxxrffx.exe 105 PID 744 wrote to memory of 3656 744 rxxrffx.exe 105 PID 744 wrote to memory of 3656 744 rxxrffx.exe 105 PID 3656 wrote to memory of 4456 3656 82208.exe 106 PID 3656 wrote to memory of 4456 3656 82208.exe 106 PID 3656 wrote to memory of 4456 3656 82208.exe 106 PID 4456 wrote to memory of 4056 4456 e88644.exe 138 PID 4456 wrote to memory of 4056 4456 e88644.exe 138 PID 4456 wrote to memory of 4056 4456 e88644.exe 138 PID 4056 wrote to memory of 3560 4056 xrfxlfl.exe 109 PID 4056 wrote to memory of 3560 4056 xrfxlfl.exe 109 PID 4056 wrote to memory of 3560 4056 xrfxlfl.exe 109 PID 3560 wrote to memory of 2084 3560 nbbthh.exe 141 PID 3560 wrote to memory of 2084 3560 nbbthh.exe 141 PID 3560 wrote to memory of 2084 3560 nbbthh.exe 141 PID 2084 wrote to memory of 2776 2084 w40842.exe 111 PID 2084 wrote to memory of 2776 2084 w40842.exe 111 PID 2084 wrote to memory of 2776 2084 w40842.exe 111 PID 2776 wrote to memory of 4852 2776 4886426.exe 113 PID 2776 wrote to memory of 4852 2776 4886426.exe 113 PID 2776 wrote to memory of 4852 2776 4886426.exe 113 PID 4852 wrote to memory of 3192 4852 226402.exe 114 PID 4852 wrote to memory of 3192 4852 226402.exe 114 PID 4852 wrote to memory of 3192 4852 226402.exe 114 PID 3192 wrote to memory of 4528 3192 rlrlxfl.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec51c66ee6ae5ecdf48ad751c839aa40N.exe"C:\Users\Admin\AppData\Local\Temp\ec51c66ee6ae5ecdf48ad751c839aa40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ddddp.exec:\ddddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\a0608.exec:\a0608.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\4460426.exec:\4460426.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\htnhtt.exec:\htnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\u260668.exec:\u260668.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\028688.exec:\028688.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\m4682.exec:\m4682.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\86606.exec:\86606.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\dvdvd.exec:\dvdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\86662.exec:\86662.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\4048260.exec:\4048260.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\w22488.exec:\w22488.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\rxxrffx.exec:\rxxrffx.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\82208.exec:\82208.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\e88644.exec:\e88644.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xrfxlfl.exec:\xrfxlfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\nbbthh.exec:\nbbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\w40842.exec:\w40842.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\4886426.exec:\4886426.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\226402.exec:\226402.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\rlrlxfl.exec:\rlrlxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\xrrrxff.exec:\xrrrxff.exe23⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nnhtht.exec:\nnhtht.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\264248.exec:\264248.exe25⤵
- Executes dropped EXE
PID:2956 -
\??\c:\280868.exec:\280868.exe26⤵
- Executes dropped EXE
PID:2944 -
\??\c:\4048644.exec:\4048644.exe27⤵
- Executes dropped EXE
PID:2644 -
\??\c:\206084.exec:\206084.exe28⤵
- Executes dropped EXE
PID:668 -
\??\c:\042626.exec:\042626.exe29⤵
- Executes dropped EXE
PID:4940 -
\??\c:\k66082.exec:\k66082.exe30⤵
- Executes dropped EXE
PID:3432 -
\??\c:\thnbnh.exec:\thnbnh.exe31⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thbnhb.exec:\thbnhb.exe32⤵
- Executes dropped EXE
PID:1224 -
\??\c:\2086686.exec:\2086686.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nhnbtn.exec:\nhnbtn.exe34⤵
- Executes dropped EXE
PID:4800 -
\??\c:\02286.exec:\02286.exe35⤵
- Executes dropped EXE
PID:4468 -
\??\c:\4240444.exec:\4240444.exe36⤵
- Executes dropped EXE
PID:752 -
\??\c:\82440.exec:\82440.exe37⤵
- Executes dropped EXE
PID:1376 -
\??\c:\4442844.exec:\4442844.exe38⤵
- Executes dropped EXE
PID:1172 -
\??\c:\62428.exec:\62428.exe39⤵
- Executes dropped EXE
PID:3952 -
\??\c:\68446.exec:\68446.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bhhbnh.exec:\bhhbnh.exe41⤵
- Executes dropped EXE
PID:3936 -
\??\c:\7tnbnh.exec:\7tnbnh.exe42⤵
- Executes dropped EXE
PID:920 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe43⤵
- Executes dropped EXE
PID:4484 -
\??\c:\08486.exec:\08486.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vjpdd.exec:\vjpdd.exe45⤵
- Executes dropped EXE
PID:4288 -
\??\c:\c260804.exec:\c260804.exe46⤵
- Executes dropped EXE
PID:4056 -
\??\c:\xrfxffl.exec:\xrfxffl.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\w44666.exec:\w44666.exe48⤵
- Executes dropped EXE
PID:3700 -
\??\c:\86042.exec:\86042.exe49⤵
- Executes dropped EXE
PID:2084 -
\??\c:\284208.exec:\284208.exe50⤵
- Executes dropped EXE
PID:3796 -
\??\c:\80482.exec:\80482.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\6000824.exec:\6000824.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pjjdd.exec:\pjjdd.exe53⤵
- Executes dropped EXE
PID:2292 -
\??\c:\m0640.exec:\m0640.exe54⤵
- Executes dropped EXE
PID:1464 -
\??\c:\dvvjd.exec:\dvvjd.exe55⤵
- Executes dropped EXE
PID:3732 -
\??\c:\3vpjj.exec:\3vpjj.exe56⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1xrlfxf.exec:\1xrlfxf.exe57⤵
- Executes dropped EXE
PID:3868 -
\??\c:\062464.exec:\062464.exe58⤵
- Executes dropped EXE
PID:4336 -
\??\c:\ntbnhh.exec:\ntbnhh.exe59⤵
- Executes dropped EXE
PID:4104 -
\??\c:\dpjjj.exec:\dpjjj.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\9ttbtb.exec:\9ttbtb.exe61⤵
- Executes dropped EXE
PID:4724 -
\??\c:\4460044.exec:\4460044.exe62⤵
- Executes dropped EXE
PID:4516 -
\??\c:\1xxrffr.exec:\1xxrffr.exe63⤵
- Executes dropped EXE
PID:4000 -
\??\c:\fffrxlx.exec:\fffrxlx.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\44666.exec:\44666.exe65⤵
- Executes dropped EXE
PID:4884 -
\??\c:\084264.exec:\084264.exe66⤵PID:3220
-
\??\c:\1tnnhh.exec:\1tnnhh.exe67⤵PID:3340
-
\??\c:\028648.exec:\028648.exe68⤵PID:2376
-
\??\c:\hbthhh.exec:\hbthhh.exe69⤵PID:4436
-
\??\c:\046622.exec:\046622.exe70⤵PID:2208
-
\??\c:\806600.exec:\806600.exe71⤵PID:4084
-
\??\c:\84442.exec:\84442.exe72⤵PID:4640
-
\??\c:\60480.exec:\60480.exe73⤵PID:1940
-
\??\c:\604846.exec:\604846.exe74⤵
- System Location Discovery: System Language Discovery
PID:3952 -
\??\c:\20426.exec:\20426.exe75⤵PID:2260
-
\??\c:\w22662.exec:\w22662.exe76⤵PID:4356
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe77⤵PID:3348
-
\??\c:\0804848.exec:\0804848.exe78⤵PID:4240
-
\??\c:\lxxffrl.exec:\lxxffrl.exe79⤵PID:4072
-
\??\c:\i886604.exec:\i886604.exe80⤵PID:4404
-
\??\c:\60684.exec:\60684.exe81⤵PID:4544
-
\??\c:\thbnhb.exec:\thbnhb.exe82⤵PID:4820
-
\??\c:\flffllf.exec:\flffllf.exe83⤵PID:2624
-
\??\c:\hbbhtb.exec:\hbbhtb.exe84⤵
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\220842.exec:\220842.exe85⤵PID:2216
-
\??\c:\20486.exec:\20486.exe86⤵PID:3256
-
\??\c:\c468806.exec:\c468806.exe87⤵PID:3116
-
\??\c:\s6620.exec:\s6620.exe88⤵PID:2044
-
\??\c:\80000.exec:\80000.exe89⤵PID:2540
-
\??\c:\q86804.exec:\q86804.exe90⤵PID:1468
-
\??\c:\624000.exec:\624000.exe91⤵PID:1656
-
\??\c:\rllrxlf.exec:\rllrxlf.exe92⤵PID:4320
-
\??\c:\2444848.exec:\2444848.exe93⤵PID:2812
-
\??\c:\462606.exec:\462606.exe94⤵PID:2896
-
\??\c:\vpvpd.exec:\vpvpd.exe95⤵PID:5064
-
\??\c:\222206.exec:\222206.exe96⤵PID:4560
-
\??\c:\4026082.exec:\4026082.exe97⤵PID:5068
-
\??\c:\266066.exec:\266066.exe98⤵PID:960
-
\??\c:\7ttnnn.exec:\7ttnnn.exe99⤵PID:1664
-
\??\c:\7dddv.exec:\7dddv.exe100⤵PID:2312
-
\??\c:\4284488.exec:\4284488.exe101⤵PID:2544
-
\??\c:\ttbttt.exec:\ttbttt.exe102⤵PID:4440
-
\??\c:\822688.exec:\822688.exe103⤵PID:532
-
\??\c:\frxrxrr.exec:\frxrxrr.exe104⤵PID:2092
-
\??\c:\2444484.exec:\2444484.exe105⤵PID:4640
-
\??\c:\606048.exec:\606048.exe106⤵PID:1940
-
\??\c:\bbttnn.exec:\bbttnn.exe107⤵PID:3952
-
\??\c:\dvvpv.exec:\dvvpv.exe108⤵PID:740
-
\??\c:\062266.exec:\062266.exe109⤵PID:4484
-
\??\c:\0848444.exec:\0848444.exe110⤵PID:3632
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe111⤵PID:2256
-
\??\c:\24840.exec:\24840.exe112⤵PID:4056
-
\??\c:\5fxxflx.exec:\5fxxflx.exe113⤵PID:2960
-
\??\c:\0480204.exec:\0480204.exe114⤵PID:3580
-
\??\c:\g6282.exec:\g6282.exe115⤵PID:4376
-
\??\c:\hntnhh.exec:\hntnhh.exe116⤵PID:3796
-
\??\c:\nbbbbb.exec:\nbbbbb.exe117⤵PID:2920
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵PID:3256
-
\??\c:\s4088.exec:\s4088.exe119⤵PID:2232
-
\??\c:\pvpdv.exec:\pvpdv.exe120⤵PID:4816
-
\??\c:\k42444.exec:\k42444.exe121⤵PID:2540
-
\??\c:\4060044.exec:\4060044.exe122⤵PID:1468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-