Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 09:45
Behavioral task
behavioral1
Sample
d73f8d0c7d2b9f3179515b442942e910N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
d73f8d0c7d2b9f3179515b442942e910N.exe
-
Size
332KB
-
MD5
d73f8d0c7d2b9f3179515b442942e910
-
SHA1
f1865f2e55ae79f7bf122dab2aa0d9de93d4b124
-
SHA256
800d2fbaac0599cf1b931feb33e7194f2f1d142e6cfe32664b2f4a1a0e1c6628
-
SHA512
363914e5c637ae97c9bde604ffc7400563f66bc4a256d971787297fabbe4e1f6c6c2c304ff6ad7022496d66acccde632b4d2b691be182e9e0c2efb2636b28785
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeU:R4wFHoSHYHUrAwfMp3CDU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4920-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1796-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/708-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/408-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/788-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3684-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-610-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-626-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1796 xlrfrll.exe 4260 nntbnb.exe 4736 7pdvp.exe 708 llxrxfx.exe 408 flrllfx.exe 3832 thttnt.exe 400 vdddv.exe 3308 7lxrlrr.exe 3924 nntttb.exe 716 jdpjd.exe 4040 lxrllxx.exe 3684 ddpvv.exe 336 9xlfxxx.exe 788 pppdv.exe 964 9hhbtt.exe 2820 xxxxrxx.exe 5096 nbtnnh.exe 1164 3vvdp.exe 4120 5xxxrrf.exe 4360 3bhtnt.exe 2652 dpvjv.exe 2280 xffrllx.exe 2900 9ntnnh.exe 4384 dvvvj.exe 532 1ntnhh.exe 3448 bbbtht.exe 1132 3djvp.exe 2560 lfxfflr.exe 1540 dvvpj.exe 896 rrllllx.exe 4568 tthbhb.exe 1352 ppjdp.exe 4864 xrlfxrf.exe 2828 5nnbtn.exe 2320 hnbtnn.exe 4252 jvvpd.exe 2060 lxfxrlr.exe 4072 hthbnb.exe 5088 tbthhh.exe 3700 jjpjj.exe 2352 rrxllff.exe 3596 tbbnhh.exe 4920 htthbt.exe 920 jvdpp.exe 4364 lxfxrll.exe 2992 ntbbbb.exe 376 vvpjd.exe 2420 fxxxxxx.exe 2160 hntbbh.exe 996 vjpjd.exe 828 9xlfffr.exe 2928 xrrrxfr.exe 408 bbnhbt.exe 2944 3vdjd.exe 1048 ffrrxrx.exe 4472 1hnhbt.exe 880 tnnhbb.exe 1820 1vdvp.exe 3732 xxxrxxf.exe 3924 nhnhbt.exe 1004 3htnhb.exe 1084 dvpjv.exe 216 rrlfxrf.exe 3684 hnbtnn.exe -
resource yara_rule behavioral2/memory/4920-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233dc-3.dat upx behavioral2/memory/4920-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1796-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-11.dat upx behavioral2/memory/4736-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4260-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-19.dat upx behavioral2/memory/708-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-9.dat upx behavioral2/files/0x0007000000023441-24.dat upx behavioral2/memory/708-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-29.dat upx behavioral2/memory/408-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-35.dat upx behavioral2/files/0x0007000000023444-38.dat upx behavioral2/memory/400-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023445-43.dat upx behavioral2/memory/3308-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3924-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-49.dat upx behavioral2/files/0x0007000000023447-53.dat upx behavioral2/memory/716-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023448-58.dat upx behavioral2/memory/4040-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023449-63.dat upx behavioral2/memory/336-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3684-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-71.dat upx behavioral2/memory/336-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344b-74.dat upx behavioral2/memory/788-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002343b-78.dat upx behavioral2/memory/964-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344c-84.dat upx behavioral2/memory/2820-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5096-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-90.dat upx behavioral2/memory/1164-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-94.dat upx behavioral2/files/0x0007000000023450-99.dat upx behavioral2/memory/4360-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4120-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2652-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023451-106.dat upx behavioral2/files/0x0007000000023452-110.dat upx behavioral2/files/0x0007000000023453-115.dat upx behavioral2/files/0x0007000000023454-118.dat upx behavioral2/files/0x0007000000023455-123.dat upx behavioral2/files/0x0007000000023456-126.dat upx behavioral2/memory/3448-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023457-131.dat upx behavioral2/files/0x0007000000023458-137.dat upx behavioral2/memory/1132-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023459-140.dat upx behavioral2/files/0x000700000002345a-144.dat upx behavioral2/memory/896-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-149.dat upx behavioral2/files/0x000700000002345c-153.dat upx behavioral2/memory/2320-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4252-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3596-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4920-183-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 1796 4920 d73f8d0c7d2b9f3179515b442942e910N.exe 83 PID 4920 wrote to memory of 1796 4920 d73f8d0c7d2b9f3179515b442942e910N.exe 83 PID 4920 wrote to memory of 1796 4920 d73f8d0c7d2b9f3179515b442942e910N.exe 83 PID 1796 wrote to memory of 4260 1796 xlrfrll.exe 84 PID 1796 wrote to memory of 4260 1796 xlrfrll.exe 84 PID 1796 wrote to memory of 4260 1796 xlrfrll.exe 84 PID 4260 wrote to memory of 4736 4260 nntbnb.exe 85 PID 4260 wrote to memory of 4736 4260 nntbnb.exe 85 PID 4260 wrote to memory of 4736 4260 nntbnb.exe 85 PID 4736 wrote to memory of 708 4736 7pdvp.exe 86 PID 4736 wrote to memory of 708 4736 7pdvp.exe 86 PID 4736 wrote to memory of 708 4736 7pdvp.exe 86 PID 708 wrote to memory of 408 708 llxrxfx.exe 87 PID 708 wrote to memory of 408 708 llxrxfx.exe 87 PID 708 wrote to memory of 408 708 llxrxfx.exe 87 PID 408 wrote to memory of 3832 408 flrllfx.exe 88 PID 408 wrote to memory of 3832 408 flrllfx.exe 88 PID 408 wrote to memory of 3832 408 flrllfx.exe 88 PID 3832 wrote to memory of 400 3832 thttnt.exe 89 PID 3832 wrote to memory of 400 3832 thttnt.exe 89 PID 3832 wrote to memory of 400 3832 thttnt.exe 89 PID 400 wrote to memory of 3308 400 vdddv.exe 91 PID 400 wrote to memory of 3308 400 vdddv.exe 91 PID 400 wrote to memory of 3308 400 vdddv.exe 91 PID 3308 wrote to memory of 3924 3308 7lxrlrr.exe 92 PID 3308 wrote to memory of 3924 3308 7lxrlrr.exe 92 PID 3308 wrote to memory of 3924 3308 7lxrlrr.exe 92 PID 3924 wrote to memory of 716 3924 nntttb.exe 93 PID 3924 wrote to memory of 716 3924 nntttb.exe 93 PID 3924 wrote to memory of 716 3924 nntttb.exe 93 PID 716 wrote to memory of 4040 716 jdpjd.exe 94 PID 716 wrote to memory of 4040 716 jdpjd.exe 94 PID 716 wrote to memory of 4040 716 jdpjd.exe 94 PID 4040 wrote to memory of 3684 4040 lxrllxx.exe 96 PID 4040 wrote to memory of 3684 4040 lxrllxx.exe 96 PID 4040 wrote to memory of 3684 4040 lxrllxx.exe 96 PID 3684 wrote to memory of 336 3684 ddpvv.exe 97 PID 3684 wrote to memory of 336 3684 ddpvv.exe 97 PID 3684 wrote to memory of 336 3684 ddpvv.exe 97 PID 336 wrote to memory of 788 336 9xlfxxx.exe 99 PID 336 wrote to memory of 788 336 9xlfxxx.exe 99 PID 336 wrote to memory of 788 336 9xlfxxx.exe 99 PID 788 wrote to memory of 964 788 pppdv.exe 100 PID 788 wrote to memory of 964 788 pppdv.exe 100 PID 788 wrote to memory of 964 788 pppdv.exe 100 PID 964 wrote to memory of 2820 964 9hhbtt.exe 101 PID 964 wrote to memory of 2820 964 9hhbtt.exe 101 PID 964 wrote to memory of 2820 964 9hhbtt.exe 101 PID 2820 wrote to memory of 5096 2820 xxxxrxx.exe 102 PID 2820 wrote to memory of 5096 2820 xxxxrxx.exe 102 PID 2820 wrote to memory of 5096 2820 xxxxrxx.exe 102 PID 5096 wrote to memory of 1164 5096 nbtnnh.exe 103 PID 5096 wrote to memory of 1164 5096 nbtnnh.exe 103 PID 5096 wrote to memory of 1164 5096 nbtnnh.exe 103 PID 1164 wrote to memory of 4120 1164 3vvdp.exe 104 PID 1164 wrote to memory of 4120 1164 3vvdp.exe 104 PID 1164 wrote to memory of 4120 1164 3vvdp.exe 104 PID 4120 wrote to memory of 4360 4120 5xxxrrf.exe 105 PID 4120 wrote to memory of 4360 4120 5xxxrrf.exe 105 PID 4120 wrote to memory of 4360 4120 5xxxrrf.exe 105 PID 4360 wrote to memory of 2652 4360 3bhtnt.exe 106 PID 4360 wrote to memory of 2652 4360 3bhtnt.exe 106 PID 4360 wrote to memory of 2652 4360 3bhtnt.exe 106 PID 2652 wrote to memory of 2280 2652 dpvjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d73f8d0c7d2b9f3179515b442942e910N.exe"C:\Users\Admin\AppData\Local\Temp\d73f8d0c7d2b9f3179515b442942e910N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\xlrfrll.exec:\xlrfrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\nntbnb.exec:\nntbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\7pdvp.exec:\7pdvp.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\llxrxfx.exec:\llxrxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\flrllfx.exec:\flrllfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\thttnt.exec:\thttnt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\vdddv.exec:\vdddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\7lxrlrr.exec:\7lxrlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\nntttb.exec:\nntttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\jdpjd.exec:\jdpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\lxrllxx.exec:\lxrllxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\ddpvv.exec:\ddpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\9xlfxxx.exec:\9xlfxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\pppdv.exec:\pppdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
\??\c:\9hhbtt.exec:\9hhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nbtnnh.exec:\nbtnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\3vvdp.exec:\3vvdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\5xxxrrf.exec:\5xxxrrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\3bhtnt.exec:\3bhtnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\dpvjv.exec:\dpvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xffrllx.exec:\xffrllx.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9ntnnh.exec:\9ntnnh.exe24⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dvvvj.exec:\dvvvj.exe25⤵
- Executes dropped EXE
PID:4384 -
\??\c:\1ntnhh.exec:\1ntnhh.exe26⤵
- Executes dropped EXE
PID:532 -
\??\c:\bbbtht.exec:\bbbtht.exe27⤵
- Executes dropped EXE
PID:3448 -
\??\c:\3djvp.exec:\3djvp.exe28⤵
- Executes dropped EXE
PID:1132 -
\??\c:\lfxfflr.exec:\lfxfflr.exe29⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dvvpj.exec:\dvvpj.exe30⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rrllllx.exec:\rrllllx.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\tthbhb.exec:\tthbhb.exe32⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ppjdp.exec:\ppjdp.exe33⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xrlfxrf.exec:\xrlfxrf.exe34⤵
- Executes dropped EXE
PID:4864 -
\??\c:\5nnbtn.exec:\5nnbtn.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\hnbtnn.exec:\hnbtnn.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jvvpd.exec:\jvvpd.exe37⤵
- Executes dropped EXE
PID:4252 -
\??\c:\lxfxrlr.exec:\lxfxrlr.exe38⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hthbnb.exec:\hthbnb.exe39⤵
- Executes dropped EXE
PID:4072 -
\??\c:\tbthhh.exec:\tbthhh.exe40⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jjpjj.exec:\jjpjj.exe41⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rrxllff.exec:\rrxllff.exe42⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tbbnhh.exec:\tbbnhh.exe43⤵
- Executes dropped EXE
PID:3596 -
\??\c:\htthbt.exec:\htthbt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4920 -
\??\c:\jvdpp.exec:\jvdpp.exe45⤵
- Executes dropped EXE
PID:920 -
\??\c:\lxfxrll.exec:\lxfxrll.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\ntbbbb.exec:\ntbbbb.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vvpjd.exec:\vvpjd.exe48⤵
- Executes dropped EXE
PID:376 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe49⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hntbbh.exec:\hntbbh.exe50⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vjpjd.exec:\vjpjd.exe51⤵
- Executes dropped EXE
PID:996 -
\??\c:\9xlfffr.exec:\9xlfffr.exe52⤵
- Executes dropped EXE
PID:828 -
\??\c:\xrrrxfr.exec:\xrrrxfr.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bbnhbt.exec:\bbnhbt.exe54⤵
- Executes dropped EXE
PID:408 -
\??\c:\3vdjd.exec:\3vdjd.exe55⤵
- Executes dropped EXE
PID:2944 -
\??\c:\ffrrxrx.exec:\ffrrxrx.exe56⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1hnhbt.exec:\1hnhbt.exe57⤵
- Executes dropped EXE
PID:4472 -
\??\c:\tnnhbb.exec:\tnnhbb.exe58⤵
- Executes dropped EXE
PID:880 -
\??\c:\1vdvp.exec:\1vdvp.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe60⤵
- Executes dropped EXE
PID:3732 -
\??\c:\nhnhbt.exec:\nhnhbt.exe61⤵
- Executes dropped EXE
PID:3924 -
\??\c:\3htnhb.exec:\3htnhb.exe62⤵
- Executes dropped EXE
PID:1004 -
\??\c:\dvpjv.exec:\dvpjv.exe63⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrlfxrf.exec:\rrlfxrf.exe64⤵
- Executes dropped EXE
PID:216 -
\??\c:\hnbtnn.exec:\hnbtnn.exe65⤵
- Executes dropped EXE
PID:3684 -
\??\c:\ppdvp.exec:\ppdvp.exe66⤵PID:2348
-
\??\c:\jdpdp.exec:\jdpdp.exe67⤵PID:636
-
\??\c:\xflxffr.exec:\xflxffr.exe68⤵PID:4448
-
\??\c:\bhhhbt.exec:\bhhhbt.exe69⤵PID:4888
-
\??\c:\7nnhhh.exec:\7nnhhh.exe70⤵PID:4220
-
\??\c:\jppjv.exec:\jppjv.exe71⤵PID:3016
-
\??\c:\lxxrllf.exec:\lxxrllf.exe72⤵PID:3680
-
\??\c:\lxrxflx.exec:\lxrxflx.exe73⤵PID:1836
-
\??\c:\htthbt.exec:\htthbt.exe74⤵PID:3480
-
\??\c:\jpjdv.exec:\jpjdv.exe75⤵PID:1360
-
\??\c:\lrlllxr.exec:\lrlllxr.exe76⤵PID:3728
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe77⤵PID:4912
-
\??\c:\3ttnbt.exec:\3ttnbt.exe78⤵PID:2156
-
\??\c:\dddvd.exec:\dddvd.exe79⤵PID:4984
-
\??\c:\ffrlrrr.exec:\ffrlrrr.exe80⤵PID:2180
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe81⤵PID:3392
-
\??\c:\bbnnhb.exec:\bbnnhb.exe82⤵PID:212
-
\??\c:\dvvvp.exec:\dvvvp.exe83⤵PID:3280
-
\??\c:\1ddvj.exec:\1ddvj.exe84⤵PID:3636
-
\??\c:\nbbnhb.exec:\nbbnhb.exe85⤵PID:2284
-
\??\c:\jjpjd.exec:\jjpjd.exe86⤵PID:3704
-
\??\c:\rrfllxr.exec:\rrfllxr.exe87⤵PID:1408
-
\??\c:\nbbnnt.exec:\nbbnnt.exe88⤵PID:4164
-
\??\c:\nhnhhb.exec:\nhnhhb.exe89⤵PID:2872
-
\??\c:\vppvv.exec:\vppvv.exe90⤵PID:1620
-
\??\c:\djvpd.exec:\djvpd.exe91⤵PID:3448
-
\??\c:\xllfflx.exec:\xllfflx.exe92⤵PID:688
-
\??\c:\bnhtth.exec:\bnhtth.exe93⤵PID:5052
-
\??\c:\ddvjv.exec:\ddvjv.exe94⤵PID:2560
-
\??\c:\lflflff.exec:\lflflff.exe95⤵PID:2996
-
\??\c:\xlxlrxf.exec:\xlxlrxf.exe96⤵PID:2876
-
\??\c:\tnthbt.exec:\tnthbt.exe97⤵PID:1240
-
\??\c:\3jjdd.exec:\3jjdd.exe98⤵PID:948
-
\??\c:\dppdv.exec:\dppdv.exe99⤵PID:2760
-
\??\c:\ffxlllf.exec:\ffxlllf.exe100⤵PID:2236
-
\??\c:\ttnhbb.exec:\ttnhbb.exe101⤵PID:2828
-
\??\c:\1jpjd.exec:\1jpjd.exe102⤵PID:2524
-
\??\c:\dddvp.exec:\dddvp.exe103⤵PID:3172
-
\??\c:\xxrlrlx.exec:\xxrlrlx.exe104⤵PID:3724
-
\??\c:\ttbtnn.exec:\ttbtnn.exe105⤵PID:5068
-
\??\c:\pdvjj.exec:\pdvjj.exe106⤵PID:1544
-
\??\c:\3lfxfxr.exec:\3lfxfxr.exe107⤵PID:2228
-
\??\c:\xxlfrxl.exec:\xxlfrxl.exe108⤵PID:3656
-
\??\c:\5bhbtn.exec:\5bhbtn.exe109⤵PID:4652
-
\??\c:\vdjvp.exec:\vdjvp.exe110⤵PID:4900
-
\??\c:\1ppdv.exec:\1ppdv.exe111⤵PID:4816
-
\??\c:\llfffll.exec:\llfffll.exe112⤵PID:2588
-
\??\c:\lxllffl.exec:\lxllffl.exe113⤵PID:3320
-
\??\c:\hhnthn.exec:\hhnthn.exe114⤵PID:1436
-
\??\c:\ppdjd.exec:\ppdjd.exe115⤵PID:1656
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe116⤵PID:4780
-
\??\c:\thnhhh.exec:\thnhhh.exe117⤵PID:4836
-
\??\c:\7nhbbh.exec:\7nhbbh.exe118⤵PID:4940
-
\??\c:\dvjdd.exec:\dvjdd.exe119⤵PID:4724
-
\??\c:\3llllrr.exec:\3llllrr.exe120⤵PID:824
-
\??\c:\vppjv.exec:\vppjv.exe121⤵PID:3840
-
\??\c:\dvpjd.exec:\dvpjd.exe122⤵PID:2024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-