Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 03:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tenkovi.exe
Resource
win7-20240704-en
6 signatures
150 seconds
General
-
Target
tenkovi.exe
-
Size
426KB
-
MD5
7c57f3ec878c31b87695949efb2f4670
-
SHA1
b2c93693d56f95690d55e06dbc2505f85fd7776f
-
SHA256
da0f7a737c235298caf3ed9ac9b988909ed614e00243083e11569f327a5a6c35
-
SHA512
7f8ca7902a8be6711ecc364ab959bb912d59d954670ecfdaea2eea0dfc636634d1b66743bc13a8f69083ace4644eede9cfd0284277be301ca924436a22cb060f
-
SSDEEP
3072:PhOm2sI93UufdC67cihfmCiiiXAsACF486jJSpTOttUpHXXxxuvCz:Pcm7ImGddXtWrXD486jJqTGUpHxuQ
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3692-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/608-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1144-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-403-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-455-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-538-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-614-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-684-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-739-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-743-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-774-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-783-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-934-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-1176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-1643-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4408 fflffll.exe 5064 hbbbtn.exe 4996 pjdvv.exe 2484 fflllll.exe 3020 3rxrrrr.exe 972 nbttbh.exe 4732 xrlfffx.exe 1408 xxffxlf.exe 2880 tnnhbh.exe 3940 vpvpp.exe 1700 xxrlfff.exe 1020 rlxrlff.exe 1868 rrxfxxf.exe 4128 5lfxxxx.exe 396 bbhbbb.exe 2988 xxlfrrx.exe 1736 9ntttb.exe 3452 xxxrrxx.exe 2992 thttnt.exe 4812 3xrflxf.exe 2972 hbhhhh.exe 4728 rfxffff.exe 1656 bbnhbt.exe 2540 vpppj.exe 5032 bbnnhh.exe 3076 9ddvv.exe 4524 rxxrrll.exe 1776 vddjd.exe 3384 rxrlflf.exe 1432 ddppv.exe 1424 flxrlfl.exe 1188 7xflfff.exe 4988 nnhbbb.exe 4800 jvjdv.exe 688 hbhhtt.exe 4644 7jjjv.exe 4624 flrrlll.exe 544 7tnhbb.exe 4504 bnhhnn.exe 3876 dpjdd.exe 3692 xxxfxxr.exe 4340 bbbbbh.exe 1204 dvpvv.exe 4256 3rfffll.exe 2764 lfrllll.exe 2164 nnhhnn.exe 2312 dvpjj.exe 4732 lfrrrxx.exe 608 thttnt.exe 1144 nnnntt.exe 1372 7vvdd.exe 3724 ffxfrrf.exe 924 hthhhh.exe 4592 bnhhnn.exe 1488 ppvpp.exe 2304 rflrrxl.exe 4264 hnnhtt.exe 3676 httnnn.exe 3092 jdjdd.exe 2440 rlxlxrr.exe 3292 9lxxxxx.exe 4244 thbbhb.exe 3456 jddvd.exe 2988 lrllrxr.exe -
resource yara_rule behavioral2/memory/3692-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-243-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/608-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1144-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-296-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-301-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-308-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-318-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-338-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-345-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-352-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-380-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-399-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-403-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-432-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-451-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-455-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-459-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-538-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-614-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-684-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-739-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-774-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-781-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 4408 3692 tenkovi.exe 83 PID 3692 wrote to memory of 4408 3692 tenkovi.exe 83 PID 3692 wrote to memory of 4408 3692 tenkovi.exe 83 PID 4408 wrote to memory of 5064 4408 fflffll.exe 84 PID 4408 wrote to memory of 5064 4408 fflffll.exe 84 PID 4408 wrote to memory of 5064 4408 fflffll.exe 84 PID 5064 wrote to memory of 4996 5064 hbbbtn.exe 85 PID 5064 wrote to memory of 4996 5064 hbbbtn.exe 85 PID 5064 wrote to memory of 4996 5064 hbbbtn.exe 85 PID 4996 wrote to memory of 2484 4996 pjdvv.exe 86 PID 4996 wrote to memory of 2484 4996 pjdvv.exe 86 PID 4996 wrote to memory of 2484 4996 pjdvv.exe 86 PID 2484 wrote to memory of 3020 2484 fflllll.exe 87 PID 2484 wrote to memory of 3020 2484 fflllll.exe 87 PID 2484 wrote to memory of 3020 2484 fflllll.exe 87 PID 3020 wrote to memory of 972 3020 3rxrrrr.exe 88 PID 3020 wrote to memory of 972 3020 3rxrrrr.exe 88 PID 3020 wrote to memory of 972 3020 3rxrrrr.exe 88 PID 972 wrote to memory of 4732 972 nbttbh.exe 89 PID 972 wrote to memory of 4732 972 nbttbh.exe 89 PID 972 wrote to memory of 4732 972 nbttbh.exe 89 PID 4732 wrote to memory of 1408 4732 xrlfffx.exe 90 PID 4732 wrote to memory of 1408 4732 xrlfffx.exe 90 PID 4732 wrote to memory of 1408 4732 xrlfffx.exe 90 PID 1408 wrote to memory of 2880 1408 xxffxlf.exe 91 PID 1408 wrote to memory of 2880 1408 xxffxlf.exe 91 PID 1408 wrote to memory of 2880 1408 xxffxlf.exe 91 PID 2880 wrote to memory of 3940 2880 tnnhbh.exe 92 PID 2880 wrote to memory of 3940 2880 tnnhbh.exe 92 PID 2880 wrote to memory of 3940 2880 tnnhbh.exe 92 PID 3940 wrote to memory of 1700 3940 vpvpp.exe 93 PID 3940 wrote to memory of 1700 3940 vpvpp.exe 93 PID 3940 wrote to memory of 1700 3940 vpvpp.exe 93 PID 1700 wrote to memory of 1020 1700 xxrlfff.exe 94 PID 1700 wrote to memory of 1020 1700 xxrlfff.exe 94 PID 1700 wrote to memory of 1020 1700 xxrlfff.exe 94 PID 1020 wrote to memory of 1868 1020 rlxrlff.exe 95 PID 1020 wrote to memory of 1868 1020 rlxrlff.exe 95 PID 1020 wrote to memory of 1868 1020 rlxrlff.exe 95 PID 1868 wrote to memory of 4128 1868 rrxfxxf.exe 96 PID 1868 wrote to memory of 4128 1868 rrxfxxf.exe 96 PID 1868 wrote to memory of 4128 1868 rrxfxxf.exe 96 PID 4128 wrote to memory of 396 4128 5lfxxxx.exe 97 PID 4128 wrote to memory of 396 4128 5lfxxxx.exe 97 PID 4128 wrote to memory of 396 4128 5lfxxxx.exe 97 PID 396 wrote to memory of 2988 396 bbhbbb.exe 98 PID 396 wrote to memory of 2988 396 bbhbbb.exe 98 PID 396 wrote to memory of 2988 396 bbhbbb.exe 98 PID 2988 wrote to memory of 1736 2988 xxlfrrx.exe 99 PID 2988 wrote to memory of 1736 2988 xxlfrrx.exe 99 PID 2988 wrote to memory of 1736 2988 xxlfrrx.exe 99 PID 1736 wrote to memory of 3452 1736 9ntttb.exe 100 PID 1736 wrote to memory of 3452 1736 9ntttb.exe 100 PID 1736 wrote to memory of 3452 1736 9ntttb.exe 100 PID 3452 wrote to memory of 2992 3452 xxxrrxx.exe 101 PID 3452 wrote to memory of 2992 3452 xxxrrxx.exe 101 PID 3452 wrote to memory of 2992 3452 xxxrrxx.exe 101 PID 2992 wrote to memory of 4812 2992 thttnt.exe 102 PID 2992 wrote to memory of 4812 2992 thttnt.exe 102 PID 2992 wrote to memory of 4812 2992 thttnt.exe 102 PID 4812 wrote to memory of 2972 4812 3xrflxf.exe 103 PID 4812 wrote to memory of 2972 4812 3xrflxf.exe 103 PID 4812 wrote to memory of 2972 4812 3xrflxf.exe 103 PID 2972 wrote to memory of 4728 2972 hbhhhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\tenkovi.exe"C:\Users\Admin\AppData\Local\Temp\tenkovi.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\fflffll.exec:\fflffll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\hbbbtn.exec:\hbbbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\pjdvv.exec:\pjdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\fflllll.exec:\fflllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3rxrrrr.exec:\3rxrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nbttbh.exec:\nbttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\xrlfffx.exec:\xrlfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\xxffxlf.exec:\xxffxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\tnnhbh.exec:\tnnhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vpvpp.exec:\vpvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\xxrlfff.exec:\xxrlfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\rlxrlff.exec:\rlxrlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\rrxfxxf.exec:\rrxfxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\5lfxxxx.exec:\5lfxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\bbhbbb.exec:\bbhbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\xxlfrrx.exec:\xxlfrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\9ntttb.exec:\9ntttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\xxxrrxx.exec:\xxxrrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\thttnt.exec:\thttnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3xrflxf.exec:\3xrflxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\hbhhhh.exec:\hbhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rfxffff.exec:\rfxffff.exe23⤵
- Executes dropped EXE
PID:4728 -
\??\c:\bbnhbt.exec:\bbnhbt.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vpppj.exec:\vpppj.exe25⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bbnnhh.exec:\bbnnhh.exe26⤵
- Executes dropped EXE
PID:5032 -
\??\c:\9ddvv.exec:\9ddvv.exe27⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rxxrrll.exec:\rxxrrll.exe28⤵
- Executes dropped EXE
PID:4524 -
\??\c:\vddjd.exec:\vddjd.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rxrlflf.exec:\rxrlflf.exe30⤵
- Executes dropped EXE
PID:3384 -
\??\c:\ddppv.exec:\ddppv.exe31⤵
- Executes dropped EXE
PID:1432 -
\??\c:\flxrlfl.exec:\flxrlfl.exe32⤵
- Executes dropped EXE
PID:1424 -
\??\c:\7xflfff.exec:\7xflfff.exe33⤵
- Executes dropped EXE
PID:1188 -
\??\c:\nnhbbb.exec:\nnhbbb.exe34⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jvjdv.exec:\jvjdv.exe35⤵
- Executes dropped EXE
PID:4800 -
\??\c:\hbhhtt.exec:\hbhhtt.exe36⤵
- Executes dropped EXE
PID:688 -
\??\c:\7jjjv.exec:\7jjjv.exe37⤵
- Executes dropped EXE
PID:4644 -
\??\c:\flrrlll.exec:\flrrlll.exe38⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7tnhbb.exec:\7tnhbb.exe39⤵
- Executes dropped EXE
PID:544 -
\??\c:\bnhhnn.exec:\bnhhnn.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\dpjdd.exec:\dpjdd.exe41⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ffxxfll.exec:\ffxxfll.exe42⤵PID:2496
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe43⤵
- Executes dropped EXE
PID:3692 -
\??\c:\bbbbbh.exec:\bbbbbh.exe44⤵
- Executes dropped EXE
PID:4340 -
\??\c:\dvpvv.exec:\dvpvv.exe45⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3rfffll.exec:\3rfffll.exe46⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lfrllll.exec:\lfrllll.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nnhhnn.exec:\nnhhnn.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\dvpjj.exec:\dvpjj.exe49⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe50⤵
- Executes dropped EXE
PID:4732 -
\??\c:\thttnt.exec:\thttnt.exe51⤵
- Executes dropped EXE
PID:608 -
\??\c:\nnnntt.exec:\nnnntt.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7vvdd.exec:\7vvdd.exe53⤵
- Executes dropped EXE
PID:1372 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe54⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hthhhh.exec:\hthhhh.exe55⤵
- Executes dropped EXE
PID:924 -
\??\c:\bnhhnn.exec:\bnhhnn.exe56⤵
- Executes dropped EXE
PID:4592 -
\??\c:\ppvpp.exec:\ppvpp.exe57⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rflrrxl.exec:\rflrrxl.exe58⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnnhtt.exec:\hnnhtt.exe59⤵
- Executes dropped EXE
PID:4264 -
\??\c:\httnnn.exec:\httnnn.exe60⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:3092 -
\??\c:\rlxlxrr.exec:\rlxlxrr.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\9lxxxxx.exec:\9lxxxxx.exe63⤵
- Executes dropped EXE
PID:3292 -
\??\c:\thbbhb.exec:\thbbhb.exe64⤵
- Executes dropped EXE
PID:4244 -
\??\c:\jddvd.exec:\jddvd.exe65⤵
- Executes dropped EXE
PID:3456 -
\??\c:\lrllrxr.exec:\lrllrxr.exe66⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrrlllf.exec:\xrrlllf.exe67⤵PID:880
-
\??\c:\bnbbbh.exec:\bnbbbh.exe68⤵PID:1692
-
\??\c:\jjppj.exec:\jjppj.exe69⤵PID:4556
-
\??\c:\rlrlfff.exec:\rlrlfff.exe70⤵PID:2856
-
\??\c:\rxllrxl.exec:\rxllrxl.exe71⤵PID:2848
-
\??\c:\nhthhh.exec:\nhthhh.exe72⤵PID:1496
-
\??\c:\pvjjv.exec:\pvjjv.exe73⤵PID:4208
-
\??\c:\rxfllll.exec:\rxfllll.exe74⤵PID:4668
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe75⤵PID:4316
-
\??\c:\nbnnnh.exec:\nbnnnh.exe76⤵PID:424
-
\??\c:\jjpvp.exec:\jjpvp.exe77⤵PID:2088
-
\??\c:\rxllllf.exec:\rxllllf.exe78⤵PID:1656
-
\??\c:\7rrrllf.exec:\7rrrllf.exe79⤵PID:3928
-
\??\c:\bthbtn.exec:\bthbtn.exe80⤵PID:908
-
\??\c:\dpjjp.exec:\dpjjp.exe81⤵PID:5032
-
\??\c:\rrffffx.exec:\rrffffx.exe82⤵PID:3596
-
\??\c:\fflfxff.exec:\fflfxff.exe83⤵PID:384
-
\??\c:\nhnnnt.exec:\nhnnnt.exe84⤵PID:1960
-
\??\c:\jdpjp.exec:\jdpjp.exe85⤵PID:3336
-
\??\c:\frxxllf.exec:\frxxllf.exe86⤵PID:1756
-
\??\c:\llxxxll.exec:\llxxxll.exe87⤵PID:4116
-
\??\c:\bhhbbt.exec:\bhhbbt.exe88⤵PID:3612
-
\??\c:\vjdvv.exec:\vjdvv.exe89⤵PID:3512
-
\??\c:\ppppj.exec:\ppppj.exe90⤵PID:4692
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe91⤵PID:2172
-
\??\c:\bbbbtb.exec:\bbbbtb.exe92⤵
- System Location Discovery: System Language Discovery
PID:1836 -
\??\c:\vjvdd.exec:\vjvdd.exe93⤵PID:2396
-
\??\c:\1frrlxx.exec:\1frrlxx.exe94⤵PID:1172
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe95⤵PID:1920
-
\??\c:\1hhnnh.exec:\1hhnnh.exe96⤵PID:4688
-
\??\c:\vpvdd.exec:\vpvdd.exe97⤵PID:2636
-
\??\c:\1djjd.exec:\1djjd.exe98⤵PID:3972
-
\??\c:\lffllll.exec:\lffllll.exe99⤵PID:4400
-
\??\c:\7lllxrx.exec:\7lllxrx.exe100⤵PID:3876
-
\??\c:\nhnnhh.exec:\nhnnhh.exe101⤵PID:2280
-
\??\c:\3pddj.exec:\3pddj.exe102⤵PID:4408
-
\??\c:\jjpjd.exec:\jjpjd.exe103⤵PID:3280
-
\??\c:\7flflrr.exec:\7flflrr.exe104⤵PID:2924
-
\??\c:\9thbtt.exec:\9thbtt.exe105⤵PID:2552
-
\??\c:\httnhh.exec:\httnhh.exe106⤵PID:4256
-
\??\c:\jdjpj.exec:\jdjpj.exe107⤵PID:2764
-
\??\c:\1dvpj.exec:\1dvpj.exe108⤵PID:2448
-
\??\c:\7rffxff.exec:\7rffxff.exe109⤵PID:1408
-
\??\c:\nnntth.exec:\nnntth.exe110⤵PID:4540
-
\??\c:\htbbbb.exec:\htbbbb.exe111⤵PID:3088
-
\??\c:\dpvpj.exec:\dpvpj.exe112⤵PID:2664
-
\??\c:\9lrlfxx.exec:\9lrlfxx.exe113⤵PID:1372
-
\??\c:\3frrrff.exec:\3frrrff.exe114⤵
- System Location Discovery: System Language Discovery
PID:4356 -
\??\c:\7nhtht.exec:\7nhtht.exe115⤵PID:3940
-
\??\c:\vpdvp.exec:\vpdvp.exe116⤵PID:660
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵PID:2316
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe118⤵PID:5088
-
\??\c:\ttbbbt.exec:\ttbbbt.exe119⤵PID:2032
-
\??\c:\pppjj.exec:\pppjj.exe120⤵PID:3744
-
\??\c:\pjppj.exec:\pjppj.exe121⤵PID:4368
-
\??\c:\xlrrllf.exec:\xlrrllf.exe122⤵PID:400
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-