Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 10:48
Behavioral task
behavioral1
Sample
d0256c99b310ee7c25447ef1eb73ac10N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
d0256c99b310ee7c25447ef1eb73ac10N.exe
-
Size
329KB
-
MD5
d0256c99b310ee7c25447ef1eb73ac10
-
SHA1
aa20d67155b117e94249f1c874da91cb4720dd74
-
SHA256
db1027406930420f5e94ecf2d0fc1bc2f467681638605ab694d8ed65ea04918e
-
SHA512
a9d54a6c775e98f032286f1b35e38fc4f2509d5e3455eaa3c88c43cd467646188c4dca8b7aab187b8e83636228505e32b2069a07de35dbcfb1b7dd9bf8b9de99
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tQ:94wFHoStJdSjylh2b77BoTMA9gX59sTo
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3416-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1724-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4296-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/820-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/792-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2920-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/488-638-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-819-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-816-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-1266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 948 lflffff.exe 1628 5tbbbh.exe 3508 xffxrrl.exe 1724 hhnnbb.exe 5064 bhtbhn.exe 4684 7pvvv.exe 4160 dpdjj.exe 2728 tbhnnn.exe 1548 dvppp.exe 1580 lrrrxff.exe 3148 bhhhbh.exe 1924 xxllxxx.exe 4952 1hnntt.exe 4948 5lfffrr.exe 3900 lffxrlf.exe 2284 pdjjp.exe 3880 nnbhtb.exe 5116 xxlllrx.exe 4072 tnhhtb.exe 2640 jdpvd.exe 1172 llxxxxf.exe 4864 jvjpp.exe 5008 rfrrrxx.exe 1440 ttntbn.exe 4352 jjppp.exe 2488 tbthth.exe 3168 jjppp.exe 2576 flllfff.exe 2352 rrxxxff.exe 3616 9jddj.exe 2956 rxrrrxx.exe 3916 thtttn.exe 2872 7djpp.exe 3648 xxffllr.exe 4424 nhhbtt.exe 4296 1jdvp.exe 2404 9vjpj.exe 4964 frxrlfx.exe 4356 btbntt.exe 1448 tthnnh.exe 820 vpjvp.exe 2148 lrffffl.exe 1092 3rffxff.exe 1324 9nnhhh.exe 3508 jpvpv.exe 2780 3ffxrrl.exe 4444 3xlfxfx.exe 4348 hthhhh.exe 3516 pvddp.exe 3656 xfrlrrx.exe 2728 tbbnhb.exe 3000 djvpj.exe 4280 flxlllx.exe 2896 tntnhh.exe 3920 nhhbbb.exe 2312 lrfrrfl.exe 4924 btnntb.exe 3296 djpjj.exe 4580 ppdvp.exe 1744 lfrrllf.exe 872 5thhhn.exe 4144 jvjjj.exe 792 pjpvp.exe 3900 fllfxrl.exe -
resource yara_rule behavioral2/memory/3416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233e2-3.dat upx behavioral2/memory/3416-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023436-8.dat upx behavioral2/memory/948-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-11.dat upx behavioral2/memory/3508-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-19.dat upx behavioral2/files/0x000700000002343a-24.dat upx behavioral2/memory/1724-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-29.dat upx behavioral2/memory/4684-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-35.dat upx behavioral2/memory/4684-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1628-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-38.dat upx behavioral2/memory/2728-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4160-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-45.dat upx behavioral2/memory/1548-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2728-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-51.dat upx behavioral2/files/0x0007000000023440-55.dat upx behavioral2/files/0x0007000000023441-58.dat upx behavioral2/memory/3148-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-63.dat upx behavioral2/memory/1924-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-69.dat upx behavioral2/memory/4952-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-73.dat upx behavioral2/memory/4948-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023445-78.dat upx behavioral2/memory/3900-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-83.dat upx behavioral2/memory/2284-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023434-89.dat upx behavioral2/memory/5116-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-93.dat upx behavioral2/memory/5116-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4072-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023448-99.dat upx behavioral2/memory/2640-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023449-105.dat upx behavioral2/memory/1172-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-109.dat upx behavioral2/files/0x000700000002344b-114.dat upx behavioral2/memory/4864-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344c-118.dat upx behavioral2/memory/5008-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-123.dat upx behavioral2/files/0x000700000002344e-127.dat upx behavioral2/files/0x000700000002344d-131.dat upx behavioral2/files/0x000700000002344f-135.dat upx behavioral2/memory/2576-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3168-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023450-142.dat upx behavioral2/memory/2352-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000e000000023381-145.dat upx behavioral2/files/0x0007000000023451-150.dat upx behavioral2/files/0x0007000000023452-154.dat upx behavioral2/memory/3916-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3648-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2404-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4296-168-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3416 wrote to memory of 948 3416 d0256c99b310ee7c25447ef1eb73ac10N.exe 83 PID 3416 wrote to memory of 948 3416 d0256c99b310ee7c25447ef1eb73ac10N.exe 83 PID 3416 wrote to memory of 948 3416 d0256c99b310ee7c25447ef1eb73ac10N.exe 83 PID 948 wrote to memory of 1628 948 lflffff.exe 84 PID 948 wrote to memory of 1628 948 lflffff.exe 84 PID 948 wrote to memory of 1628 948 lflffff.exe 84 PID 1628 wrote to memory of 3508 1628 5tbbbh.exe 85 PID 1628 wrote to memory of 3508 1628 5tbbbh.exe 85 PID 1628 wrote to memory of 3508 1628 5tbbbh.exe 85 PID 3508 wrote to memory of 1724 3508 xffxrrl.exe 86 PID 3508 wrote to memory of 1724 3508 xffxrrl.exe 86 PID 3508 wrote to memory of 1724 3508 xffxrrl.exe 86 PID 1724 wrote to memory of 5064 1724 hhnnbb.exe 87 PID 1724 wrote to memory of 5064 1724 hhnnbb.exe 87 PID 1724 wrote to memory of 5064 1724 hhnnbb.exe 87 PID 5064 wrote to memory of 4684 5064 bhtbhn.exe 88 PID 5064 wrote to memory of 4684 5064 bhtbhn.exe 88 PID 5064 wrote to memory of 4684 5064 bhtbhn.exe 88 PID 4684 wrote to memory of 4160 4684 7pvvv.exe 89 PID 4684 wrote to memory of 4160 4684 7pvvv.exe 89 PID 4684 wrote to memory of 4160 4684 7pvvv.exe 89 PID 4160 wrote to memory of 2728 4160 dpdjj.exe 90 PID 4160 wrote to memory of 2728 4160 dpdjj.exe 90 PID 4160 wrote to memory of 2728 4160 dpdjj.exe 90 PID 2728 wrote to memory of 1548 2728 tbhnnn.exe 92 PID 2728 wrote to memory of 1548 2728 tbhnnn.exe 92 PID 2728 wrote to memory of 1548 2728 tbhnnn.exe 92 PID 1548 wrote to memory of 1580 1548 dvppp.exe 94 PID 1548 wrote to memory of 1580 1548 dvppp.exe 94 PID 1548 wrote to memory of 1580 1548 dvppp.exe 94 PID 1580 wrote to memory of 3148 1580 lrrrxff.exe 95 PID 1580 wrote to memory of 3148 1580 lrrrxff.exe 95 PID 1580 wrote to memory of 3148 1580 lrrrxff.exe 95 PID 3148 wrote to memory of 1924 3148 bhhhbh.exe 97 PID 3148 wrote to memory of 1924 3148 bhhhbh.exe 97 PID 3148 wrote to memory of 1924 3148 bhhhbh.exe 97 PID 1924 wrote to memory of 4952 1924 xxllxxx.exe 98 PID 1924 wrote to memory of 4952 1924 xxllxxx.exe 98 PID 1924 wrote to memory of 4952 1924 xxllxxx.exe 98 PID 4952 wrote to memory of 4948 4952 1hnntt.exe 99 PID 4952 wrote to memory of 4948 4952 1hnntt.exe 99 PID 4952 wrote to memory of 4948 4952 1hnntt.exe 99 PID 4948 wrote to memory of 3900 4948 5lfffrr.exe 100 PID 4948 wrote to memory of 3900 4948 5lfffrr.exe 100 PID 4948 wrote to memory of 3900 4948 5lfffrr.exe 100 PID 3900 wrote to memory of 2284 3900 lffxrlf.exe 101 PID 3900 wrote to memory of 2284 3900 lffxrlf.exe 101 PID 3900 wrote to memory of 2284 3900 lffxrlf.exe 101 PID 2284 wrote to memory of 3880 2284 pdjjp.exe 102 PID 2284 wrote to memory of 3880 2284 pdjjp.exe 102 PID 2284 wrote to memory of 3880 2284 pdjjp.exe 102 PID 3880 wrote to memory of 5116 3880 nnbhtb.exe 103 PID 3880 wrote to memory of 5116 3880 nnbhtb.exe 103 PID 3880 wrote to memory of 5116 3880 nnbhtb.exe 103 PID 5116 wrote to memory of 4072 5116 xxlllrx.exe 104 PID 5116 wrote to memory of 4072 5116 xxlllrx.exe 104 PID 5116 wrote to memory of 4072 5116 xxlllrx.exe 104 PID 4072 wrote to memory of 2640 4072 tnhhtb.exe 105 PID 4072 wrote to memory of 2640 4072 tnhhtb.exe 105 PID 4072 wrote to memory of 2640 4072 tnhhtb.exe 105 PID 2640 wrote to memory of 1172 2640 jdpvd.exe 106 PID 2640 wrote to memory of 1172 2640 jdpvd.exe 106 PID 2640 wrote to memory of 1172 2640 jdpvd.exe 106 PID 1172 wrote to memory of 4864 1172 llxxxxf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0256c99b310ee7c25447ef1eb73ac10N.exe"C:\Users\Admin\AppData\Local\Temp\d0256c99b310ee7c25447ef1eb73ac10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\lflffff.exec:\lflffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\5tbbbh.exec:\5tbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xffxrrl.exec:\xffxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\hhnnbb.exec:\hhnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\bhtbhn.exec:\bhtbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\7pvvv.exec:\7pvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dpdjj.exec:\dpdjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\tbhnnn.exec:\tbhnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dvppp.exec:\dvppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\lrrrxff.exec:\lrrrxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\bhhhbh.exec:\bhhhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\xxllxxx.exec:\xxllxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\1hnntt.exec:\1hnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\5lfffrr.exec:\5lfffrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\lffxrlf.exec:\lffxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\pdjjp.exec:\pdjjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\nnbhtb.exec:\nnbhtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\xxlllrx.exec:\xxlllrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\tnhhtb.exec:\tnhhtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\jdpvd.exec:\jdpvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\llxxxxf.exec:\llxxxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\jvjpp.exec:\jvjpp.exe23⤵
- Executes dropped EXE
PID:4864 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe24⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ttntbn.exec:\ttntbn.exe25⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jjppp.exec:\jjppp.exe26⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tbthth.exec:\tbthth.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jjppp.exec:\jjppp.exe28⤵
- Executes dropped EXE
PID:3168 -
\??\c:\flllfff.exec:\flllfff.exe29⤵
- Executes dropped EXE
PID:2576 -
\??\c:\rrxxxff.exec:\rrxxxff.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9jddj.exec:\9jddj.exe31⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rxrrrxx.exec:\rxrrrxx.exe32⤵
- Executes dropped EXE
PID:2956 -
\??\c:\thtttn.exec:\thtttn.exe33⤵
- Executes dropped EXE
PID:3916 -
\??\c:\7djpp.exec:\7djpp.exe34⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xxffllr.exec:\xxffllr.exe35⤵
- Executes dropped EXE
PID:3648 -
\??\c:\nhhbtt.exec:\nhhbtt.exe36⤵
- Executes dropped EXE
PID:4424 -
\??\c:\1jdvp.exec:\1jdvp.exe37⤵
- Executes dropped EXE
PID:4296 -
\??\c:\9vjpj.exec:\9vjpj.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\frxrlfx.exec:\frxrlfx.exe39⤵
- Executes dropped EXE
PID:4964 -
\??\c:\btbntt.exec:\btbntt.exe40⤵
- Executes dropped EXE
PID:4356 -
\??\c:\tthnnh.exec:\tthnnh.exe41⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vpjvp.exec:\vpjvp.exe42⤵
- Executes dropped EXE
PID:820 -
\??\c:\lrffffl.exec:\lrffffl.exe43⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3rffxff.exec:\3rffxff.exe44⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9nnhhh.exec:\9nnhhh.exe45⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jpvpv.exec:\jpvpv.exe46⤵
- Executes dropped EXE
PID:3508 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe47⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3xlfxfx.exec:\3xlfxfx.exe48⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hthhhh.exec:\hthhhh.exe49⤵
- Executes dropped EXE
PID:4348 -
\??\c:\pvddp.exec:\pvddp.exe50⤵
- Executes dropped EXE
PID:3516 -
\??\c:\xfrlrrx.exec:\xfrlrrx.exe51⤵
- Executes dropped EXE
PID:3656 -
\??\c:\tbbnhb.exec:\tbbnhb.exe52⤵
- Executes dropped EXE
PID:2728 -
\??\c:\djvpj.exec:\djvpj.exe53⤵
- Executes dropped EXE
PID:3000 -
\??\c:\flxlllx.exec:\flxlllx.exe54⤵
- Executes dropped EXE
PID:4280 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nhhbbb.exec:\nhhbbb.exe56⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lrfrrfl.exec:\lrfrrfl.exe57⤵
- Executes dropped EXE
PID:2312 -
\??\c:\btnntb.exec:\btnntb.exe58⤵
- Executes dropped EXE
PID:4924 -
\??\c:\djpjj.exec:\djpjj.exe59⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ppdvp.exec:\ppdvp.exe60⤵
- Executes dropped EXE
PID:4580 -
\??\c:\lfrrllf.exec:\lfrrllf.exe61⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5thhhn.exec:\5thhhn.exe62⤵
- Executes dropped EXE
PID:872 -
\??\c:\jvjjj.exec:\jvjjj.exe63⤵
- Executes dropped EXE
PID:4144 -
\??\c:\pjpvp.exec:\pjpvp.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\fllfxrl.exec:\fllfxrl.exe65⤵
- Executes dropped EXE
PID:3900 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe66⤵PID:684
-
\??\c:\bttnhb.exec:\bttnhb.exe67⤵PID:1436
-
\??\c:\vdjdd.exec:\vdjdd.exe68⤵PID:3796
-
\??\c:\rfxrlrr.exec:\rfxrlrr.exe69⤵PID:5116
-
\??\c:\lflfxrl.exec:\lflfxrl.exe70⤵PID:5040
-
\??\c:\hnhbhn.exec:\hnhbhn.exe71⤵
- System Location Discovery: System Language Discovery
PID:3544 -
\??\c:\pdvpp.exec:\pdvpp.exe72⤵PID:1360
-
\??\c:\vjvjd.exec:\vjvjd.exe73⤵PID:1560
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe74⤵PID:2396
-
\??\c:\bnhtnh.exec:\bnhtnh.exe75⤵PID:2852
-
\??\c:\3tnhbb.exec:\3tnhbb.exe76⤵PID:2184
-
\??\c:\3vdvd.exec:\3vdvd.exe77⤵PID:2044
-
\??\c:\frffllr.exec:\frffllr.exe78⤵PID:1552
-
\??\c:\xxfrlfr.exec:\xxfrlfr.exe79⤵PID:2948
-
\??\c:\nnbnhb.exec:\nnbnhb.exe80⤵PID:432
-
\??\c:\jpdvp.exec:\jpdvp.exe81⤵PID:4440
-
\??\c:\5xrflll.exec:\5xrflll.exe82⤵PID:4376
-
\??\c:\xflrlrr.exec:\xflrlrr.exe83⤵PID:3120
-
\??\c:\hthbtn.exec:\hthbtn.exe84⤵PID:1640
-
\??\c:\bhnnhh.exec:\bhnnhh.exe85⤵PID:5060
-
\??\c:\vvjdj.exec:\vvjdj.exe86⤵
- System Location Discovery: System Language Discovery
PID:4680 -
\??\c:\frrlffx.exec:\frrlffx.exe87⤵PID:2124
-
\??\c:\xxfxllf.exec:\xxfxllf.exe88⤵PID:1420
-
\??\c:\thnhbb.exec:\thnhbb.exe89⤵PID:1028
-
\??\c:\jjjdv.exec:\jjjdv.exe90⤵PID:852
-
\??\c:\7bbbtt.exec:\7bbbtt.exe91⤵PID:4988
-
\??\c:\nnhtht.exec:\nnhtht.exe92⤵PID:4424
-
\??\c:\pppdv.exec:\pppdv.exe93⤵PID:4296
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe94⤵PID:2404
-
\??\c:\nntnnn.exec:\nntnnn.exe95⤵PID:3180
-
\??\c:\lxffxll.exec:\lxffxll.exe96⤵PID:460
-
\??\c:\hbbbhh.exec:\hbbbhh.exe97⤵PID:1864
-
\??\c:\nbhhht.exec:\nbhhht.exe98⤵PID:4168
-
\??\c:\3pvdd.exec:\3pvdd.exe99⤵PID:3600
-
\??\c:\bbhbbt.exec:\bbhbbt.exe100⤵PID:3172
-
\??\c:\5jjdv.exec:\5jjdv.exe101⤵PID:2660
-
\??\c:\llrlllf.exec:\llrlllf.exe102⤵PID:5064
-
\??\c:\bnhhbh.exec:\bnhhbh.exe103⤵PID:2780
-
\??\c:\djddp.exec:\djddp.exe104⤵PID:1916
-
\??\c:\ddjjj.exec:\ddjjj.exe105⤵PID:1332
-
\??\c:\hnbhhn.exec:\hnbhhn.exe106⤵PID:3220
-
\??\c:\xfrllll.exec:\xfrllll.exe107⤵PID:4160
-
\??\c:\rlfrllf.exec:\rlfrllf.exe108⤵PID:4704
-
\??\c:\9ntnhh.exec:\9ntnhh.exe109⤵PID:3380
-
\??\c:\pdjjj.exec:\pdjjj.exe110⤵PID:4896
-
\??\c:\ppppp.exec:\ppppp.exe111⤵PID:3688
-
\??\c:\xxfllff.exec:\xxfllff.exe112⤵PID:1580
-
\??\c:\hbtnnn.exec:\hbtnnn.exe113⤵PID:4860
-
\??\c:\hnbhht.exec:\hnbhht.exe114⤵PID:3920
-
\??\c:\jvjjj.exec:\jvjjj.exe115⤵PID:2980
-
\??\c:\ffflxff.exec:\ffflxff.exe116⤵PID:656
-
\??\c:\xxlxxrr.exec:\xxlxxrr.exe117⤵PID:4468
-
\??\c:\pdvpv.exec:\pdvpv.exe118⤵PID:2920
-
\??\c:\xfrllxr.exec:\xfrllxr.exe119⤵PID:1924
-
\??\c:\hntttb.exec:\hntttb.exe120⤵PID:3136
-
\??\c:\jppjj.exec:\jppjj.exe121⤵PID:1744
-
\??\c:\rlrllrx.exec:\rlrllrx.exe122⤵PID:872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-