Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 19:39
Behavioral task
behavioral1
Sample
d8bf68c8878f51869ea1c5a78d9af1d0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
d8bf68c8878f51869ea1c5a78d9af1d0N.exe
-
Size
367KB
-
MD5
d8bf68c8878f51869ea1c5a78d9af1d0
-
SHA1
40fec6897909f897924aa9bb1585a4a912073107
-
SHA256
a8c79012856b2ba2e4d5f8df3ac740890f87119a1c4c8d4448a49ba00ef58c81
-
SHA512
7f1d8aaed10862c1f9dbefe2b7f9ee3bd72d659e2edc3c2bba2fdb07237916161398e591f9012a4095bf3df7c11d1ca661fac490933a5633fbd2d27c50d8e5cc
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8+:/4wFHoSQuxy3rTXIM18+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5072-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3896-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2648-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4768-532-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-571-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-623-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-819-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-940-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-995-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-1221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-1243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-1478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1336 9ffxllf.exe 4088 7nhbtt.exe 1360 ppjjd.exe 3776 lrlrfrl.exe 4960 btttnn.exe 3108 ththhb.exe 4124 djpjd.exe 2296 jvjdv.exe 4972 xlffxll.exe 928 bhhtnt.exe 4992 1jpjj.exe 4828 fffxrrr.exe 2644 jvpdp.exe 2496 ttnhhh.exe 4800 nhhhbb.exe 2844 xfrxrfr.exe 1972 jppjd.exe 4008 rlxxllf.exe 5044 frrlxlr.exe 3856 rlfxrrf.exe 1660 pdpjd.exe 1192 ntnhhb.exe 3804 nnthbb.exe 3468 jjjpj.exe 312 rxfxlll.exe 2952 5bnhhh.exe 3256 lffxxrl.exe 1200 tnbhhh.exe 2616 ddpdj.exe 3724 vpjpj.exe 3340 ffxxrrl.exe 3820 7rlfxrf.exe 1984 bbbbtn.exe 3416 ddjdp.exe 3896 xflfxxr.exe 2884 xxlllxx.exe 316 hbhnhh.exe 3228 pjvpj.exe 1272 lrxfffx.exe 2696 5nbttt.exe 4156 1vdvp.exe 1612 xrxxrxr.exe 3212 rlfxllf.exe 1312 hnhbbn.exe 4340 dvddd.exe 4344 fxllrrl.exe 4748 xxrrrxx.exe 4276 nbhbbb.exe 4164 djvpp.exe 4900 vvjjd.exe 2344 lxfxrrx.exe 1928 bhtnnt.exe 384 ttbtnh.exe 4244 1djdd.exe 2088 llrlxxr.exe 4140 btthtn.exe 3328 httbnb.exe 4124 pppdv.exe 3208 xxlfrrf.exe 2520 btbhbt.exe 4972 nhhhbb.exe 2584 9vdvv.exe 928 rrxxffr.exe 184 bbbtnn.exe -
resource yara_rule behavioral2/memory/5072-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023453-3.dat upx behavioral2/memory/5072-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b4-10.dat upx behavioral2/memory/4088-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b5-17.dat upx behavioral2/files/0x00070000000234b6-22.dat upx behavioral2/files/0x00070000000234b7-29.dat upx behavioral2/files/0x00070000000234b8-35.dat upx behavioral2/memory/4124-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234b9-41.dat upx behavioral2/memory/3108-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4960-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3776-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1360-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1336-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ba-46.dat upx behavioral2/files/0x00070000000234bb-51.dat upx behavioral2/files/0x00070000000234bc-57.dat upx behavioral2/memory/2296-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4992-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234be-70.dat upx behavioral2/memory/4828-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bd-64.dat upx behavioral2/memory/4828-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234bf-78.dat upx behavioral2/memory/2644-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c0-81.dat upx behavioral2/memory/2496-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c1-89.dat upx behavioral2/files/0x00080000000234b1-93.dat upx behavioral2/memory/4800-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2844-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c2-102.dat upx behavioral2/files/0x00070000000234c3-107.dat upx behavioral2/memory/4008-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c4-112.dat upx behavioral2/memory/4008-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c5-118.dat upx behavioral2/memory/5044-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c6-124.dat upx behavioral2/memory/3856-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1660-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c7-133.dat upx behavioral2/files/0x00070000000234c9-142.dat upx behavioral2/files/0x00070000000234ca-148.dat upx behavioral2/memory/3804-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234c8-137.dat upx behavioral2/files/0x0002000000022b25-153.dat upx behavioral2/memory/312-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0002000000022b23-159.dat upx behavioral2/files/0x000a000000023412-163.dat upx behavioral2/files/0x00070000000234cc-174.dat upx behavioral2/files/0x00070000000234cd-180.dat upx behavioral2/memory/2616-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234cb-170.dat upx behavioral2/files/0x00070000000234ce-184.dat upx behavioral2/memory/3820-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1984-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3896-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2884-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4340-232-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5072 wrote to memory of 1336 5072 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 84 PID 5072 wrote to memory of 1336 5072 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 84 PID 5072 wrote to memory of 1336 5072 d8bf68c8878f51869ea1c5a78d9af1d0N.exe 84 PID 1336 wrote to memory of 4088 1336 9ffxllf.exe 86 PID 1336 wrote to memory of 4088 1336 9ffxllf.exe 86 PID 1336 wrote to memory of 4088 1336 9ffxllf.exe 86 PID 4088 wrote to memory of 1360 4088 7nhbtt.exe 87 PID 4088 wrote to memory of 1360 4088 7nhbtt.exe 87 PID 4088 wrote to memory of 1360 4088 7nhbtt.exe 87 PID 1360 wrote to memory of 3776 1360 ppjjd.exe 88 PID 1360 wrote to memory of 3776 1360 ppjjd.exe 88 PID 1360 wrote to memory of 3776 1360 ppjjd.exe 88 PID 3776 wrote to memory of 4960 3776 lrlrfrl.exe 89 PID 3776 wrote to memory of 4960 3776 lrlrfrl.exe 89 PID 3776 wrote to memory of 4960 3776 lrlrfrl.exe 89 PID 4960 wrote to memory of 3108 4960 btttnn.exe 90 PID 4960 wrote to memory of 3108 4960 btttnn.exe 90 PID 4960 wrote to memory of 3108 4960 btttnn.exe 90 PID 3108 wrote to memory of 4124 3108 ththhb.exe 91 PID 3108 wrote to memory of 4124 3108 ththhb.exe 91 PID 3108 wrote to memory of 4124 3108 ththhb.exe 91 PID 4124 wrote to memory of 2296 4124 djpjd.exe 92 PID 4124 wrote to memory of 2296 4124 djpjd.exe 92 PID 4124 wrote to memory of 2296 4124 djpjd.exe 92 PID 2296 wrote to memory of 4972 2296 jvjdv.exe 93 PID 2296 wrote to memory of 4972 2296 jvjdv.exe 93 PID 2296 wrote to memory of 4972 2296 jvjdv.exe 93 PID 4972 wrote to memory of 928 4972 xlffxll.exe 94 PID 4972 wrote to memory of 928 4972 xlffxll.exe 94 PID 4972 wrote to memory of 928 4972 xlffxll.exe 94 PID 928 wrote to memory of 4992 928 bhhtnt.exe 96 PID 928 wrote to memory of 4992 928 bhhtnt.exe 96 PID 928 wrote to memory of 4992 928 bhhtnt.exe 96 PID 4992 wrote to memory of 4828 4992 1jpjj.exe 97 PID 4992 wrote to memory of 4828 4992 1jpjj.exe 97 PID 4992 wrote to memory of 4828 4992 1jpjj.exe 97 PID 4828 wrote to memory of 2644 4828 fffxrrr.exe 98 PID 4828 wrote to memory of 2644 4828 fffxrrr.exe 98 PID 4828 wrote to memory of 2644 4828 fffxrrr.exe 98 PID 2644 wrote to memory of 2496 2644 jvpdp.exe 99 PID 2644 wrote to memory of 2496 2644 jvpdp.exe 99 PID 2644 wrote to memory of 2496 2644 jvpdp.exe 99 PID 2496 wrote to memory of 4800 2496 ttnhhh.exe 100 PID 2496 wrote to memory of 4800 2496 ttnhhh.exe 100 PID 2496 wrote to memory of 4800 2496 ttnhhh.exe 100 PID 4800 wrote to memory of 2844 4800 nhhhbb.exe 101 PID 4800 wrote to memory of 2844 4800 nhhhbb.exe 101 PID 4800 wrote to memory of 2844 4800 nhhhbb.exe 101 PID 2844 wrote to memory of 1972 2844 xfrxrfr.exe 102 PID 2844 wrote to memory of 1972 2844 xfrxrfr.exe 102 PID 2844 wrote to memory of 1972 2844 xfrxrfr.exe 102 PID 1972 wrote to memory of 4008 1972 jppjd.exe 103 PID 1972 wrote to memory of 4008 1972 jppjd.exe 103 PID 1972 wrote to memory of 4008 1972 jppjd.exe 103 PID 4008 wrote to memory of 5044 4008 rlxxllf.exe 104 PID 4008 wrote to memory of 5044 4008 rlxxllf.exe 104 PID 4008 wrote to memory of 5044 4008 rlxxllf.exe 104 PID 5044 wrote to memory of 3856 5044 frrlxlr.exe 105 PID 5044 wrote to memory of 3856 5044 frrlxlr.exe 105 PID 5044 wrote to memory of 3856 5044 frrlxlr.exe 105 PID 3856 wrote to memory of 1660 3856 rlfxrrf.exe 106 PID 3856 wrote to memory of 1660 3856 rlfxrrf.exe 106 PID 3856 wrote to memory of 1660 3856 rlfxrrf.exe 106 PID 1660 wrote to memory of 1192 1660 pdpjd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8bf68c8878f51869ea1c5a78d9af1d0N.exe"C:\Users\Admin\AppData\Local\Temp\d8bf68c8878f51869ea1c5a78d9af1d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\9ffxllf.exec:\9ffxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\7nhbtt.exec:\7nhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\ppjjd.exec:\ppjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\lrlrfrl.exec:\lrlrfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\btttnn.exec:\btttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\ththhb.exec:\ththhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\djpjd.exec:\djpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\jvjdv.exec:\jvjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\xlffxll.exec:\xlffxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bhhtnt.exec:\bhhtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\1jpjj.exec:\1jpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\fffxrrr.exec:\fffxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\jvpdp.exec:\jvpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ttnhhh.exec:\ttnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nhhhbb.exec:\nhhhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\xfrxrfr.exec:\xfrxrfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jppjd.exec:\jppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rlxxllf.exec:\rlxxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\frrlxlr.exec:\frrlxlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rlfxrrf.exec:\rlfxrrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\pdpjd.exec:\pdpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ntnhhb.exec:\ntnhhb.exe23⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nnthbb.exec:\nnthbb.exe24⤵
- Executes dropped EXE
PID:3804 -
\??\c:\jjjpj.exec:\jjjpj.exe25⤵
- Executes dropped EXE
PID:3468 -
\??\c:\rxfxlll.exec:\rxfxlll.exe26⤵
- Executes dropped EXE
PID:312 -
\??\c:\5bnhhh.exec:\5bnhhh.exe27⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lffxxrl.exec:\lffxxrl.exe28⤵
- Executes dropped EXE
PID:3256 -
\??\c:\tnbhhh.exec:\tnbhhh.exe29⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ddpdj.exec:\ddpdj.exe30⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpjpj.exec:\vpjpj.exe31⤵
- Executes dropped EXE
PID:3724 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe32⤵
- Executes dropped EXE
PID:3340 -
\??\c:\7rlfxrf.exec:\7rlfxrf.exe33⤵
- Executes dropped EXE
PID:3820 -
\??\c:\bbbbtn.exec:\bbbbtn.exe34⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ddjdp.exec:\ddjdp.exe35⤵
- Executes dropped EXE
PID:3416 -
\??\c:\xflfxxr.exec:\xflfxxr.exe36⤵
- Executes dropped EXE
PID:3896 -
\??\c:\xxlllxx.exec:\xxlllxx.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbhnhh.exec:\hbhnhh.exe38⤵
- Executes dropped EXE
PID:316 -
\??\c:\pjvpj.exec:\pjvpj.exe39⤵
- Executes dropped EXE
PID:3228 -
\??\c:\lrxfffx.exec:\lrxfffx.exe40⤵
- Executes dropped EXE
PID:1272 -
\??\c:\5nbttt.exec:\5nbttt.exe41⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1vdvp.exec:\1vdvp.exe42⤵
- Executes dropped EXE
PID:4156 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe43⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rlfxllf.exec:\rlfxllf.exe44⤵
- Executes dropped EXE
PID:3212 -
\??\c:\hnhbbn.exec:\hnhbbn.exe45⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dvddd.exec:\dvddd.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\fxllrrl.exec:\fxllrrl.exe47⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\nbhbbb.exec:\nbhbbb.exe49⤵
- Executes dropped EXE
PID:4276 -
\??\c:\djvpp.exec:\djvpp.exe50⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vvjjd.exec:\vvjjd.exe51⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lxfxrrx.exec:\lxfxrrx.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bhtnnt.exec:\bhtnnt.exe53⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ttbtnh.exec:\ttbtnh.exe54⤵
- Executes dropped EXE
PID:384 -
\??\c:\1djdd.exec:\1djdd.exe55⤵
- Executes dropped EXE
PID:4244 -
\??\c:\llrlxxr.exec:\llrlxxr.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\btthtn.exec:\btthtn.exe57⤵
- Executes dropped EXE
PID:4140 -
\??\c:\httbnb.exec:\httbnb.exe58⤵
- Executes dropped EXE
PID:3328 -
\??\c:\pppdv.exec:\pppdv.exe59⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xxlfrrf.exec:\xxlfrrf.exe60⤵
- Executes dropped EXE
PID:3208 -
\??\c:\btbhbt.exec:\btbhbt.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\nhhhbb.exec:\nhhhbb.exe62⤵
- Executes dropped EXE
PID:4972 -
\??\c:\9vdvv.exec:\9vdvv.exe63⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rrxxffr.exec:\rrxxffr.exe64⤵
- Executes dropped EXE
PID:928 -
\??\c:\bbbtnn.exec:\bbbtnn.exe65⤵
- Executes dropped EXE
PID:184 -
\??\c:\tntnhh.exec:\tntnhh.exe66⤵PID:2656
-
\??\c:\rffxxxx.exec:\rffxxxx.exe67⤵PID:4072
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe68⤵PID:2644
-
\??\c:\bntnhh.exec:\bntnhh.exe69⤵PID:1400
-
\??\c:\7ddvp.exec:\7ddvp.exe70⤵PID:2800
-
\??\c:\rflxrlf.exec:\rflxrlf.exe71⤵PID:1340
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe72⤵PID:2844
-
\??\c:\nbtnnn.exec:\nbtnnn.exe73⤵PID:3600
-
\??\c:\jpvpp.exec:\jpvpp.exe74⤵PID:4848
-
\??\c:\fxxrlll.exec:\fxxrlll.exe75⤵PID:4008
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe76⤵PID:844
-
\??\c:\bbbbtt.exec:\bbbbtt.exe77⤵PID:392
-
\??\c:\pdvdv.exec:\pdvdv.exe78⤵PID:1204
-
\??\c:\llflxfr.exec:\llflxfr.exe79⤵PID:5048
-
\??\c:\frrlflx.exec:\frrlflx.exe80⤵PID:1192
-
\??\c:\thbtnn.exec:\thbtnn.exe81⤵PID:2648
-
\??\c:\pdddp.exec:\pdddp.exe82⤵PID:5020
-
\??\c:\ddddp.exec:\ddddp.exe83⤵PID:116
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe84⤵PID:312
-
\??\c:\jdvpj.exec:\jdvpj.exe85⤵PID:2952
-
\??\c:\9flxfff.exec:\9flxfff.exe86⤵PID:3332
-
\??\c:\5tnhbb.exec:\5tnhbb.exe87⤵PID:4044
-
\??\c:\pdpjd.exec:\pdpjd.exe88⤵PID:2188
-
\??\c:\3rflrfr.exec:\3rflrfr.exe89⤵PID:4884
-
\??\c:\5tbbbb.exec:\5tbbbb.exe90⤵PID:4020
-
\??\c:\3pddp.exec:\3pddp.exe91⤵PID:3292
-
\??\c:\1fxrlll.exec:\1fxrlll.exe92⤵PID:3900
-
\??\c:\7hnhbb.exec:\7hnhbb.exe93⤵PID:492
-
\??\c:\9jpjj.exec:\9jpjj.exe94⤵PID:3964
-
\??\c:\3lrllrr.exec:\3lrllrr.exe95⤵PID:4416
-
\??\c:\rfflfff.exec:\rfflfff.exe96⤵PID:656
-
\??\c:\jvjdd.exec:\jvjdd.exe97⤵PID:2884
-
\??\c:\ppppp.exec:\ppppp.exe98⤵PID:2364
-
\??\c:\rlxrlll.exec:\rlxrlll.exe99⤵PID:1128
-
\??\c:\bhnhhh.exec:\bhnhhh.exe100⤵PID:5008
-
\??\c:\ddddv.exec:\ddddv.exe101⤵PID:1600
-
\??\c:\dvdvd.exec:\dvdvd.exe102⤵PID:3372
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe103⤵PID:2096
-
\??\c:\7nhtnh.exec:\7nhtnh.exe104⤵PID:1828
-
\??\c:\vjvdp.exec:\vjvdp.exe105⤵PID:4324
-
\??\c:\9vdvd.exec:\9vdvd.exe106⤵PID:3220
-
\??\c:\3xrlfxx.exec:\3xrlfxx.exe107⤵PID:4600
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe108⤵PID:1336
-
\??\c:\hhbtnn.exec:\hhbtnn.exe109⤵PID:1836
-
\??\c:\jjvpp.exec:\jjvpp.exe110⤵PID:3452
-
\??\c:\vdvvd.exec:\vdvvd.exe111⤵PID:4464
-
\??\c:\llxrllf.exec:\llxrllf.exe112⤵PID:2612
-
\??\c:\tnbbhh.exec:\tnbbhh.exe113⤵PID:1656
-
\??\c:\nbhntt.exec:\nbhntt.exe114⤵
- System Location Discovery: System Language Discovery
PID:4512 -
\??\c:\pvdvj.exec:\pvdvj.exe115⤵PID:4980
-
\??\c:\nhnnhh.exec:\nhnnhh.exe116⤵PID:1236
-
\??\c:\jjvvd.exec:\jjvvd.exe117⤵PID:1740
-
\??\c:\5pvvd.exec:\5pvvd.exe118⤵PID:1808
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe119⤵PID:3288
-
\??\c:\hnbbnn.exec:\hnbbnn.exe120⤵PID:5092
-
\??\c:\bnbnhn.exec:\bnbnhn.exe121⤵PID:2584
-
\??\c:\vvvdv.exec:\vvvdv.exe122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-