Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2024, 08:47
Behavioral task
behavioral1
Sample
c88d7ac2412af2e37130d392b078a7e0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
c88d7ac2412af2e37130d392b078a7e0N.exe
-
Size
117KB
-
MD5
c88d7ac2412af2e37130d392b078a7e0
-
SHA1
1c282e256f2595f5b932ebb445c4f6cbffb20da0
-
SHA256
959155171785d6ad64fad12ce912f655c0bd1055443ba368f9cf61f08f7e09df
-
SHA512
854520786b94be6cdbdb5a8ab6a991976763d873092a2479587d534360ed5266e3a1dc53beca4e2ecf75cc6eaa277f047575bcd1f14074afc213e9b831ba4cce
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgQlu8:9cm4FmowdHoS4BtgQo8
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3580-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1088-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-1040-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-1642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-1895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3488 lflllll.exe 1444 bhhbbt.exe 2212 dpdvp.exe 4876 9djdv.exe 2704 rxffrff.exe 1540 bthnnb.exe 2620 tnttnn.exe 4076 dvdvp.exe 1828 xlxrlxx.exe 4632 lrlrrlr.exe 1356 tthhnn.exe 1928 7nbthh.exe 3924 7vdvp.exe 2508 lxffflf.exe 2660 rlllllf.exe 1852 bnbbtt.exe 4476 dddvp.exe 3628 7lrrxfl.exe 448 tbhhbb.exe 2880 pdvpp.exe 1624 xrxrfll.exe 932 tnbbhh.exe 4616 bthbtt.exe 2604 lrxrrrl.exe 1088 bnnhbb.exe 2140 pddpj.exe 1164 vvjjv.exe 2144 rlrlfxx.exe 900 hbnhtn.exe 3576 jpjvd.exe 4464 pppjv.exe 3876 lfffxxx.exe 552 3hnnnn.exe 4764 dddvp.exe 3652 vppjd.exe 2884 rfxlrfr.exe 4900 tbhntt.exe 4268 bntttb.exe 4736 dvjdd.exe 1684 rxfxrlf.exe 312 nhnnhh.exe 4312 thbtnh.exe 2252 jppjv.exe 4588 5rffxlx.exe 4384 xrlfxxl.exe 4868 tnttnn.exe 4916 bbhhbh.exe 708 dvjjd.exe 2436 lfflxxf.exe 2308 3xfxrrf.exe 4948 hhtnhh.exe 4224 btntnh.exe 1316 jddvd.exe 2644 3ddvp.exe 2408 flrlxxl.exe 2256 fxflxff.exe 4756 9hnnhh.exe 1212 3ntnnn.exe 2524 vjdvj.exe 4544 djjdp.exe 2652 frlfxxr.exe 3924 llrrfll.exe 4932 thtnbb.exe 4500 thnnbh.exe -
resource yara_rule behavioral2/memory/3580-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000234ce-3.dat upx behavioral2/memory/3580-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234e3-9.dat upx behavioral2/files/0x00070000000234e8-14.dat upx behavioral2/memory/1444-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3488-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2212-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e9-22.dat upx behavioral2/files/0x00070000000234ea-27.dat upx behavioral2/memory/4876-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234eb-33.dat upx behavioral2/memory/2704-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ec-40.dat upx behavioral2/memory/2620-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1540-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ed-47.dat upx behavioral2/memory/1828-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-57.dat upx behavioral2/memory/4632-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f0-63.dat upx behavioral2/memory/4632-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f1-69.dat upx behavioral2/memory/1356-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ee-52.dat upx behavioral2/files/0x00070000000234f2-75.dat upx behavioral2/files/0x00070000000234f3-80.dat upx behavioral2/memory/3924-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f4-86.dat upx behavioral2/memory/2508-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f5-92.dat upx behavioral2/files/0x00070000000234f6-97.dat upx behavioral2/files/0x00070000000234f7-102.dat upx behavioral2/memory/4476-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f8-108.dat upx behavioral2/memory/3628-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f9-114.dat upx behavioral2/memory/448-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fa-120.dat upx behavioral2/memory/1624-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fb-127.dat upx behavioral2/files/0x00070000000234fc-131.dat upx behavioral2/files/0x00070000000234fd-136.dat upx behavioral2/files/0x00070000000234fe-141.dat upx behavioral2/memory/2604-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ff-146.dat upx behavioral2/memory/1088-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023501-152.dat upx behavioral2/memory/2140-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000234e4-158.dat upx behavioral2/files/0x0007000000023502-163.dat upx behavioral2/memory/2144-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023503-172.dat upx behavioral2/memory/900-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023504-176.dat upx behavioral2/files/0x0007000000023505-182.dat upx behavioral2/memory/3876-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/552-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4764-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4268-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4736-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1684-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/312-219-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3580 wrote to memory of 3488 3580 c88d7ac2412af2e37130d392b078a7e0N.exe 83 PID 3580 wrote to memory of 3488 3580 c88d7ac2412af2e37130d392b078a7e0N.exe 83 PID 3580 wrote to memory of 3488 3580 c88d7ac2412af2e37130d392b078a7e0N.exe 83 PID 3488 wrote to memory of 1444 3488 lflllll.exe 84 PID 3488 wrote to memory of 1444 3488 lflllll.exe 84 PID 3488 wrote to memory of 1444 3488 lflllll.exe 84 PID 1444 wrote to memory of 2212 1444 bhhbbt.exe 85 PID 1444 wrote to memory of 2212 1444 bhhbbt.exe 85 PID 1444 wrote to memory of 2212 1444 bhhbbt.exe 85 PID 2212 wrote to memory of 4876 2212 dpdvp.exe 86 PID 2212 wrote to memory of 4876 2212 dpdvp.exe 86 PID 2212 wrote to memory of 4876 2212 dpdvp.exe 86 PID 4876 wrote to memory of 2704 4876 9djdv.exe 87 PID 4876 wrote to memory of 2704 4876 9djdv.exe 87 PID 4876 wrote to memory of 2704 4876 9djdv.exe 87 PID 2704 wrote to memory of 1540 2704 rxffrff.exe 88 PID 2704 wrote to memory of 1540 2704 rxffrff.exe 88 PID 2704 wrote to memory of 1540 2704 rxffrff.exe 88 PID 1540 wrote to memory of 2620 1540 bthnnb.exe 89 PID 1540 wrote to memory of 2620 1540 bthnnb.exe 89 PID 1540 wrote to memory of 2620 1540 bthnnb.exe 89 PID 2620 wrote to memory of 4076 2620 tnttnn.exe 90 PID 2620 wrote to memory of 4076 2620 tnttnn.exe 90 PID 2620 wrote to memory of 4076 2620 tnttnn.exe 90 PID 4076 wrote to memory of 1828 4076 dvdvp.exe 91 PID 4076 wrote to memory of 1828 4076 dvdvp.exe 91 PID 4076 wrote to memory of 1828 4076 dvdvp.exe 91 PID 1828 wrote to memory of 4632 1828 xlxrlxx.exe 92 PID 1828 wrote to memory of 4632 1828 xlxrlxx.exe 92 PID 1828 wrote to memory of 4632 1828 xlxrlxx.exe 92 PID 4632 wrote to memory of 1356 4632 lrlrrlr.exe 93 PID 4632 wrote to memory of 1356 4632 lrlrrlr.exe 93 PID 4632 wrote to memory of 1356 4632 lrlrrlr.exe 93 PID 1356 wrote to memory of 1928 1356 tthhnn.exe 94 PID 1356 wrote to memory of 1928 1356 tthhnn.exe 94 PID 1356 wrote to memory of 1928 1356 tthhnn.exe 94 PID 1928 wrote to memory of 3924 1928 7nbthh.exe 95 PID 1928 wrote to memory of 3924 1928 7nbthh.exe 95 PID 1928 wrote to memory of 3924 1928 7nbthh.exe 95 PID 3924 wrote to memory of 2508 3924 7vdvp.exe 96 PID 3924 wrote to memory of 2508 3924 7vdvp.exe 96 PID 3924 wrote to memory of 2508 3924 7vdvp.exe 96 PID 2508 wrote to memory of 2660 2508 lxffflf.exe 97 PID 2508 wrote to memory of 2660 2508 lxffflf.exe 97 PID 2508 wrote to memory of 2660 2508 lxffflf.exe 97 PID 2660 wrote to memory of 1852 2660 rlllllf.exe 99 PID 2660 wrote to memory of 1852 2660 rlllllf.exe 99 PID 2660 wrote to memory of 1852 2660 rlllllf.exe 99 PID 1852 wrote to memory of 4476 1852 bnbbtt.exe 100 PID 1852 wrote to memory of 4476 1852 bnbbtt.exe 100 PID 1852 wrote to memory of 4476 1852 bnbbtt.exe 100 PID 4476 wrote to memory of 3628 4476 dddvp.exe 101 PID 4476 wrote to memory of 3628 4476 dddvp.exe 101 PID 4476 wrote to memory of 3628 4476 dddvp.exe 101 PID 3628 wrote to memory of 448 3628 7lrrxfl.exe 102 PID 3628 wrote to memory of 448 3628 7lrrxfl.exe 102 PID 3628 wrote to memory of 448 3628 7lrrxfl.exe 102 PID 448 wrote to memory of 2880 448 tbhhbb.exe 103 PID 448 wrote to memory of 2880 448 tbhhbb.exe 103 PID 448 wrote to memory of 2880 448 tbhhbb.exe 103 PID 2880 wrote to memory of 1624 2880 pdvpp.exe 105 PID 2880 wrote to memory of 1624 2880 pdvpp.exe 105 PID 2880 wrote to memory of 1624 2880 pdvpp.exe 105 PID 1624 wrote to memory of 932 1624 xrxrfll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c88d7ac2412af2e37130d392b078a7e0N.exe"C:\Users\Admin\AppData\Local\Temp\c88d7ac2412af2e37130d392b078a7e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\lflllll.exec:\lflllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\bhhbbt.exec:\bhhbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\dpdvp.exec:\dpdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\9djdv.exec:\9djdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\rxffrff.exec:\rxffrff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bthnnb.exec:\bthnnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\tnttnn.exec:\tnttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dvdvp.exec:\dvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\xlxrlxx.exec:\xlxrlxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\lrlrrlr.exec:\lrlrrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\tthhnn.exec:\tthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\7nbthh.exec:\7nbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\7vdvp.exec:\7vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\lxffflf.exec:\lxffflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\rlllllf.exec:\rlllllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\bnbbtt.exec:\bnbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\dddvp.exec:\dddvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\7lrrxfl.exec:\7lrrxfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\tbhhbb.exec:\tbhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pdvpp.exec:\pdvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xrxrfll.exec:\xrxrfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\tnbbhh.exec:\tnbbhh.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\bthbtt.exec:\bthbtt.exe24⤵
- Executes dropped EXE
PID:4616 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe25⤵
- Executes dropped EXE
PID:2604 -
\??\c:\bnnhbb.exec:\bnnhbb.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pddpj.exec:\pddpj.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vvjjv.exec:\vvjjv.exe28⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rlrlfxx.exec:\rlrlfxx.exe29⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbnhtn.exec:\hbnhtn.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\jpjvd.exec:\jpjvd.exe31⤵
- Executes dropped EXE
PID:3576 -
\??\c:\pppjv.exec:\pppjv.exe32⤵
- Executes dropped EXE
PID:4464 -
\??\c:\lfffxxx.exec:\lfffxxx.exe33⤵
- Executes dropped EXE
PID:3876 -
\??\c:\3hnnnn.exec:\3hnnnn.exe34⤵
- Executes dropped EXE
PID:552 -
\??\c:\dddvp.exec:\dddvp.exe35⤵
- Executes dropped EXE
PID:4764 -
\??\c:\vppjd.exec:\vppjd.exe36⤵
- Executes dropped EXE
PID:3652 -
\??\c:\rfxlrfr.exec:\rfxlrfr.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\tbhntt.exec:\tbhntt.exe38⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bntttb.exec:\bntttb.exe39⤵
- Executes dropped EXE
PID:4268 -
\??\c:\dvjdd.exec:\dvjdd.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe41⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nhnnhh.exec:\nhnnhh.exe42⤵
- Executes dropped EXE
PID:312 -
\??\c:\thbtnh.exec:\thbtnh.exe43⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jppjv.exec:\jppjv.exe44⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5rffxlx.exec:\5rffxlx.exe45⤵
- Executes dropped EXE
PID:4588 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe46⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tnttnn.exec:\tnttnn.exe47⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bbhhbh.exec:\bbhhbh.exe48⤵
- Executes dropped EXE
PID:4916 -
\??\c:\dvjjd.exec:\dvjjd.exe49⤵
- Executes dropped EXE
PID:708 -
\??\c:\lfflxxf.exec:\lfflxxf.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3xfxrrf.exec:\3xfxrrf.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hhtnhh.exec:\hhtnhh.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\btntnh.exec:\btntnh.exe53⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jddvd.exec:\jddvd.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1316 -
\??\c:\3ddvp.exec:\3ddvp.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\flrlxxl.exec:\flrlxxl.exe56⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fxflxff.exec:\fxflxff.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9hnnhh.exec:\9hnnhh.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\3ntnnn.exec:\3ntnnn.exe59⤵
- Executes dropped EXE
PID:1212 -
\??\c:\vjdvj.exec:\vjdvj.exe60⤵
- Executes dropped EXE
PID:2524 -
\??\c:\djjdp.exec:\djjdp.exe61⤵
- Executes dropped EXE
PID:4544 -
\??\c:\frlfxxr.exec:\frlfxxr.exe62⤵
- Executes dropped EXE
PID:2652 -
\??\c:\llrrfll.exec:\llrrfll.exe63⤵
- Executes dropped EXE
PID:3924 -
\??\c:\thtnbb.exec:\thtnbb.exe64⤵
- Executes dropped EXE
PID:4932 -
\??\c:\thnnbh.exec:\thnnbh.exe65⤵
- Executes dropped EXE
PID:4500 -
\??\c:\djddd.exec:\djddd.exe66⤵PID:5036
-
\??\c:\llxfxrf.exec:\llxfxrf.exe67⤵PID:2440
-
\??\c:\1frxxxr.exec:\1frxxxr.exe68⤵PID:2768
-
\??\c:\thhthb.exec:\thhthb.exe69⤵PID:4316
-
\??\c:\nhbtnt.exec:\nhbtnt.exe70⤵PID:4000
-
\??\c:\5vjvd.exec:\5vjvd.exe71⤵PID:4968
-
\??\c:\dvpjj.exec:\dvpjj.exe72⤵PID:2544
-
\??\c:\lfxrllf.exec:\lfxrllf.exe73⤵PID:2976
-
\??\c:\nhnhhh.exec:\nhnhhh.exe74⤵PID:64
-
\??\c:\nthbtt.exec:\nthbtt.exe75⤵PID:1276
-
\??\c:\jvdjd.exec:\jvdjd.exe76⤵PID:628
-
\??\c:\llrlffx.exec:\llrlffx.exe77⤵PID:2404
-
\??\c:\nhbtnt.exec:\nhbtnt.exe78⤵PID:3444
-
\??\c:\nhhbtn.exec:\nhhbtn.exe79⤵PID:452
-
\??\c:\jvvvp.exec:\jvvvp.exe80⤵PID:1764
-
\??\c:\lxfxllx.exec:\lxfxllx.exe81⤵PID:4836
-
\??\c:\nbbtnb.exec:\nbbtnb.exe82⤵PID:1164
-
\??\c:\9hhbtn.exec:\9hhbtn.exe83⤵PID:2036
-
\??\c:\ppdvd.exec:\ppdvd.exe84⤵PID:2080
-
\??\c:\7dpjv.exec:\7dpjv.exe85⤵PID:2040
-
\??\c:\1xlfffx.exec:\1xlfffx.exe86⤵PID:3400
-
\??\c:\hhbbbb.exec:\hhbbbb.exe87⤵PID:464
-
\??\c:\pdpjd.exec:\pdpjd.exe88⤵PID:4404
-
\??\c:\rlfffll.exec:\rlfffll.exe89⤵PID:860
-
\??\c:\9ntnht.exec:\9ntnht.exe90⤵PID:1220
-
\??\c:\bhbtnb.exec:\bhbtnb.exe91⤵PID:3876
-
\??\c:\rrlrlll.exec:\rrlrlll.exe92⤵PID:1872
-
\??\c:\7tnnhh.exec:\7tnnhh.exe93⤵PID:1352
-
\??\c:\hnbthh.exec:\hnbthh.exe94⤵PID:1896
-
\??\c:\7pdpd.exec:\7pdpd.exe95⤵PID:4100
-
\??\c:\xllxrrf.exec:\xllxrrf.exe96⤵PID:4268
-
\??\c:\1rxxrxx.exec:\1rxxrxx.exe97⤵PID:4424
-
\??\c:\bntnhh.exec:\bntnhh.exe98⤵PID:4428
-
\??\c:\pdpjp.exec:\pdpjp.exe99⤵PID:4244
-
\??\c:\lfrlffx.exec:\lfrlffx.exe100⤵PID:2216
-
\??\c:\5lrlllr.exec:\5lrlllr.exe101⤵PID:1372
-
\??\c:\xxxrxlr.exec:\xxxrxlr.exe102⤵PID:4360
-
\??\c:\tnhhbb.exec:\tnhhbb.exe103⤵PID:4964
-
\??\c:\jjjdp.exec:\jjjdp.exe104⤵PID:4384
-
\??\c:\dddvv.exec:\dddvv.exe105⤵PID:1596
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe106⤵PID:2268
-
\??\c:\lrxxllr.exec:\lrxxllr.exe107⤵PID:3656
-
\??\c:\9ntnhn.exec:\9ntnhn.exe108⤵PID:2704
-
\??\c:\ddjjv.exec:\ddjjv.exe109⤵PID:3380
-
\??\c:\1vppj.exec:\1vppj.exe110⤵PID:1540
-
\??\c:\xrxxxrl.exec:\xrxxxrl.exe111⤵PID:3236
-
\??\c:\5ntnhn.exec:\5ntnhn.exe112⤵PID:4136
-
\??\c:\hhnhhb.exec:\hhnhhb.exe113⤵PID:3280
-
\??\c:\pjpdv.exec:\pjpdv.exe114⤵PID:2384
-
\??\c:\pdvpp.exec:\pdvpp.exe115⤵PID:1860
-
\??\c:\llrlffx.exec:\llrlffx.exe116⤵PID:4760
-
\??\c:\3fxxrrl.exec:\3fxxrrl.exe117⤵PID:4452
-
\??\c:\ntbbbt.exec:\ntbbbt.exe118⤵PID:5064
-
\??\c:\thnhbb.exec:\thnhbb.exe119⤵PID:1532
-
\??\c:\7dpjd.exec:\7dpjd.exe120⤵PID:3884
-
\??\c:\jddvd.exec:\jddvd.exe121⤵PID:1584
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-