Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2024, 23:04
Behavioral task
behavioral1
Sample
d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe
Resource
win7-20240903-en
General
-
Target
d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe
-
Size
74KB
-
MD5
efb2dd41a951124058486c64fdcf1de0
-
SHA1
97561983602d12b2a2d8144c502174c232948d38
-
SHA256
d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4
-
SHA512
945ba8024b0133813fdc3da86da4bf0a12f0d209099c8b1030790740261dae53552775846bbad3aef0c03c792676b839468bc049ddc1c68ff9f6f608ebd619fc
-
SSDEEP
1536:vvQBeOGtrYS3srx93UBWfwC6Ggnouy8rrUxAqQDrzIksAtFOu:vhOmTsF93UYfwC6GIoutrAxAqU6AtFOu
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3708-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-886-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-1109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-1684-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3708 7thbtt.exe 2360 nhnhbb.exe 4792 jvvdv.exe 2612 rlxrrrr.exe 3100 tthbbb.exe 3304 9dddv.exe 1216 nnhtnn.exe 2524 djdjv.exe 880 5lffxxf.exe 216 tnhbbb.exe 3492 vjpjp.exe 1460 nbnnth.exe 1684 jjdvp.exe 1136 rllffxx.exe 3960 xrrxxrr.exe 2520 nhhbbb.exe 4400 vjjdd.exe 1424 3pdvp.exe 3712 frfxrrr.exe 3504 tbhnnn.exe 2112 jjjjd.exe 3092 pjppd.exe 3608 frrxrrr.exe 5080 thhnnn.exe 4948 vvvvv.exe 3404 djddv.exe 4148 rlrfllf.exe 2380 fxlfrrx.exe 736 bnnnhh.exe 4000 dppjd.exe 2252 vvpdp.exe 1444 rrrrfxl.exe 3288 hhtthh.exe 3908 3jpvv.exe 1040 xrffrfl.exe 3720 5bttbb.exe 464 tttthn.exe 4076 jdpvv.exe 4264 lfrlxfl.exe 4204 ttbbbt.exe 4724 hbthbn.exe 208 ppdpj.exe 4212 rrxrlxl.exe 4564 htbbtn.exe 5096 pdvpj.exe 4388 pjpjd.exe 3436 xxfxrfr.exe 4188 ntntbh.exe 3652 nnnntb.exe 3972 djvdp.exe 516 lfffxrr.exe 996 9xrrlfx.exe 4300 ntnnbn.exe 1980 pjjpp.exe 3304 jjjdp.exe 4656 llflxrl.exe 1704 tttttb.exe 2008 nnbbtt.exe 880 vvjvp.exe 3616 xrxffxx.exe 1320 httnhh.exe 700 7ttnbb.exe 2736 ddppd.exe 312 xrfxrlr.exe -
resource yara_rule behavioral2/memory/4292-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233b9-3.dat upx behavioral2/memory/3708-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4292-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002341a-10.dat upx behavioral2/files/0x000700000002341b-13.dat upx behavioral2/memory/2360-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-20.dat upx behavioral2/memory/4792-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2612-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-27.dat upx behavioral2/memory/3100-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-32.dat upx behavioral2/memory/3304-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-38.dat upx behavioral2/files/0x0007000000023421-43.dat upx behavioral2/memory/1216-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-50.dat upx behavioral2/memory/2524-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/880-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-56.dat upx behavioral2/files/0x0007000000023424-63.dat upx behavioral2/memory/216-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-69.dat upx behavioral2/memory/3492-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-73.dat upx behavioral2/memory/1460-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-79.dat upx behavioral2/files/0x0007000000023428-84.dat upx behavioral2/files/0x0007000000023429-89.dat upx behavioral2/files/0x000700000002342a-94.dat upx behavioral2/memory/2520-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4400-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-100.dat upx behavioral2/memory/1424-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-106.dat upx behavioral2/files/0x000700000002342d-113.dat upx behavioral2/files/0x000700000002342e-117.dat upx behavioral2/files/0x000700000002342f-121.dat upx behavioral2/memory/3092-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-129.dat upx behavioral2/memory/3608-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-134.dat upx behavioral2/files/0x0008000000023418-139.dat upx behavioral2/files/0x0007000000023432-144.dat upx behavioral2/memory/4948-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-151.dat upx behavioral2/files/0x0007000000023434-155.dat upx behavioral2/memory/4148-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-161.dat upx behavioral2/memory/2380-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-168.dat upx behavioral2/files/0x0007000000023438-172.dat upx behavioral2/files/0x0007000000023439-177.dat upx behavioral2/memory/1444-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1040-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3720-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4076-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4264-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4204-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4724-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/208-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-234-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4292 wrote to memory of 3708 4292 d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe 82 PID 4292 wrote to memory of 3708 4292 d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe 82 PID 4292 wrote to memory of 3708 4292 d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe 82 PID 3708 wrote to memory of 2360 3708 7thbtt.exe 83 PID 3708 wrote to memory of 2360 3708 7thbtt.exe 83 PID 3708 wrote to memory of 2360 3708 7thbtt.exe 83 PID 2360 wrote to memory of 4792 2360 nhnhbb.exe 84 PID 2360 wrote to memory of 4792 2360 nhnhbb.exe 84 PID 2360 wrote to memory of 4792 2360 nhnhbb.exe 84 PID 4792 wrote to memory of 2612 4792 jvvdv.exe 85 PID 4792 wrote to memory of 2612 4792 jvvdv.exe 85 PID 4792 wrote to memory of 2612 4792 jvvdv.exe 85 PID 2612 wrote to memory of 3100 2612 rlxrrrr.exe 86 PID 2612 wrote to memory of 3100 2612 rlxrrrr.exe 86 PID 2612 wrote to memory of 3100 2612 rlxrrrr.exe 86 PID 3100 wrote to memory of 3304 3100 tthbbb.exe 87 PID 3100 wrote to memory of 3304 3100 tthbbb.exe 87 PID 3100 wrote to memory of 3304 3100 tthbbb.exe 87 PID 3304 wrote to memory of 1216 3304 9dddv.exe 88 PID 3304 wrote to memory of 1216 3304 9dddv.exe 88 PID 3304 wrote to memory of 1216 3304 9dddv.exe 88 PID 1216 wrote to memory of 2524 1216 nnhtnn.exe 89 PID 1216 wrote to memory of 2524 1216 nnhtnn.exe 89 PID 1216 wrote to memory of 2524 1216 nnhtnn.exe 89 PID 2524 wrote to memory of 880 2524 djdjv.exe 90 PID 2524 wrote to memory of 880 2524 djdjv.exe 90 PID 2524 wrote to memory of 880 2524 djdjv.exe 90 PID 880 wrote to memory of 216 880 5lffxxf.exe 91 PID 880 wrote to memory of 216 880 5lffxxf.exe 91 PID 880 wrote to memory of 216 880 5lffxxf.exe 91 PID 216 wrote to memory of 3492 216 tnhbbb.exe 92 PID 216 wrote to memory of 3492 216 tnhbbb.exe 92 PID 216 wrote to memory of 3492 216 tnhbbb.exe 92 PID 3492 wrote to memory of 1460 3492 vjpjp.exe 93 PID 3492 wrote to memory of 1460 3492 vjpjp.exe 93 PID 3492 wrote to memory of 1460 3492 vjpjp.exe 93 PID 1460 wrote to memory of 1684 1460 nbnnth.exe 94 PID 1460 wrote to memory of 1684 1460 nbnnth.exe 94 PID 1460 wrote to memory of 1684 1460 nbnnth.exe 94 PID 1684 wrote to memory of 1136 1684 jjdvp.exe 95 PID 1684 wrote to memory of 1136 1684 jjdvp.exe 95 PID 1684 wrote to memory of 1136 1684 jjdvp.exe 95 PID 1136 wrote to memory of 3960 1136 rllffxx.exe 96 PID 1136 wrote to memory of 3960 1136 rllffxx.exe 96 PID 1136 wrote to memory of 3960 1136 rllffxx.exe 96 PID 3960 wrote to memory of 2520 3960 xrrxxrr.exe 97 PID 3960 wrote to memory of 2520 3960 xrrxxrr.exe 97 PID 3960 wrote to memory of 2520 3960 xrrxxrr.exe 97 PID 2520 wrote to memory of 4400 2520 nhhbbb.exe 98 PID 2520 wrote to memory of 4400 2520 nhhbbb.exe 98 PID 2520 wrote to memory of 4400 2520 nhhbbb.exe 98 PID 4400 wrote to memory of 1424 4400 vjjdd.exe 99 PID 4400 wrote to memory of 1424 4400 vjjdd.exe 99 PID 4400 wrote to memory of 1424 4400 vjjdd.exe 99 PID 1424 wrote to memory of 3712 1424 3pdvp.exe 100 PID 1424 wrote to memory of 3712 1424 3pdvp.exe 100 PID 1424 wrote to memory of 3712 1424 3pdvp.exe 100 PID 3712 wrote to memory of 3504 3712 frfxrrr.exe 101 PID 3712 wrote to memory of 3504 3712 frfxrrr.exe 101 PID 3712 wrote to memory of 3504 3712 frfxrrr.exe 101 PID 3504 wrote to memory of 2112 3504 tbhnnn.exe 102 PID 3504 wrote to memory of 2112 3504 tbhnnn.exe 102 PID 3504 wrote to memory of 2112 3504 tbhnnn.exe 102 PID 2112 wrote to memory of 3092 2112 jjjjd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe"C:\Users\Admin\AppData\Local\Temp\d84f195ae3a1834bc18a4c4419198aa7dc0dfb5c4003e2258c0671ea3f1efcb4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\7thbtt.exec:\7thbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\nhnhbb.exec:\nhnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jvvdv.exec:\jvvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\tthbbb.exec:\tthbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\9dddv.exec:\9dddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\nnhtnn.exec:\nnhtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\djdjv.exec:\djdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5lffxxf.exec:\5lffxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\tnhbbb.exec:\tnhbbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\vjpjp.exec:\vjpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\nbnnth.exec:\nbnnth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\jjdvp.exec:\jjdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rllffxx.exec:\rllffxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\xrrxxrr.exec:\xrrxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\nhhbbb.exec:\nhhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjjdd.exec:\vjjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\3pdvp.exec:\3pdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\frfxrrr.exec:\frfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\tbhnnn.exec:\tbhnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\jjjjd.exec:\jjjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\pjppd.exec:\pjppd.exe23⤵
- Executes dropped EXE
PID:3092 -
\??\c:\frrxrrr.exec:\frrxrrr.exe24⤵
- Executes dropped EXE
PID:3608 -
\??\c:\thhnnn.exec:\thhnnn.exe25⤵
- Executes dropped EXE
PID:5080 -
\??\c:\vvvvv.exec:\vvvvv.exe26⤵
- Executes dropped EXE
PID:4948 -
\??\c:\djddv.exec:\djddv.exe27⤵
- Executes dropped EXE
PID:3404 -
\??\c:\rlrfllf.exec:\rlrfllf.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnnnhh.exec:\bnnnhh.exe30⤵
- Executes dropped EXE
PID:736 -
\??\c:\dppjd.exec:\dppjd.exe31⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vvpdp.exec:\vvpdp.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rrrrfxl.exec:\rrrrfxl.exe33⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hhtthh.exec:\hhtthh.exe34⤵
- Executes dropped EXE
PID:3288 -
\??\c:\3jpvv.exec:\3jpvv.exe35⤵
- Executes dropped EXE
PID:3908 -
\??\c:\xrffrfl.exec:\xrffrfl.exe36⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5bttbb.exec:\5bttbb.exe37⤵
- Executes dropped EXE
PID:3720 -
\??\c:\tttthn.exec:\tttthn.exe38⤵
- Executes dropped EXE
PID:464 -
\??\c:\jdpvv.exec:\jdpvv.exe39⤵
- Executes dropped EXE
PID:4076 -
\??\c:\lfrlxfl.exec:\lfrlxfl.exe40⤵
- Executes dropped EXE
PID:4264 -
\??\c:\ttbbbt.exec:\ttbbbt.exe41⤵
- Executes dropped EXE
PID:4204 -
\??\c:\hbthbn.exec:\hbthbn.exe42⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ppdpj.exec:\ppdpj.exe43⤵
- Executes dropped EXE
PID:208 -
\??\c:\rrxrlxl.exec:\rrxrlxl.exe44⤵
- Executes dropped EXE
PID:4212 -
\??\c:\htbbtn.exec:\htbbtn.exe45⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pdvpj.exec:\pdvpj.exe46⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:4388 -
\??\c:\xxfxrfr.exec:\xxfxrfr.exe48⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ntntbh.exec:\ntntbh.exe49⤵
- Executes dropped EXE
PID:4188 -
\??\c:\nnnntb.exec:\nnnntb.exe50⤵
- Executes dropped EXE
PID:3652 -
\??\c:\djvdp.exec:\djvdp.exe51⤵
- Executes dropped EXE
PID:3972 -
\??\c:\lfffxrr.exec:\lfffxrr.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:516 -
\??\c:\9xrrlfx.exec:\9xrrlfx.exe53⤵
- Executes dropped EXE
PID:996 -
\??\c:\ntnnbn.exec:\ntnnbn.exe54⤵
- Executes dropped EXE
PID:4300 -
\??\c:\pjjpp.exec:\pjjpp.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjjdp.exec:\jjjdp.exe56⤵
- Executes dropped EXE
PID:3304 -
\??\c:\llflxrl.exec:\llflxrl.exe57⤵
- Executes dropped EXE
PID:4656 -
\??\c:\tttttb.exec:\tttttb.exe58⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nnbbtt.exec:\nnbbtt.exe59⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vvjvp.exec:\vvjvp.exe60⤵
- Executes dropped EXE
PID:880 -
\??\c:\xrxffxx.exec:\xrxffxx.exe61⤵
- Executes dropped EXE
PID:3616 -
\??\c:\httnhh.exec:\httnhh.exe62⤵
- Executes dropped EXE
PID:1320 -
\??\c:\7ttnbb.exec:\7ttnbb.exe63⤵
- Executes dropped EXE
PID:700 -
\??\c:\ddppd.exec:\ddppd.exe64⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrfxrlr.exec:\xrfxrlr.exe65⤵
- Executes dropped EXE
PID:312 -
\??\c:\5lxlrlr.exec:\5lxlrlr.exe66⤵PID:3132
-
\??\c:\bbtbht.exec:\bbtbht.exe67⤵PID:3432
-
\??\c:\dpvpj.exec:\dpvpj.exe68⤵PID:448
-
\??\c:\tnbnhb.exec:\tnbnhb.exe69⤵PID:3224
-
\??\c:\vjvpp.exec:\vjvpp.exe70⤵PID:4956
-
\??\c:\9jjdp.exec:\9jjdp.exe71⤵PID:5084
-
\??\c:\frrlxrx.exec:\frrlxrx.exe72⤵PID:1960
-
\??\c:\bbbttn.exec:\bbbttn.exe73⤵PID:3680
-
\??\c:\5nhhtb.exec:\5nhhtb.exe74⤵PID:4252
-
\??\c:\pjpjp.exec:\pjpjp.exe75⤵PID:2284
-
\??\c:\vvvpj.exec:\vvvpj.exe76⤵PID:5092
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe77⤵PID:5012
-
\??\c:\5tttnn.exec:\5tttnn.exe78⤵PID:5068
-
\??\c:\btbtnn.exec:\btbtnn.exe79⤵PID:4772
-
\??\c:\9vvpj.exec:\9vvpj.exe80⤵PID:1768
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe81⤵PID:5040
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe82⤵PID:2616
-
\??\c:\httttb.exec:\httttb.exe83⤵PID:4004
-
\??\c:\djppd.exec:\djppd.exe84⤵PID:876
-
\??\c:\3llffxr.exec:\3llffxr.exe85⤵PID:2452
-
\??\c:\3flrrrx.exec:\3flrrrx.exe86⤵PID:440
-
\??\c:\nnhhbh.exec:\nnhhbh.exe87⤵PID:4000
-
\??\c:\bthhtb.exec:\bthhtb.exe88⤵PID:3220
-
\??\c:\jjjvd.exec:\jjjvd.exe89⤵PID:2348
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe90⤵PID:3160
-
\??\c:\rrxffxr.exec:\rrxffxr.exe91⤵PID:4460
-
\??\c:\hnbttn.exec:\hnbttn.exe92⤵PID:512
-
\??\c:\vdvpj.exec:\vdvpj.exe93⤵PID:4932
-
\??\c:\pvddv.exec:\pvddv.exe94⤵PID:4424
-
\??\c:\9vjdj.exec:\9vjdj.exe95⤵PID:3996
-
\??\c:\lllfxxr.exec:\lllfxxr.exe96⤵PID:4060
-
\??\c:\rxfrlrl.exec:\rxfrlrl.exe97⤵PID:728
-
\??\c:\nnttnh.exec:\nnttnh.exe98⤵PID:4204
-
\??\c:\bnnnnt.exec:\bnnnnt.exe99⤵PID:2308
-
\??\c:\pjvvv.exec:\pjvvv.exe100⤵PID:1168
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe101⤵PID:2384
-
\??\c:\frrffxr.exec:\frrffxr.exe102⤵PID:2864
-
\??\c:\7bnnhh.exec:\7bnnhh.exe103⤵PID:5096
-
\??\c:\vpvdj.exec:\vpvdj.exe104⤵PID:3032
-
\??\c:\ddjpd.exec:\ddjpd.exe105⤵PID:4184
-
\??\c:\jvvpd.exec:\jvvpd.exe106⤵PID:1920
-
\??\c:\flxlflf.exec:\flxlflf.exe107⤵PID:3968
-
\??\c:\xlfrflr.exec:\xlfrflr.exe108⤵PID:2564
-
\??\c:\tntbtb.exec:\tntbtb.exe109⤵PID:4944
-
\??\c:\tbhhhh.exec:\tbhhhh.exe110⤵PID:2908
-
\??\c:\jjddp.exec:\jjddp.exe111⤵PID:2108
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe112⤵PID:3088
-
\??\c:\lfllrxx.exec:\lfllrxx.exe113⤵PID:1980
-
\??\c:\nnbtbb.exec:\nnbtbb.exe114⤵PID:2876
-
\??\c:\9tnnhh.exec:\9tnnhh.exe115⤵PID:1416
-
\??\c:\jjpjv.exec:\jjpjv.exe116⤵PID:1704
-
\??\c:\vjjdv.exec:\vjjdv.exe117⤵PID:1680
-
\??\c:\fffxxrr.exec:\fffxxrr.exe118⤵PID:5088
-
\??\c:\vjdvd.exec:\vjdvd.exe119⤵PID:1692
-
\??\c:\lrlxfrr.exec:\lrlxfrr.exe120⤵PID:3148
-
\??\c:\flxxrrx.exec:\flxxrrx.exe121⤵PID:3536
-
\??\c:\htthbt.exec:\htthbt.exe122⤵PID:4800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-