Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21/09/2024, 17:03
Static task
static1
Behavioral task
behavioral1
Sample
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe
Resource
win7-20240729-en
General
-
Target
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe
-
Size
332KB
-
MD5
9e8a754c309363f8123e7e44134888d0
-
SHA1
7ae09b09628a175377cf19f8bd1cd1943ab8f593
-
SHA256
368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65e
-
SHA512
a28640056203f869e52d6990db7da2890234a5ece87b6924b4ee8ffeb17233862f82d31f9479d2f31bce194b908fae91ac9c43b41292b06efd2d76a42a9306f2
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhJ:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTZ
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-1098-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-1102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2824 bhhnbh.exe 5048 9jpvj.exe 4860 rrllxll.exe 824 nnbtnn.exe 3768 lflrlrx.exe 3816 ppjjv.exe 1776 rllfxrf.exe 3924 thhhbt.exe 2112 rfxlxrf.exe 1528 btnbtt.exe 624 flfxrxr.exe 1116 3hhbth.exe 980 rlrlfrl.exe 2688 vvdvp.exe 2488 xrflfxr.exe 2620 rrxrfrl.exe 4588 dpdvp.exe 2240 rxlxlrx.exe 2632 pjjdd.exe 2760 lfflfxr.exe 3536 bthhtn.exe 3172 pjjvv.exe 4328 1fffxxr.exe 4252 pjpjj.exe 4044 vjdjv.exe 60 7rlxlfr.exe 636 pjpdv.exe 3000 bnhbtn.exe 2104 dvpjv.exe 4360 ffffrxl.exe 4720 9jdvd.exe 3700 pjjdv.exe 4936 tntnhb.exe 436 dpvpj.exe 1896 lrlrrfl.exe 4940 llxflxf.exe 4064 nbhbtt.exe 4928 vjdvp.exe 4908 9vvpp.exe 4264 lxxfxlr.exe 4864 ntnhbh.exe 3576 pdddp.exe 668 frfxrrr.exe 3520 xlrfxrf.exe 2996 htnhhh.exe 4444 vvpdv.exe 3500 xrrrllf.exe 212 tnbtbn.exe 4232 thhbtn.exe 4976 pjdvj.exe 2228 1llfrlf.exe 640 btnhnn.exe 4136 hnnhtb.exe 4844 vpjdv.exe 1980 xrrlffx.exe 1104 lrxrlfx.exe 3300 3bnbtn.exe 3556 5djjj.exe 1396 9vvjd.exe 3696 1xrlxxr.exe 2848 9thnbt.exe 4172 pddpd.exe 624 dvddd.exe 1232 lfxrffx.exe -
resource yara_rule behavioral2/memory/3016-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4328-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/556-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3016 wrote to memory of 2824 3016 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 82 PID 3016 wrote to memory of 2824 3016 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 82 PID 3016 wrote to memory of 2824 3016 368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe 82 PID 2824 wrote to memory of 5048 2824 bhhnbh.exe 83 PID 2824 wrote to memory of 5048 2824 bhhnbh.exe 83 PID 2824 wrote to memory of 5048 2824 bhhnbh.exe 83 PID 5048 wrote to memory of 4860 5048 9jpvj.exe 84 PID 5048 wrote to memory of 4860 5048 9jpvj.exe 84 PID 5048 wrote to memory of 4860 5048 9jpvj.exe 84 PID 4860 wrote to memory of 824 4860 rrllxll.exe 85 PID 4860 wrote to memory of 824 4860 rrllxll.exe 85 PID 4860 wrote to memory of 824 4860 rrllxll.exe 85 PID 824 wrote to memory of 3768 824 nnbtnn.exe 86 PID 824 wrote to memory of 3768 824 nnbtnn.exe 86 PID 824 wrote to memory of 3768 824 nnbtnn.exe 86 PID 3768 wrote to memory of 3816 3768 lflrlrx.exe 87 PID 3768 wrote to memory of 3816 3768 lflrlrx.exe 87 PID 3768 wrote to memory of 3816 3768 lflrlrx.exe 87 PID 3816 wrote to memory of 1776 3816 ppjjv.exe 88 PID 3816 wrote to memory of 1776 3816 ppjjv.exe 88 PID 3816 wrote to memory of 1776 3816 ppjjv.exe 88 PID 1776 wrote to memory of 3924 1776 rllfxrf.exe 89 PID 1776 wrote to memory of 3924 1776 rllfxrf.exe 89 PID 1776 wrote to memory of 3924 1776 rllfxrf.exe 89 PID 3924 wrote to memory of 2112 3924 thhhbt.exe 90 PID 3924 wrote to memory of 2112 3924 thhhbt.exe 90 PID 3924 wrote to memory of 2112 3924 thhhbt.exe 90 PID 2112 wrote to memory of 1528 2112 rfxlxrf.exe 91 PID 2112 wrote to memory of 1528 2112 rfxlxrf.exe 91 PID 2112 wrote to memory of 1528 2112 rfxlxrf.exe 91 PID 1528 wrote to memory of 624 1528 btnbtt.exe 92 PID 1528 wrote to memory of 624 1528 btnbtt.exe 92 PID 1528 wrote to memory of 624 1528 btnbtt.exe 92 PID 624 wrote to memory of 1116 624 flfxrxr.exe 93 PID 624 wrote to memory of 1116 624 flfxrxr.exe 93 PID 624 wrote to memory of 1116 624 flfxrxr.exe 93 PID 1116 wrote to memory of 980 1116 3hhbth.exe 94 PID 1116 wrote to memory of 980 1116 3hhbth.exe 94 PID 1116 wrote to memory of 980 1116 3hhbth.exe 94 PID 980 wrote to memory of 2688 980 rlrlfrl.exe 95 PID 980 wrote to memory of 2688 980 rlrlfrl.exe 95 PID 980 wrote to memory of 2688 980 rlrlfrl.exe 95 PID 2688 wrote to memory of 2488 2688 vvdvp.exe 96 PID 2688 wrote to memory of 2488 2688 vvdvp.exe 96 PID 2688 wrote to memory of 2488 2688 vvdvp.exe 96 PID 2488 wrote to memory of 2620 2488 xrflfxr.exe 97 PID 2488 wrote to memory of 2620 2488 xrflfxr.exe 97 PID 2488 wrote to memory of 2620 2488 xrflfxr.exe 97 PID 2620 wrote to memory of 4588 2620 rrxrfrl.exe 98 PID 2620 wrote to memory of 4588 2620 rrxrfrl.exe 98 PID 2620 wrote to memory of 4588 2620 rrxrfrl.exe 98 PID 4588 wrote to memory of 2240 4588 dpdvp.exe 99 PID 4588 wrote to memory of 2240 4588 dpdvp.exe 99 PID 4588 wrote to memory of 2240 4588 dpdvp.exe 99 PID 2240 wrote to memory of 2632 2240 rxlxlrx.exe 100 PID 2240 wrote to memory of 2632 2240 rxlxlrx.exe 100 PID 2240 wrote to memory of 2632 2240 rxlxlrx.exe 100 PID 2632 wrote to memory of 2760 2632 pjjdd.exe 101 PID 2632 wrote to memory of 2760 2632 pjjdd.exe 101 PID 2632 wrote to memory of 2760 2632 pjjdd.exe 101 PID 2760 wrote to memory of 3536 2760 lfflfxr.exe 102 PID 2760 wrote to memory of 3536 2760 lfflfxr.exe 102 PID 2760 wrote to memory of 3536 2760 lfflfxr.exe 102 PID 3536 wrote to memory of 3172 3536 bthhtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe"C:\Users\Admin\AppData\Local\Temp\368dccce20b264ff0341b13aff5b755866237fb089ed21efabd784066c5dc65eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bhhnbh.exec:\bhhnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9jpvj.exec:\9jpvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\rrllxll.exec:\rrllxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\nnbtnn.exec:\nnbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\lflrlrx.exec:\lflrlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\ppjjv.exec:\ppjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\rllfxrf.exec:\rllfxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\thhhbt.exec:\thhhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\btnbtt.exec:\btnbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\flfxrxr.exec:\flfxrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\3hhbth.exec:\3hhbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\rlrlfrl.exec:\rlrlfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\vvdvp.exec:\vvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xrflfxr.exec:\xrflfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rrxrfrl.exec:\rrxrfrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\dpdvp.exec:\dpdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\rxlxlrx.exec:\rxlxlrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\pjjdd.exec:\pjjdd.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lfflfxr.exec:\lfflfxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bthhtn.exec:\bthhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\pjjvv.exec:\pjjvv.exe23⤵
- Executes dropped EXE
PID:3172 -
\??\c:\1fffxxr.exec:\1fffxxr.exe24⤵
- Executes dropped EXE
PID:4328 -
\??\c:\pjpjj.exec:\pjpjj.exe25⤵
- Executes dropped EXE
PID:4252 -
\??\c:\vjdjv.exec:\vjdjv.exe26⤵
- Executes dropped EXE
PID:4044 -
\??\c:\7rlxlfr.exec:\7rlxlfr.exe27⤵
- Executes dropped EXE
PID:60 -
\??\c:\pjpdv.exec:\pjpdv.exe28⤵
- Executes dropped EXE
PID:636 -
\??\c:\bnhbtn.exec:\bnhbtn.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\dvpjv.exec:\dvpjv.exe30⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ffffrxl.exec:\ffffrxl.exe31⤵
- Executes dropped EXE
PID:4360 -
\??\c:\9jdvd.exec:\9jdvd.exe32⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:3700 -
\??\c:\tntnhb.exec:\tntnhb.exe34⤵
- Executes dropped EXE
PID:4936 -
\??\c:\dpvpj.exec:\dpvpj.exe35⤵
- Executes dropped EXE
PID:436 -
\??\c:\lrlrrfl.exec:\lrlrrfl.exe36⤵
- Executes dropped EXE
PID:1896 -
\??\c:\llxflxf.exec:\llxflxf.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nbhbtt.exec:\nbhbtt.exe38⤵
- Executes dropped EXE
PID:4064 -
\??\c:\vjdvp.exec:\vjdvp.exe39⤵
- Executes dropped EXE
PID:4928 -
\??\c:\9vvpp.exec:\9vvpp.exe40⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lxxfxlr.exec:\lxxfxlr.exe41⤵
- Executes dropped EXE
PID:4264 -
\??\c:\ntnhbh.exec:\ntnhbh.exe42⤵
- Executes dropped EXE
PID:4864 -
\??\c:\pdddp.exec:\pdddp.exe43⤵
- Executes dropped EXE
PID:3576 -
\??\c:\frfxrrr.exec:\frfxrrr.exe44⤵
- Executes dropped EXE
PID:668 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe45⤵
- Executes dropped EXE
PID:3520 -
\??\c:\htnhhh.exec:\htnhhh.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vvpdv.exec:\vvpdv.exe47⤵
- Executes dropped EXE
PID:4444 -
\??\c:\xrrrllf.exec:\xrrrllf.exe48⤵
- Executes dropped EXE
PID:3500 -
\??\c:\tnbtbn.exec:\tnbtbn.exe49⤵
- Executes dropped EXE
PID:212 -
\??\c:\thhbtn.exec:\thhbtn.exe50⤵
- Executes dropped EXE
PID:4232 -
\??\c:\pjdvj.exec:\pjdvj.exe51⤵
- Executes dropped EXE
PID:4976 -
\??\c:\1llfrlf.exec:\1llfrlf.exe52⤵
- Executes dropped EXE
PID:2228 -
\??\c:\btnhnn.exec:\btnhnn.exe53⤵
- Executes dropped EXE
PID:640 -
\??\c:\hnnhtb.exec:\hnnhtb.exe54⤵
- Executes dropped EXE
PID:4136 -
\??\c:\vpjdv.exec:\vpjdv.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\xrrlffx.exec:\xrrlffx.exe56⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe57⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3bnbtn.exec:\3bnbtn.exe58⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5djjj.exec:\5djjj.exe59⤵
- Executes dropped EXE
PID:3556 -
\??\c:\9vvjd.exec:\9vvjd.exe60⤵
- Executes dropped EXE
PID:1396 -
\??\c:\1xrlxxr.exec:\1xrlxxr.exe61⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9thnbt.exec:\9thnbt.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pddpd.exec:\pddpd.exe63⤵
- Executes dropped EXE
PID:4172 -
\??\c:\dvddd.exec:\dvddd.exe64⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfxrffx.exec:\lfxrffx.exe65⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tbbtnh.exec:\tbbtnh.exe66⤵PID:4336
-
\??\c:\vpppd.exec:\vpppd.exe67⤵PID:940
-
\??\c:\dvvvv.exec:\dvvvv.exe68⤵PID:980
-
\??\c:\9xxrlff.exec:\9xxrlff.exe69⤵PID:4380
-
\??\c:\bhhbtn.exec:\bhhbtn.exe70⤵PID:4708
-
\??\c:\dvddv.exec:\dvddv.exe71⤵PID:2692
-
\??\c:\fxxxlfl.exec:\fxxxlfl.exe72⤵
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\bttnhb.exec:\bttnhb.exe73⤵PID:1484
-
\??\c:\ttntnt.exec:\ttntnt.exe74⤵PID:1008
-
\??\c:\jdvvp.exec:\jdvvp.exe75⤵PID:4588
-
\??\c:\xxffxfx.exec:\xxffxfx.exe76⤵PID:1404
-
\??\c:\rrrlffx.exec:\rrrlffx.exe77⤵PID:3468
-
\??\c:\1bbtnh.exec:\1bbtnh.exe78⤵PID:4956
-
\??\c:\vjjjv.exec:\vjjjv.exe79⤵PID:3196
-
\??\c:\vjdpj.exec:\vjdpj.exe80⤵PID:1032
-
\??\c:\rllxrfx.exec:\rllxrfx.exe81⤵PID:3536
-
\??\c:\ntthhh.exec:\ntthhh.exe82⤵PID:4920
-
\??\c:\1hbthh.exec:\1hbthh.exe83⤵PID:804
-
\??\c:\vjpjj.exec:\vjpjj.exe84⤵PID:4780
-
\??\c:\fxrlllr.exec:\fxrlllr.exe85⤵PID:1956
-
\??\c:\hthbbh.exec:\hthbbh.exe86⤵PID:3612
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe87⤵PID:4732
-
\??\c:\nhhhbh.exec:\nhhhbh.exe88⤵PID:4424
-
\??\c:\pdjvp.exec:\pdjvp.exe89⤵PID:1220
-
\??\c:\flxlrlf.exec:\flxlrlf.exe90⤵PID:3236
-
\??\c:\nhtnhn.exec:\nhtnhn.exe91⤵PID:1368
-
\??\c:\1hhbtn.exec:\1hhbtn.exe92⤵PID:800
-
\??\c:\dpvpp.exec:\dpvpp.exe93⤵PID:968
-
\??\c:\9rlfffx.exec:\9rlfffx.exe94⤵PID:3108
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe95⤵PID:3664
-
\??\c:\nhthnh.exec:\nhthnh.exe96⤵PID:1440
-
\??\c:\djvpj.exec:\djvpj.exe97⤵PID:1820
-
\??\c:\rlrlrxr.exec:\rlrlrxr.exe98⤵PID:4080
-
\??\c:\1xrrlll.exec:\1xrrlll.exe99⤵PID:3760
-
\??\c:\bbbnhh.exec:\bbbnhh.exe100⤵PID:1720
-
\??\c:\vpppj.exec:\vpppj.exe101⤵PID:3936
-
\??\c:\djvjp.exec:\djvjp.exe102⤵PID:4164
-
\??\c:\xflfxrr.exec:\xflfxrr.exe103⤵PID:3040
-
\??\c:\3nttnn.exec:\3nttnn.exe104⤵PID:3744
-
\??\c:\vpvpj.exec:\vpvpj.exe105⤵PID:5108
-
\??\c:\pjdvv.exec:\pjdvv.exe106⤵PID:1384
-
\??\c:\xxrxflx.exec:\xxrxflx.exe107⤵PID:2708
-
\??\c:\7ttnhh.exec:\7ttnhh.exe108⤵PID:3424
-
\??\c:\hnbttb.exec:\hnbttb.exe109⤵PID:2404
-
\??\c:\1jvpj.exec:\1jvpj.exe110⤵PID:2976
-
\??\c:\rxfrflf.exec:\rxfrflf.exe111⤵PID:1272
-
\??\c:\hnntnh.exec:\hnntnh.exe112⤵PID:1812
-
\??\c:\3btnnn.exec:\3btnnn.exe113⤵PID:4312
-
\??\c:\dvjdd.exec:\dvjdd.exe114⤵PID:3288
-
\??\c:\vdjpj.exec:\vdjpj.exe115⤵PID:232
-
\??\c:\3xrffrr.exec:\3xrffrr.exe116⤵PID:2592
-
\??\c:\lfrrllf.exec:\lfrrllf.exe117⤵PID:3876
-
\??\c:\tbhtnb.exec:\tbhtnb.exe118⤵PID:2432
-
\??\c:\jpddv.exec:\jpddv.exe119⤵PID:4636
-
\??\c:\lffxlll.exec:\lffxlll.exe120⤵PID:4136
-
\??\c:\nnhtbt.exec:\nnhtbt.exe121⤵PID:4980
-
\??\c:\htbnhh.exec:\htbnhh.exe122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-