Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 01:57
Behavioral task
behavioral1
Sample
c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe
-
Size
367KB
-
MD5
bbf4041171bca5e329ba59279508b9e6
-
SHA1
61d7616669cabd72a5dcdabc34c05870690f475b
-
SHA256
c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35
-
SHA512
ebf67bfcae114b5de4c1c9e155ea719ea5eed5db49b19bb209990e49b4e2702e02366f136748b0979679bda0bbdf71d08c08f98eea79f9938c3b201898b5f4cc
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE8S:/4wFHoSQuxy3rTXIM18S
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4396-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/32-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4028-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-414-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2708-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-910-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-1391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-1531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 5lrlllf.exe 1392 nthhnt.exe 1420 vjdvv.exe 2448 vddvv.exe 1928 hbhhbn.exe 2948 vvpvd.exe 4236 bbttth.exe 5096 jddjj.exe 3636 fxffxff.exe 3944 pvvvv.exe 4884 xlxrrrl.exe 1800 1lrrrxx.exe 2440 3xlflrr.exe 1404 djvjj.exe 3024 vvvvp.exe 1956 nhhhhn.exe 4564 pjjjj.exe 3096 xlllffl.exe 4608 tnbtnn.exe 3360 jdppj.exe 2304 1xrllff.exe 1248 vpjpp.exe 756 pjjjd.exe 4088 xrrlfff.exe 4412 hthhhn.exe 3668 9pvpp.exe 4040 9hnntn.exe 2720 9pvpj.exe 2052 lllfxxx.exe 1232 pvddd.exe 3784 9lffflr.exe 4284 3dvvv.exe 3372 ffrllfx.exe 1084 1bbnhb.exe 3448 pvjjj.exe 3960 5ppjj.exe 1500 lxfflxx.exe 4288 nthhbh.exe 2192 vpppj.exe 3932 9lffxxr.exe 4552 tbhhbh.exe 436 ttnnhn.exe 8 dvvpj.exe 4332 vpvvv.exe 5080 xflfxxr.exe 3652 nnhbbt.exe 2652 hnnnhh.exe 452 vppjd.exe 532 frfxrrr.exe 3648 fxfxxrl.exe 4424 3bttnn.exe 2428 dvpjd.exe 4488 vdpjd.exe 3848 lfxxrrl.exe 3036 bthnht.exe 628 vvjdp.exe 428 vdddj.exe 3952 llllfff.exe 2448 1rxxrfx.exe 3404 bbhbtb.exe 4432 7dvpj.exe 4504 xlllrrr.exe 4236 frxxrrl.exe 4872 5ntnhh.exe -
resource yara_rule behavioral2/memory/4396-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000234ca-3.dat upx behavioral2/memory/4396-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234de-10.dat upx behavioral2/memory/2856-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1392-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234df-12.dat upx behavioral2/memory/1420-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e0-21.dat upx behavioral2/files/0x00070000000234e1-28.dat upx behavioral2/files/0x00070000000234e2-31.dat upx behavioral2/files/0x00070000000234e3-37.dat upx behavioral2/files/0x00070000000234e4-41.dat upx behavioral2/files/0x00070000000234e5-46.dat upx behavioral2/memory/5096-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e6-52.dat upx behavioral2/memory/3944-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e7-59.dat upx behavioral2/memory/4884-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4884-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e8-67.dat upx behavioral2/memory/1800-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234e9-73.dat upx behavioral2/files/0x00070000000234ea-77.dat upx behavioral2/memory/2440-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234eb-83.dat upx behavioral2/files/0x00080000000234db-90.dat upx behavioral2/memory/3024-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ed-94.dat upx behavioral2/memory/1956-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ee-101.dat upx behavioral2/memory/3096-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4564-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234ef-107.dat upx behavioral2/memory/4608-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f0-115.dat upx behavioral2/memory/3360-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f1-120.dat upx behavioral2/files/0x00070000000234f2-125.dat upx behavioral2/files/0x00070000000234f3-131.dat upx behavioral2/memory/756-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1248-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2304-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f4-138.dat upx behavioral2/memory/4088-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f5-143.dat upx behavioral2/memory/4088-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f6-149.dat upx behavioral2/memory/4412-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f7-156.dat upx behavioral2/memory/4040-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234f8-160.dat upx behavioral2/files/0x00070000000234f9-166.dat upx behavioral2/files/0x00070000000234fa-172.dat upx behavioral2/files/0x00070000000234fb-178.dat upx behavioral2/memory/1232-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000234fc-183.dat upx behavioral2/memory/3372-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1084-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1500-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4288-210-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2192-214-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4396 wrote to memory of 2856 4396 c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe 82 PID 4396 wrote to memory of 2856 4396 c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe 82 PID 4396 wrote to memory of 2856 4396 c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe 82 PID 2856 wrote to memory of 1392 2856 5lrlllf.exe 83 PID 2856 wrote to memory of 1392 2856 5lrlllf.exe 83 PID 2856 wrote to memory of 1392 2856 5lrlllf.exe 83 PID 1392 wrote to memory of 1420 1392 nthhnt.exe 84 PID 1392 wrote to memory of 1420 1392 nthhnt.exe 84 PID 1392 wrote to memory of 1420 1392 nthhnt.exe 84 PID 1420 wrote to memory of 2448 1420 vjdvv.exe 85 PID 1420 wrote to memory of 2448 1420 vjdvv.exe 85 PID 1420 wrote to memory of 2448 1420 vjdvv.exe 85 PID 2448 wrote to memory of 1928 2448 vddvv.exe 86 PID 2448 wrote to memory of 1928 2448 vddvv.exe 86 PID 2448 wrote to memory of 1928 2448 vddvv.exe 86 PID 1928 wrote to memory of 2948 1928 hbhhbn.exe 87 PID 1928 wrote to memory of 2948 1928 hbhhbn.exe 87 PID 1928 wrote to memory of 2948 1928 hbhhbn.exe 87 PID 2948 wrote to memory of 4236 2948 vvpvd.exe 88 PID 2948 wrote to memory of 4236 2948 vvpvd.exe 88 PID 2948 wrote to memory of 4236 2948 vvpvd.exe 88 PID 4236 wrote to memory of 5096 4236 bbttth.exe 89 PID 4236 wrote to memory of 5096 4236 bbttth.exe 89 PID 4236 wrote to memory of 5096 4236 bbttth.exe 89 PID 5096 wrote to memory of 3636 5096 jddjj.exe 90 PID 5096 wrote to memory of 3636 5096 jddjj.exe 90 PID 5096 wrote to memory of 3636 5096 jddjj.exe 90 PID 3636 wrote to memory of 3944 3636 fxffxff.exe 91 PID 3636 wrote to memory of 3944 3636 fxffxff.exe 91 PID 3636 wrote to memory of 3944 3636 fxffxff.exe 91 PID 3944 wrote to memory of 4884 3944 pvvvv.exe 92 PID 3944 wrote to memory of 4884 3944 pvvvv.exe 92 PID 3944 wrote to memory of 4884 3944 pvvvv.exe 92 PID 4884 wrote to memory of 1800 4884 xlxrrrl.exe 93 PID 4884 wrote to memory of 1800 4884 xlxrrrl.exe 93 PID 4884 wrote to memory of 1800 4884 xlxrrrl.exe 93 PID 1800 wrote to memory of 2440 1800 1lrrrxx.exe 94 PID 1800 wrote to memory of 2440 1800 1lrrrxx.exe 94 PID 1800 wrote to memory of 2440 1800 1lrrrxx.exe 94 PID 2440 wrote to memory of 1404 2440 3xlflrr.exe 95 PID 2440 wrote to memory of 1404 2440 3xlflrr.exe 95 PID 2440 wrote to memory of 1404 2440 3xlflrr.exe 95 PID 1404 wrote to memory of 3024 1404 djvjj.exe 96 PID 1404 wrote to memory of 3024 1404 djvjj.exe 96 PID 1404 wrote to memory of 3024 1404 djvjj.exe 96 PID 3024 wrote to memory of 1956 3024 vvvvp.exe 97 PID 3024 wrote to memory of 1956 3024 vvvvp.exe 97 PID 3024 wrote to memory of 1956 3024 vvvvp.exe 97 PID 1956 wrote to memory of 4564 1956 nhhhhn.exe 98 PID 1956 wrote to memory of 4564 1956 nhhhhn.exe 98 PID 1956 wrote to memory of 4564 1956 nhhhhn.exe 98 PID 4564 wrote to memory of 3096 4564 pjjjj.exe 99 PID 4564 wrote to memory of 3096 4564 pjjjj.exe 99 PID 4564 wrote to memory of 3096 4564 pjjjj.exe 99 PID 3096 wrote to memory of 4608 3096 xlllffl.exe 100 PID 3096 wrote to memory of 4608 3096 xlllffl.exe 100 PID 3096 wrote to memory of 4608 3096 xlllffl.exe 100 PID 4608 wrote to memory of 3360 4608 tnbtnn.exe 101 PID 4608 wrote to memory of 3360 4608 tnbtnn.exe 101 PID 4608 wrote to memory of 3360 4608 tnbtnn.exe 101 PID 3360 wrote to memory of 2304 3360 jdppj.exe 102 PID 3360 wrote to memory of 2304 3360 jdppj.exe 102 PID 3360 wrote to memory of 2304 3360 jdppj.exe 102 PID 2304 wrote to memory of 1248 2304 1xrllff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe"C:\Users\Admin\AppData\Local\Temp\c74448b2757dda856fae26f3bc86f639c5e509b42b28297787d19ca777ea7d35.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\5lrlllf.exec:\5lrlllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nthhnt.exec:\nthhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\vjdvv.exec:\vjdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\vddvv.exec:\vddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hbhhbn.exec:\hbhhbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\vvpvd.exec:\vvpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\bbttth.exec:\bbttth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\jddjj.exec:\jddjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\fxffxff.exec:\fxffxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\pvvvv.exec:\pvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\xlxrrrl.exec:\xlxrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\3xlflrr.exec:\3xlflrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\djvjj.exec:\djvjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\vvvvp.exec:\vvvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nhhhhn.exec:\nhhhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\pjjjj.exec:\pjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\xlllffl.exec:\xlllffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\tnbtnn.exec:\tnbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\jdppj.exec:\jdppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\1xrllff.exec:\1xrllff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\vpjpp.exec:\vpjpp.exe23⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjjjd.exec:\pjjjd.exe24⤵
- Executes dropped EXE
PID:756 -
\??\c:\xrrlfff.exec:\xrrlfff.exe25⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hthhhn.exec:\hthhhn.exe26⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9pvpp.exec:\9pvpp.exe27⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9hnntn.exec:\9hnntn.exe28⤵
- Executes dropped EXE
PID:4040 -
\??\c:\9pvpj.exec:\9pvpj.exe29⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lllfxxx.exec:\lllfxxx.exe30⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pvddd.exec:\pvddd.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\9lffflr.exec:\9lffflr.exe32⤵
- Executes dropped EXE
PID:3784 -
\??\c:\3dvvv.exec:\3dvvv.exe33⤵
- Executes dropped EXE
PID:4284 -
\??\c:\ffrllfx.exec:\ffrllfx.exe34⤵
- Executes dropped EXE
PID:3372 -
\??\c:\1bbnhb.exec:\1bbnhb.exe35⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pvjjj.exec:\pvjjj.exe36⤵
- Executes dropped EXE
PID:3448 -
\??\c:\5ppjj.exec:\5ppjj.exe37⤵
- Executes dropped EXE
PID:3960 -
\??\c:\lxfflxx.exec:\lxfflxx.exe38⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nthhbh.exec:\nthhbh.exe39⤵
- Executes dropped EXE
PID:4288 -
\??\c:\vpppj.exec:\vpppj.exe40⤵
- Executes dropped EXE
PID:2192 -
\??\c:\9lffxxr.exec:\9lffxxr.exe41⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tbhhbh.exec:\tbhhbh.exe42⤵
- Executes dropped EXE
PID:4552 -
\??\c:\ttnnhn.exec:\ttnnhn.exe43⤵
- Executes dropped EXE
PID:436 -
\??\c:\dvvpj.exec:\dvvpj.exe44⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpvvv.exec:\vpvvv.exe45⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xflfxxr.exec:\xflfxxr.exe46⤵
- Executes dropped EXE
PID:5080 -
\??\c:\nnhbbt.exec:\nnhbbt.exe47⤵
- Executes dropped EXE
PID:3652 -
\??\c:\hnnnhh.exec:\hnnnhh.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:452 -
\??\c:\frfxrrr.exec:\frfxrrr.exe50⤵
- Executes dropped EXE
PID:532 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe51⤵
- Executes dropped EXE
PID:3648 -
\??\c:\3bttnn.exec:\3bttnn.exe52⤵
- Executes dropped EXE
PID:4424 -
\??\c:\dvpjd.exec:\dvpjd.exe53⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vdpjd.exec:\vdpjd.exe54⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe55⤵
- Executes dropped EXE
PID:3848 -
\??\c:\bthnht.exec:\bthnht.exe56⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvjdp.exec:\vvjdp.exe57⤵
- Executes dropped EXE
PID:628 -
\??\c:\vdddj.exec:\vdddj.exe58⤵
- Executes dropped EXE
PID:428 -
\??\c:\llllfff.exec:\llllfff.exe59⤵
- Executes dropped EXE
PID:3952 -
\??\c:\1rxxrfx.exec:\1rxxrfx.exe60⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbhbtb.exec:\bbhbtb.exe61⤵
- Executes dropped EXE
PID:3404 -
\??\c:\7dvpj.exec:\7dvpj.exe62⤵
- Executes dropped EXE
PID:4432 -
\??\c:\xlllrrr.exec:\xlllrrr.exe63⤵
- Executes dropped EXE
PID:4504 -
\??\c:\frxxrrl.exec:\frxxrrl.exe64⤵
- Executes dropped EXE
PID:4236 -
\??\c:\5ntnhh.exec:\5ntnhh.exe65⤵
- Executes dropped EXE
PID:4872 -
\??\c:\vvdvj.exec:\vvdvj.exe66⤵PID:3604
-
\??\c:\jjddv.exec:\jjddv.exe67⤵PID:464
-
\??\c:\flrrrxx.exec:\flrrrxx.exe68⤵PID:32
-
\??\c:\7ffxrxr.exec:\7ffxrxr.exe69⤵PID:1060
-
\??\c:\nnnnhh.exec:\nnnnhh.exe70⤵PID:4028
-
\??\c:\jdjjv.exec:\jdjjv.exe71⤵PID:2012
-
\??\c:\fxrlfff.exec:\fxrlfff.exe72⤵PID:1492
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe73⤵PID:1964
-
\??\c:\1nttnn.exec:\1nttnn.exe74⤵PID:3080
-
\??\c:\thhhtt.exec:\thhhtt.exe75⤵PID:5012
-
\??\c:\pvjjv.exec:\pvjjv.exe76⤵PID:3336
-
\??\c:\rrllrrr.exec:\rrllrrr.exe77⤵PID:552
-
\??\c:\tnhnbn.exec:\tnhnbn.exe78⤵PID:2500
-
\??\c:\ppppp.exec:\ppppp.exe79⤵PID:116
-
\??\c:\pjpjj.exec:\pjpjj.exe80⤵PID:1396
-
\??\c:\lrllllx.exec:\lrllllx.exe81⤵PID:2308
-
\??\c:\9xffxxr.exec:\9xffxxr.exe82⤵PID:2304
-
\??\c:\3nbtnb.exec:\3nbtnb.exe83⤵PID:2432
-
\??\c:\dvddj.exec:\dvddj.exe84⤵PID:2644
-
\??\c:\9jppj.exec:\9jppj.exe85⤵PID:764
-
\??\c:\rlffllf.exec:\rlffllf.exe86⤵PID:756
-
\??\c:\tnnhbb.exec:\tnnhbb.exe87⤵PID:2676
-
\??\c:\9bhhbh.exec:\9bhhbh.exe88⤵PID:4280
-
\??\c:\9ppjd.exec:\9ppjd.exe89⤵PID:640
-
\??\c:\djdvp.exec:\djdvp.exe90⤵PID:3892
-
\??\c:\rllffff.exec:\rllffff.exe91⤵PID:4836
-
\??\c:\thnhhh.exec:\thnhhh.exe92⤵PID:3480
-
\??\c:\ntbbtt.exec:\ntbbtt.exe93⤵PID:3844
-
\??\c:\pdpdv.exec:\pdpdv.exe94⤵PID:2896
-
\??\c:\ddddp.exec:\ddddp.exe95⤵PID:824
-
\??\c:\xfxlfxf.exec:\xfxlfxf.exe96⤵PID:2316
-
\??\c:\bbhhhh.exec:\bbhhhh.exe97⤵PID:2668
-
\??\c:\hbhbtt.exec:\hbhbtt.exe98⤵PID:2280
-
\??\c:\dvdjd.exec:\dvdjd.exe99⤵PID:1528
-
\??\c:\5flfxfr.exec:\5flfxfr.exe100⤵PID:380
-
\??\c:\hbhhnn.exec:\hbhhnn.exe101⤵PID:1476
-
\??\c:\nnnnhh.exec:\nnnnhh.exe102⤵PID:1604
-
\??\c:\5jddv.exec:\5jddv.exe103⤵PID:3676
-
\??\c:\djpjd.exec:\djpjd.exe104⤵PID:1916
-
\??\c:\ffxrllf.exec:\ffxrllf.exe105⤵PID:3532
-
\??\c:\ntbbbb.exec:\ntbbbb.exe106⤵PID:2732
-
\??\c:\ddjdv.exec:\ddjdv.exe107⤵PID:2628
-
\??\c:\dddvp.exec:\dddvp.exe108⤵PID:4240
-
\??\c:\xrrfxlx.exec:\xrrfxlx.exe109⤵PID:2892
-
\??\c:\htbhhn.exec:\htbhhn.exe110⤵PID:3656
-
\??\c:\btnnnt.exec:\btnnnt.exe111⤵PID:4668
-
\??\c:\1pppd.exec:\1pppd.exe112⤵PID:624
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe113⤵PID:2708
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe114⤵PID:2748
-
\??\c:\nbnnnn.exec:\nbnnnn.exe115⤵PID:2816
-
\??\c:\jjjjv.exec:\jjjjv.exe116⤵PID:2788
-
\??\c:\lflfxrr.exec:\lflfxrr.exe117⤵PID:1200
-
\??\c:\rfrlllf.exec:\rfrlllf.exe118⤵PID:4424
-
\??\c:\hbhhbn.exec:\hbhhbn.exe119⤵PID:1980
-
\??\c:\vvddp.exec:\vvddp.exe120⤵PID:368
-
\??\c:\7lxfxll.exec:\7lxfxll.exe121⤵PID:1392
-
\??\c:\llrlfff.exec:\llrlfff.exe122⤵
- System Location Discovery: System Language Discovery
PID:1904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-