Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 10:26
Static task
static1
Behavioral task
behavioral1
Sample
bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe
Resource
win7-20240903-en
General
-
Target
bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe
-
Size
452KB
-
MD5
f05369c59fe38bc7e4a79c7001736800
-
SHA1
0f2e6e5f0e124a6169c8080e3d4cc2168cd16479
-
SHA256
bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1e
-
SHA512
f4c67d4a98b68b959aeacb01bacf7aace978abc15ccfc48b21d1144adc960963e76527c6d660a3c5e22a55531c2a1f98ddc65eb4e722220a4b2b4e9a08163612
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2988-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1384-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1756-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-837-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-875-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-1398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1744 nbbbbb.exe 1440 ffxrrll.exe 3560 jjvdv.exe 2208 nhnnnt.exe 3372 xlffxrl.exe 2344 bnnhhh.exe 4620 jdppp.exe 3004 1htntb.exe 3048 dpjdd.exe 1712 nbhhhh.exe 3728 djpvv.exe 3852 rfllffr.exe 3548 lfrxfll.exe 2076 thbntn.exe 3780 pvpdv.exe 808 vjdjp.exe 4692 lrfxlfl.exe 4712 bnnhbb.exe 4760 jjdjv.exe 3196 fxlflfx.exe 1500 vdppv.exe 1040 tthnnn.exe 312 vpppp.exe 4640 xrlrxxf.exe 4504 nnbhht.exe 1172 xrxrrll.exe 3720 hbnnnt.exe 4008 xxlffxx.exe 2284 nttbbb.exe 5024 tnbtbh.exe 4112 ffffxlf.exe 4900 1nnbbn.exe 3240 nhbttb.exe 4844 9jvdv.exe 2020 hhhhhh.exe 3556 vjpjp.exe 400 lxlllll.exe 1428 vdjvd.exe 1920 jdddd.exe 3416 lrllfff.exe 3884 9nhnbb.exe 1952 vpjpv.exe 1244 flrrrxx.exe 2896 ttbhbb.exe 2336 9jdvj.exe 3264 lxxxxfx.exe 4932 bnhbnh.exe 2568 ddppp.exe 1416 rffxlll.exe 4464 hbbttb.exe 956 3bnhtb.exe 972 rxxllrf.exe 4248 xxrrfll.exe 1440 pppdd.exe 3948 9pjjp.exe 1996 rflxllf.exe 3252 thbhbt.exe 3372 ppppp.exe 2660 llxxxll.exe 4400 hbhhht.exe 2476 dpvpj.exe 1384 rrllllf.exe 3628 jvddj.exe 4284 xxxrllx.exe -
resource yara_rule behavioral2/memory/2988-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1384-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-871-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2988 wrote to memory of 1744 2988 bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe 81 PID 2988 wrote to memory of 1744 2988 bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe 81 PID 2988 wrote to memory of 1744 2988 bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe 81 PID 1744 wrote to memory of 1440 1744 nbbbbb.exe 82 PID 1744 wrote to memory of 1440 1744 nbbbbb.exe 82 PID 1744 wrote to memory of 1440 1744 nbbbbb.exe 82 PID 1440 wrote to memory of 3560 1440 ffxrrll.exe 83 PID 1440 wrote to memory of 3560 1440 ffxrrll.exe 83 PID 1440 wrote to memory of 3560 1440 ffxrrll.exe 83 PID 3560 wrote to memory of 2208 3560 jjvdv.exe 84 PID 3560 wrote to memory of 2208 3560 jjvdv.exe 84 PID 3560 wrote to memory of 2208 3560 jjvdv.exe 84 PID 2208 wrote to memory of 3372 2208 nhnnnt.exe 85 PID 2208 wrote to memory of 3372 2208 nhnnnt.exe 85 PID 2208 wrote to memory of 3372 2208 nhnnnt.exe 85 PID 3372 wrote to memory of 2344 3372 xlffxrl.exe 86 PID 3372 wrote to memory of 2344 3372 xlffxrl.exe 86 PID 3372 wrote to memory of 2344 3372 xlffxrl.exe 86 PID 2344 wrote to memory of 4620 2344 bnnhhh.exe 87 PID 2344 wrote to memory of 4620 2344 bnnhhh.exe 87 PID 2344 wrote to memory of 4620 2344 bnnhhh.exe 87 PID 4620 wrote to memory of 3004 4620 jdppp.exe 88 PID 4620 wrote to memory of 3004 4620 jdppp.exe 88 PID 4620 wrote to memory of 3004 4620 jdppp.exe 88 PID 3004 wrote to memory of 3048 3004 1htntb.exe 89 PID 3004 wrote to memory of 3048 3004 1htntb.exe 89 PID 3004 wrote to memory of 3048 3004 1htntb.exe 89 PID 3048 wrote to memory of 1712 3048 dpjdd.exe 90 PID 3048 wrote to memory of 1712 3048 dpjdd.exe 90 PID 3048 wrote to memory of 1712 3048 dpjdd.exe 90 PID 1712 wrote to memory of 3728 1712 nbhhhh.exe 91 PID 1712 wrote to memory of 3728 1712 nbhhhh.exe 91 PID 1712 wrote to memory of 3728 1712 nbhhhh.exe 91 PID 3728 wrote to memory of 3852 3728 djpvv.exe 92 PID 3728 wrote to memory of 3852 3728 djpvv.exe 92 PID 3728 wrote to memory of 3852 3728 djpvv.exe 92 PID 3852 wrote to memory of 3548 3852 rfllffr.exe 93 PID 3852 wrote to memory of 3548 3852 rfllffr.exe 93 PID 3852 wrote to memory of 3548 3852 rfllffr.exe 93 PID 3548 wrote to memory of 2076 3548 lfrxfll.exe 94 PID 3548 wrote to memory of 2076 3548 lfrxfll.exe 94 PID 3548 wrote to memory of 2076 3548 lfrxfll.exe 94 PID 2076 wrote to memory of 3780 2076 thbntn.exe 95 PID 2076 wrote to memory of 3780 2076 thbntn.exe 95 PID 2076 wrote to memory of 3780 2076 thbntn.exe 95 PID 3780 wrote to memory of 808 3780 pvpdv.exe 96 PID 3780 wrote to memory of 808 3780 pvpdv.exe 96 PID 3780 wrote to memory of 808 3780 pvpdv.exe 96 PID 808 wrote to memory of 4692 808 vjdjp.exe 97 PID 808 wrote to memory of 4692 808 vjdjp.exe 97 PID 808 wrote to memory of 4692 808 vjdjp.exe 97 PID 4692 wrote to memory of 4712 4692 lrfxlfl.exe 98 PID 4692 wrote to memory of 4712 4692 lrfxlfl.exe 98 PID 4692 wrote to memory of 4712 4692 lrfxlfl.exe 98 PID 4712 wrote to memory of 4760 4712 bnnhbb.exe 99 PID 4712 wrote to memory of 4760 4712 bnnhbb.exe 99 PID 4712 wrote to memory of 4760 4712 bnnhbb.exe 99 PID 4760 wrote to memory of 3196 4760 jjdjv.exe 100 PID 4760 wrote to memory of 3196 4760 jjdjv.exe 100 PID 4760 wrote to memory of 3196 4760 jjdjv.exe 100 PID 3196 wrote to memory of 1500 3196 fxlflfx.exe 101 PID 3196 wrote to memory of 1500 3196 fxlflfx.exe 101 PID 3196 wrote to memory of 1500 3196 fxlflfx.exe 101 PID 1500 wrote to memory of 1040 1500 vdppv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe"C:\Users\Admin\AppData\Local\Temp\bda228926da733059fa4e78dbe7fff0581d1259a0eca44681ff87159bf2daa1eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\nbbbbb.exec:\nbbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\ffxrrll.exec:\ffxrrll.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\jjvdv.exec:\jjvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\nhnnnt.exec:\nhnnnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\xlffxrl.exec:\xlffxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\bnnhhh.exec:\bnnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jdppp.exec:\jdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\1htntb.exec:\1htntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dpjdd.exec:\dpjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nbhhhh.exec:\nbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\djpvv.exec:\djpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\rfllffr.exec:\rfllffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\lfrxfll.exec:\lfrxfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\thbntn.exec:\thbntn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\pvpdv.exec:\pvpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\vjdjp.exec:\vjdjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\lrfxlfl.exec:\lrfxlfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bnnhbb.exec:\bnnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\jjdjv.exec:\jjdjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\fxlflfx.exec:\fxlflfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\vdppv.exec:\vdppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\tthnnn.exec:\tthnnn.exe23⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vpppp.exec:\vpppp.exe24⤵
- Executes dropped EXE
PID:312 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe25⤵
- Executes dropped EXE
PID:4640 -
\??\c:\nnbhht.exec:\nnbhht.exe26⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xrxrrll.exec:\xrxrrll.exe27⤵
- Executes dropped EXE
PID:1172 -
\??\c:\hbnnnt.exec:\hbnnnt.exe28⤵
- Executes dropped EXE
PID:3720 -
\??\c:\xxlffxx.exec:\xxlffxx.exe29⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nttbbb.exec:\nttbbb.exe30⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnbtbh.exec:\tnbtbh.exe31⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ffffxlf.exec:\ffffxlf.exe32⤵
- Executes dropped EXE
PID:4112 -
\??\c:\1nnbbn.exec:\1nnbbn.exe33⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nhbttb.exec:\nhbttb.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3240 -
\??\c:\9jvdv.exec:\9jvdv.exe35⤵
- Executes dropped EXE
PID:4844 -
\??\c:\hhhhhh.exec:\hhhhhh.exe36⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjpjp.exec:\vjpjp.exe37⤵
- Executes dropped EXE
PID:3556 -
\??\c:\lxlllll.exec:\lxlllll.exe38⤵
- Executes dropped EXE
PID:400 -
\??\c:\vdjvd.exec:\vdjvd.exe39⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jdddd.exec:\jdddd.exe40⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lrllfff.exec:\lrllfff.exe41⤵
- Executes dropped EXE
PID:3416 -
\??\c:\9nhnbb.exec:\9nhnbb.exe42⤵
- Executes dropped EXE
PID:3884 -
\??\c:\vpjpv.exec:\vpjpv.exe43⤵
- Executes dropped EXE
PID:1952 -
\??\c:\flrrrxx.exec:\flrrrxx.exe44⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ttbhbb.exec:\ttbhbb.exe45⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9jdvj.exec:\9jdvj.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\lxxxxfx.exec:\lxxxxfx.exe47⤵
- Executes dropped EXE
PID:3264 -
\??\c:\bnhbnh.exec:\bnhbnh.exe48⤵
- Executes dropped EXE
PID:4932 -
\??\c:\ddppp.exec:\ddppp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\rffxlll.exec:\rffxlll.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hbbttb.exec:\hbbttb.exe51⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3bnhtb.exec:\3bnhtb.exe52⤵
- Executes dropped EXE
PID:956 -
\??\c:\rxxllrf.exec:\rxxllrf.exe53⤵
- Executes dropped EXE
PID:972 -
\??\c:\xxrrfll.exec:\xxrrfll.exe54⤵
- Executes dropped EXE
PID:4248 -
\??\c:\pppdd.exec:\pppdd.exe55⤵
- Executes dropped EXE
PID:1440 -
\??\c:\9pjjp.exec:\9pjjp.exe56⤵
- Executes dropped EXE
PID:3948 -
\??\c:\rflxllf.exec:\rflxllf.exe57⤵
- Executes dropped EXE
PID:1996 -
\??\c:\thbhbt.exec:\thbhbt.exe58⤵
- Executes dropped EXE
PID:3252 -
\??\c:\ppppp.exec:\ppppp.exe59⤵
- Executes dropped EXE
PID:3372 -
\??\c:\llxxxll.exec:\llxxxll.exe60⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbhhht.exec:\hbhhht.exe61⤵
- Executes dropped EXE
PID:4400 -
\??\c:\dpvpj.exec:\dpvpj.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rrllllf.exec:\rrllllf.exe63⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jvddj.exec:\jvddj.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3628 -
\??\c:\xxxrllx.exec:\xxxrllx.exe65⤵
- Executes dropped EXE
PID:4284 -
\??\c:\hnttnn.exec:\hnttnn.exe66⤵PID:3976
-
\??\c:\jdvjv.exec:\jdvjv.exe67⤵PID:5068
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe68⤵PID:3092
-
\??\c:\hhnnbb.exec:\hhnnbb.exe69⤵PID:4972
-
\??\c:\vpjvd.exec:\vpjvd.exe70⤵PID:3852
-
\??\c:\frlfffl.exec:\frlfffl.exe71⤵PID:4872
-
\??\c:\thtnnn.exec:\thtnnn.exe72⤵PID:4396
-
\??\c:\hbhbtt.exec:\hbhbtt.exe73⤵PID:2012
-
\??\c:\pjdjd.exec:\pjdjd.exe74⤵PID:3408
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe75⤵PID:1444
-
\??\c:\lrrrrff.exec:\lrrrrff.exe76⤵PID:3368
-
\??\c:\5tbtbn.exec:\5tbtbn.exe77⤵PID:2184
-
\??\c:\ffffllr.exec:\ffffllr.exe78⤵PID:4980
-
\??\c:\fxrxrlf.exec:\fxrxrlf.exe79⤵PID:3056
-
\??\c:\tnnhbb.exec:\tnnhbb.exe80⤵PID:2580
-
\??\c:\vjvdd.exec:\vjvdd.exe81⤵PID:4724
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe82⤵PID:392
-
\??\c:\thntbn.exec:\thntbn.exe83⤵PID:696
-
\??\c:\7jpjj.exec:\7jpjj.exe84⤵PID:3464
-
\??\c:\llflrxf.exec:\llflrxf.exe85⤵PID:4560
-
\??\c:\hhttbn.exec:\hhttbn.exe86⤵PID:2572
-
\??\c:\vddjd.exec:\vddjd.exe87⤵PID:2036
-
\??\c:\7llfxxl.exec:\7llfxxl.exe88⤵PID:3968
-
\??\c:\hhhhbb.exec:\hhhhbb.exe89⤵PID:1448
-
\??\c:\dvdjp.exec:\dvdjp.exe90⤵PID:3060
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe91⤵PID:4008
-
\??\c:\btnhtt.exec:\btnhtt.exe92⤵PID:4004
-
\??\c:\pjpdd.exec:\pjpdd.exe93⤵PID:1880
-
\??\c:\fxffxff.exec:\fxffxff.exe94⤵PID:5024
-
\??\c:\nntbht.exec:\nntbht.exe95⤵PID:4624
-
\??\c:\jpdjd.exec:\jpdjd.exe96⤵PID:232
-
\??\c:\fffxrrl.exec:\fffxrrl.exe97⤵PID:1892
-
\??\c:\tttnhh.exec:\tttnhh.exe98⤵PID:3240
-
\??\c:\dvvvv.exec:\dvvvv.exe99⤵PID:1756
-
\??\c:\rrrrxll.exec:\rrrrxll.exe100⤵PID:2612
-
\??\c:\ttnhnn.exec:\ttnhnn.exe101⤵PID:3228
-
\??\c:\vpvvv.exec:\vpvvv.exe102⤵PID:4240
-
\??\c:\fffxrlf.exec:\fffxrlf.exe103⤵PID:3160
-
\??\c:\9hhhbb.exec:\9hhhbb.exe104⤵PID:2812
-
\??\c:\bbhbtn.exec:\bbhbtn.exe105⤵PID:4856
-
\??\c:\dpjpv.exec:\dpjpv.exe106⤵PID:3488
-
\??\c:\xrrxrfl.exec:\xrrxrfl.exe107⤵PID:4420
-
\??\c:\tnbhhh.exec:\tnbhhh.exe108⤵PID:5040
-
\??\c:\jjjdv.exec:\jjjdv.exe109⤵PID:4632
-
\??\c:\3ppvp.exec:\3ppvp.exe110⤵PID:2684
-
\??\c:\rfllfll.exec:\rfllfll.exe111⤵
- System Location Discovery: System Language Discovery
PID:1344 -
\??\c:\thbbbb.exec:\thbbbb.exe112⤵PID:5096
-
\??\c:\dpddd.exec:\dpddd.exe113⤵PID:3636
-
\??\c:\1ffffll.exec:\1ffffll.exe114⤵PID:1760
-
\??\c:\nhnnnn.exec:\nhnnnn.exe115⤵PID:2900
-
\??\c:\djvpv.exec:\djvpv.exe116⤵PID:2988
-
\??\c:\fxlrrfl.exec:\fxlrrfl.exe117⤵PID:4748
-
\??\c:\nnnnbh.exec:\nnnnbh.exe118⤵PID:3364
-
\??\c:\pjvvd.exec:\pjvvd.exe119⤵PID:4248
-
\??\c:\xxlxxfx.exec:\xxlxxfx.exe120⤵PID:4904
-
\??\c:\tbnnhn.exec:\tbnnhn.exe121⤵PID:3560
-
\??\c:\jvddd.exec:\jvddd.exe122⤵PID:3996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-