Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 08:23
Static task
static1
Behavioral task
behavioral1
Sample
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe
Resource
win7-20240903-en
General
-
Target
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe
-
Size
452KB
-
MD5
895f492a7be5d60b7fa587754c729230
-
SHA1
b952b9ad67b6f9cf78d7337d5b7c536a1489c2d2
-
SHA256
a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08a
-
SHA512
8f61473e083d1f206c71e85eb87ed962be0458de73acfd637a5e8108c280d132daf8b71fd22da59443c16b10c16c20ec14f88d97c4970edef0f61d696338526c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4484-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2608-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3692-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4532-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-979-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-1148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-1221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-1553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-1828-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4484 vjjvj.exe 4660 1pvpv.exe 5000 flrlfxr.exe 756 7vvjv.exe 2120 xrlfxrl.exe 440 5tnbtn.exe 1672 ppddv.exe 2140 ffrxrxf.exe 1504 xrrfrfr.exe 4028 rffxrlf.exe 3684 bnnhbb.exe 1944 tbhtnh.exe 4432 jjjdv.exe 3892 frffxxx.exe 4532 rrrlxrl.exe 1536 htbthb.exe 1704 pjpdv.exe 4168 jvvvj.exe 2700 xrlffxr.exe 3692 nthbnh.exe 3152 1tthbt.exe 2024 dpvjp.exe 4876 lfxrrlr.exe 5008 1rxlxrl.exe 344 7hthhb.exe 1544 tbhnnh.exe 1964 jddpj.exe 2608 fxfrlxr.exe 3796 hntthb.exe 2912 1btnnh.exe 4976 pjpjd.exe 2304 9vjvj.exe 1968 9lxrfxr.exe 2336 thhbtn.exe 3680 tnhbnh.exe 3540 jvvjd.exe 2568 lflxfxl.exe 5036 5lxrlfr.exe 1744 httnbn.exe 4348 5pjvj.exe 3520 vjjdp.exe 4612 fxxrlfl.exe 2388 rllxlfr.exe 3984 bnnbtn.exe 748 3ppjp.exe 2192 vpvjp.exe 3880 lflrfrf.exe 3964 nnnnhh.exe 1096 tnhbnh.exe 3924 3vdvv.exe 4408 pjjdp.exe 3028 hbnhhh.exe 3672 9bnnnn.exe 1076 7vvpd.exe 4176 rllrfxx.exe 2900 fxrfrrf.exe 5000 hbnbnh.exe 4600 dvdvd.exe 5020 rlfrllf.exe 2860 lxxrllf.exe 3512 hhbtnt.exe 3688 pjvvv.exe 208 ddpjd.exe 2044 5rxxxlr.exe -
resource yara_rule behavioral2/memory/4484-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2608-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4532-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-842-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-979-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 4484 408 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 82 PID 408 wrote to memory of 4484 408 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 82 PID 408 wrote to memory of 4484 408 a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe 82 PID 4484 wrote to memory of 4660 4484 vjjvj.exe 83 PID 4484 wrote to memory of 4660 4484 vjjvj.exe 83 PID 4484 wrote to memory of 4660 4484 vjjvj.exe 83 PID 4660 wrote to memory of 5000 4660 1pvpv.exe 84 PID 4660 wrote to memory of 5000 4660 1pvpv.exe 84 PID 4660 wrote to memory of 5000 4660 1pvpv.exe 84 PID 5000 wrote to memory of 756 5000 flrlfxr.exe 85 PID 5000 wrote to memory of 756 5000 flrlfxr.exe 85 PID 5000 wrote to memory of 756 5000 flrlfxr.exe 85 PID 756 wrote to memory of 2120 756 7vvjv.exe 86 PID 756 wrote to memory of 2120 756 7vvjv.exe 86 PID 756 wrote to memory of 2120 756 7vvjv.exe 86 PID 2120 wrote to memory of 440 2120 xrlfxrl.exe 87 PID 2120 wrote to memory of 440 2120 xrlfxrl.exe 87 PID 2120 wrote to memory of 440 2120 xrlfxrl.exe 87 PID 440 wrote to memory of 1672 440 5tnbtn.exe 88 PID 440 wrote to memory of 1672 440 5tnbtn.exe 88 PID 440 wrote to memory of 1672 440 5tnbtn.exe 88 PID 1672 wrote to memory of 2140 1672 ppddv.exe 89 PID 1672 wrote to memory of 2140 1672 ppddv.exe 89 PID 1672 wrote to memory of 2140 1672 ppddv.exe 89 PID 2140 wrote to memory of 1504 2140 ffrxrxf.exe 90 PID 2140 wrote to memory of 1504 2140 ffrxrxf.exe 90 PID 2140 wrote to memory of 1504 2140 ffrxrxf.exe 90 PID 1504 wrote to memory of 4028 1504 xrrfrfr.exe 91 PID 1504 wrote to memory of 4028 1504 xrrfrfr.exe 91 PID 1504 wrote to memory of 4028 1504 xrrfrfr.exe 91 PID 4028 wrote to memory of 3684 4028 rffxrlf.exe 92 PID 4028 wrote to memory of 3684 4028 rffxrlf.exe 92 PID 4028 wrote to memory of 3684 4028 rffxrlf.exe 92 PID 3684 wrote to memory of 1944 3684 bnnhbb.exe 93 PID 3684 wrote to memory of 1944 3684 bnnhbb.exe 93 PID 3684 wrote to memory of 1944 3684 bnnhbb.exe 93 PID 1944 wrote to memory of 4432 1944 tbhtnh.exe 94 PID 1944 wrote to memory of 4432 1944 tbhtnh.exe 94 PID 1944 wrote to memory of 4432 1944 tbhtnh.exe 94 PID 4432 wrote to memory of 3892 4432 jjjdv.exe 95 PID 4432 wrote to memory of 3892 4432 jjjdv.exe 95 PID 4432 wrote to memory of 3892 4432 jjjdv.exe 95 PID 3892 wrote to memory of 4532 3892 frffxxx.exe 153 PID 3892 wrote to memory of 4532 3892 frffxxx.exe 153 PID 3892 wrote to memory of 4532 3892 frffxxx.exe 153 PID 4532 wrote to memory of 1536 4532 rrrlxrl.exe 195 PID 4532 wrote to memory of 1536 4532 rrrlxrl.exe 195 PID 4532 wrote to memory of 1536 4532 rrrlxrl.exe 195 PID 1536 wrote to memory of 1704 1536 htbthb.exe 98 PID 1536 wrote to memory of 1704 1536 htbthb.exe 98 PID 1536 wrote to memory of 1704 1536 htbthb.exe 98 PID 1704 wrote to memory of 4168 1704 pjpdv.exe 99 PID 1704 wrote to memory of 4168 1704 pjpdv.exe 99 PID 1704 wrote to memory of 4168 1704 pjpdv.exe 99 PID 4168 wrote to memory of 2700 4168 jvvvj.exe 100 PID 4168 wrote to memory of 2700 4168 jvvvj.exe 100 PID 4168 wrote to memory of 2700 4168 jvvvj.exe 100 PID 2700 wrote to memory of 3692 2700 xrlffxr.exe 101 PID 2700 wrote to memory of 3692 2700 xrlffxr.exe 101 PID 2700 wrote to memory of 3692 2700 xrlffxr.exe 101 PID 3692 wrote to memory of 3152 3692 nthbnh.exe 102 PID 3692 wrote to memory of 3152 3692 nthbnh.exe 102 PID 3692 wrote to memory of 3152 3692 nthbnh.exe 102 PID 3152 wrote to memory of 2024 3152 1tthbt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe"C:\Users\Admin\AppData\Local\Temp\a031bda797585007dca504eb84a7ebb1584c3feab508e2738a38a6ca101de08aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\vjjvj.exec:\vjjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\1pvpv.exec:\1pvpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\flrlfxr.exec:\flrlfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\7vvjv.exec:\7vvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5tnbtn.exec:\5tnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\ppddv.exec:\ppddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\ffrxrxf.exec:\ffrxrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xrrfrfr.exec:\xrrfrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\rffxrlf.exec:\rffxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\bnnhbb.exec:\bnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\tbhtnh.exec:\tbhtnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\jjjdv.exec:\jjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\frffxxx.exec:\frffxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\rrrlxrl.exec:\rrrlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\htbthb.exec:\htbthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\pjpdv.exec:\pjpdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jvvvj.exec:\jvvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\xrlffxr.exec:\xrlffxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nthbnh.exec:\nthbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\1tthbt.exec:\1tthbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dpvjp.exec:\dpvjp.exe23⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfxrrlr.exec:\lfxrrlr.exe24⤵
- Executes dropped EXE
PID:4876 -
\??\c:\1rxlxrl.exec:\1rxlxrl.exe25⤵
- Executes dropped EXE
PID:5008 -
\??\c:\7hthhb.exec:\7hthhb.exe26⤵
- Executes dropped EXE
PID:344 -
\??\c:\tbhnnh.exec:\tbhnnh.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jddpj.exec:\jddpj.exe28⤵
- Executes dropped EXE
PID:1964 -
\??\c:\fxfrlxr.exec:\fxfrlxr.exe29⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hntthb.exec:\hntthb.exe30⤵
- Executes dropped EXE
PID:3796 -
\??\c:\1btnnh.exec:\1btnnh.exe31⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pjpjd.exec:\pjpjd.exe32⤵
- Executes dropped EXE
PID:4976 -
\??\c:\9vjvj.exec:\9vjvj.exe33⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9lxrfxr.exec:\9lxrfxr.exe34⤵
- Executes dropped EXE
PID:1968 -
\??\c:\thhbtn.exec:\thhbtn.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnhbnh.exec:\tnhbnh.exe36⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jvvjd.exec:\jvvjd.exe37⤵
- Executes dropped EXE
PID:3540 -
\??\c:\lflxfxl.exec:\lflxfxl.exe38⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5lxrlfr.exec:\5lxrlfr.exe39⤵
- Executes dropped EXE
PID:5036 -
\??\c:\httnbn.exec:\httnbn.exe40⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5pjvj.exec:\5pjvj.exe41⤵
- Executes dropped EXE
PID:4348 -
\??\c:\vjjdp.exec:\vjjdp.exe42⤵
- Executes dropped EXE
PID:3520 -
\??\c:\fxxrlfl.exec:\fxxrlfl.exe43⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rllxlfr.exec:\rllxlfr.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bnnbtn.exec:\bnnbtn.exe45⤵
- Executes dropped EXE
PID:3984 -
\??\c:\3ppjp.exec:\3ppjp.exe46⤵
- Executes dropped EXE
PID:748 -
\??\c:\vpvjp.exec:\vpvjp.exe47⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lflrfrf.exec:\lflrfrf.exe48⤵
- Executes dropped EXE
PID:3880 -
\??\c:\nnnnhh.exec:\nnnnhh.exe49⤵
- Executes dropped EXE
PID:3964 -
\??\c:\tnhbnh.exec:\tnhbnh.exe50⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3vdvv.exec:\3vdvv.exe51⤵
- Executes dropped EXE
PID:3924 -
\??\c:\pjjdp.exec:\pjjdp.exe52⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lrrlxrr.exec:\lrrlxrr.exe53⤵PID:4508
-
\??\c:\hbnhhh.exec:\hbnhhh.exe54⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9bnnnn.exec:\9bnnnn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\7vvpd.exec:\7vvpd.exe56⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rllrfxx.exec:\rllrfxx.exe57⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxrfrrf.exec:\fxrfrrf.exe58⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hbnbnh.exec:\hbnbnh.exe59⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dvdvd.exec:\dvdvd.exe60⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rlfrllf.exec:\rlfrllf.exe61⤵
- Executes dropped EXE
PID:5020 -
\??\c:\lxxrllf.exec:\lxxrllf.exe62⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhbtnt.exec:\hhbtnt.exe63⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pjvvv.exec:\pjvvv.exe64⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ddpjd.exec:\ddpjd.exe65⤵
- Executes dropped EXE
PID:208 -
\??\c:\5rxxxlr.exec:\5rxxxlr.exe66⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbhbnn.exec:\hbhbnn.exe67⤵PID:4896
-
\??\c:\nbhbnh.exec:\nbhbnh.exe68⤵PID:1680
-
\??\c:\djddv.exec:\djddv.exe69⤵PID:4028
-
\??\c:\rlxlfxr.exec:\rlxlfxr.exe70⤵PID:3388
-
\??\c:\ffrlfxf.exec:\ffrlfxf.exe71⤵PID:4268
-
\??\c:\jjjdd.exec:\jjjdd.exe72⤵PID:1116
-
\??\c:\dvpvp.exec:\dvpvp.exe73⤵PID:4532
-
\??\c:\rllffll.exec:\rllffll.exe74⤵PID:4964
-
\??\c:\bhhhbt.exec:\bhhhbt.exe75⤵PID:4376
-
\??\c:\7bbnbb.exec:\7bbnbb.exe76⤵PID:4568
-
\??\c:\vpdvd.exec:\vpdvd.exe77⤵PID:2704
-
\??\c:\lxfxlff.exec:\lxfxlff.exe78⤵PID:3300
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe79⤵PID:1480
-
\??\c:\nbtntt.exec:\nbtntt.exe80⤵PID:464
-
\??\c:\htbbnn.exec:\htbbnn.exe81⤵PID:1580
-
\??\c:\vpdvd.exec:\vpdvd.exe82⤵PID:344
-
\??\c:\fxllfrr.exec:\fxllfrr.exe83⤵PID:1040
-
\??\c:\3rrlffx.exec:\3rrlffx.exe84⤵PID:4668
-
\??\c:\tthtbb.exec:\tthtbb.exe85⤵
- System Location Discovery: System Language Discovery
PID:3712 -
\??\c:\hbhbnn.exec:\hbhbnn.exe86⤵PID:3076
-
\??\c:\pjdjd.exec:\pjdjd.exe87⤵PID:1352
-
\??\c:\lrxfxrr.exec:\lrxfxrr.exe88⤵PID:2152
-
\??\c:\xffrfxl.exec:\xffrfxl.exe89⤵PID:1716
-
\??\c:\nhnhbt.exec:\nhnhbt.exe90⤵PID:4640
-
\??\c:\3pjvp.exec:\3pjvp.exe91⤵PID:1324
-
\??\c:\7vpdv.exec:\7vpdv.exe92⤵PID:3032
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe93⤵PID:4224
-
\??\c:\hbbbbt.exec:\hbbbbt.exe94⤵PID:3500
-
\??\c:\btthbh.exec:\btthbh.exe95⤵PID:2164
-
\??\c:\9jppv.exec:\9jppv.exe96⤵PID:4348
-
\??\c:\jjjdv.exec:\jjjdv.exe97⤵PID:3024
-
\??\c:\frfxrlf.exec:\frfxrlf.exe98⤵PID:3696
-
\??\c:\rrxlffx.exec:\rrxlffx.exe99⤵PID:2564
-
\??\c:\5ntbbb.exec:\5ntbbb.exe100⤵PID:3984
-
\??\c:\pdpjd.exec:\pdpjd.exe101⤵PID:2000
-
\??\c:\jjpvv.exec:\jjpvv.exe102⤵PID:5044
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe103⤵PID:1628
-
\??\c:\3lxrllf.exec:\3lxrllf.exe104⤵PID:2068
-
\??\c:\3nbtnh.exec:\3nbtnh.exe105⤵PID:2364
-
\??\c:\3jppd.exec:\3jppd.exe106⤵PID:5116
-
\??\c:\dvppj.exec:\dvppj.exe107⤵PID:5100
-
\??\c:\rllfffx.exec:\rllfffx.exe108⤵PID:4380
-
\??\c:\nhbtnn.exec:\nhbtnn.exe109⤵PID:4808
-
\??\c:\tntbtt.exec:\tntbtt.exe110⤵PID:1156
-
\??\c:\dpvjj.exec:\dpvjj.exe111⤵PID:3792
-
\??\c:\vppdd.exec:\vppdd.exe112⤵PID:3844
-
\??\c:\frffffl.exec:\frffffl.exe113⤵PID:2264
-
\??\c:\5nhbnn.exec:\5nhbnn.exe114⤵PID:4152
-
\??\c:\9vpjj.exec:\9vpjj.exe115⤵PID:1536
-
\??\c:\pjpdp.exec:\pjpdp.exe116⤵PID:4776
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe117⤵PID:1244
-
\??\c:\5hbthh.exec:\5hbthh.exe118⤵PID:2524
-
\??\c:\vvdjj.exec:\vvdjj.exe119⤵PID:1004
-
\??\c:\3lrfxxx.exec:\3lrfxxx.exe120⤵PID:2720
-
\??\c:\1bhhht.exec:\1bhhht.exe121⤵PID:316
-
\??\c:\vvdvj.exec:\vvdvj.exe122⤵PID:440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-