Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/10/2024, 23:11
Behavioral task
behavioral1
Sample
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe
Resource
win7-20240708-en
General
-
Target
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe
-
Size
3.7MB
-
MD5
e0b2850054fbaa6aabd4d31722815020
-
SHA1
3c1a5268eb58f7d5166b440c118a4759549dc0f2
-
SHA256
d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8
-
SHA512
7bed9117f881358e6fa768470bc00dc41f69ab32bcd6dc7723d94340f48b8278963c81508ca1301c2a8bef955660337cd9b1d8d43bc1cbe0cea1600ccebed8a6
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98J:U6XLq/qPPslzKx/dJg1ErmNk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2180-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4448-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/484-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4648-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/740-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3872-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2496-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2624-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1312-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/900-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-582-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-665-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-693-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-773-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-873-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-886-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-1283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-1856-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 4480 dpjjd.exe 1408 rrfxrlr.exe 3244 ppdvj.exe 4448 djjvj.exe 4036 ddddv.exe 2272 pjjjp.exe 3400 jjvvd.exe 1884 nttnbt.exe 484 vpjdv.exe 4484 vvppj.exe 860 bhnhhh.exe 764 xlfrxfr.exe 424 djpvv.exe 4716 rxlllll.exe 3604 7tthhh.exe 4764 hntthh.exe 4136 ntnnht.exe 4648 ddjpv.exe 740 9tbbtb.exe 2208 jpvvv.exe 2432 jdddj.exe 3240 lllrrxx.exe 1892 xflrlfr.exe 4532 ppvvp.exe 1308 hnnnhn.exe 4528 lxlfffl.exe 900 vjvvv.exe 3212 bbbbhb.exe 4992 jvvvv.exe 4000 dpjdj.exe 4216 ttnhbh.exe 4360 ppjpv.exe 3872 llffxff.exe 1640 xrrrlll.exe 2272 1lfxxxr.exe 2496 tnhhnh.exe 3648 bbnnnn.exe 2624 ppvpp.exe 1304 dddjv.exe 2292 pvppv.exe 716 jjvdd.exe 1680 jjjpj.exe 3460 xllxlfr.exe 380 hhtnnh.exe 3976 tntbnt.exe 644 ppjjj.exe 684 9ddjd.exe 1312 jvjdd.exe 2344 jjppj.exe 1080 rlfxffx.exe 2116 fxllrrl.exe 2776 jjdjv.exe 1184 rrxxllf.exe 3232 rfxrxxx.exe 4540 rxfflrr.exe 4928 jvdjp.exe 4236 dpdvp.exe 2332 pjvpp.exe 1788 7pvvp.exe 5040 vdvvd.exe 4044 pvddv.exe 2308 vpdvv.exe 3024 dpdvv.exe 1912 djjjj.exe -
resource yara_rule behavioral2/memory/2180-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b85-3.dat upx behavioral2/memory/2180-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-9.dat upx behavioral2/memory/4480-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-14.dat upx behavioral2/files/0x000b000000023b86-23.dat upx behavioral2/memory/4448-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-27.dat upx behavioral2/memory/4036-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-34.dat upx behavioral2/memory/2272-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0011000000023aaa-39.dat upx behavioral2/memory/2272-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3400-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ace-48.dat upx behavioral2/memory/1884-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b8e-51.dat upx behavioral2/files/0x000a000000023b8f-58.dat upx behavioral2/memory/4484-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/484-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-65.dat upx behavioral2/memory/860-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-70.dat upx behavioral2/memory/764-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/860-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/764-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0002000000022ef8-77.dat upx behavioral2/files/0x0002000000022efc-83.dat upx behavioral2/files/0x000a000000023b93-87.dat upx behavioral2/memory/4716-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-94.dat upx behavioral2/files/0x000a000000023b95-99.dat upx behavioral2/memory/4764-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-108.dat upx behavioral2/memory/4136-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-111.dat upx behavioral2/memory/4648-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/740-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-117.dat upx behavioral2/files/0x000a000000023b99-123.dat upx behavioral2/memory/2208-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-129.dat upx behavioral2/memory/2432-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3240-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-138.dat upx behavioral2/files/0x000a000000023b9d-141.dat upx behavioral2/files/0x000a000000023b9e-146.dat upx behavioral2/memory/4532-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-152.dat upx behavioral2/files/0x000a000000023ba0-157.dat upx behavioral2/files/0x000a000000023ba1-162.dat upx behavioral2/memory/3212-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-167.dat upx behavioral2/files/0x000b000000023ba3-174.dat upx behavioral2/memory/4992-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023ba5-180.dat upx behavioral2/memory/4000-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bbd-186.dat upx behavioral2/memory/3872-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1640-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2272-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2496-206-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 4480 2180 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 84 PID 2180 wrote to memory of 4480 2180 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 84 PID 2180 wrote to memory of 4480 2180 d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe 84 PID 4480 wrote to memory of 1408 4480 dpjjd.exe 86 PID 4480 wrote to memory of 1408 4480 dpjjd.exe 86 PID 4480 wrote to memory of 1408 4480 dpjjd.exe 86 PID 1408 wrote to memory of 3244 1408 rrfxrlr.exe 87 PID 1408 wrote to memory of 3244 1408 rrfxrlr.exe 87 PID 1408 wrote to memory of 3244 1408 rrfxrlr.exe 87 PID 3244 wrote to memory of 4448 3244 ppdvj.exe 89 PID 3244 wrote to memory of 4448 3244 ppdvj.exe 89 PID 3244 wrote to memory of 4448 3244 ppdvj.exe 89 PID 4448 wrote to memory of 4036 4448 djjvj.exe 91 PID 4448 wrote to memory of 4036 4448 djjvj.exe 91 PID 4448 wrote to memory of 4036 4448 djjvj.exe 91 PID 4036 wrote to memory of 2272 4036 ddddv.exe 92 PID 4036 wrote to memory of 2272 4036 ddddv.exe 92 PID 4036 wrote to memory of 2272 4036 ddddv.exe 92 PID 2272 wrote to memory of 3400 2272 pjjjp.exe 93 PID 2272 wrote to memory of 3400 2272 pjjjp.exe 93 PID 2272 wrote to memory of 3400 2272 pjjjp.exe 93 PID 3400 wrote to memory of 1884 3400 jjvvd.exe 94 PID 3400 wrote to memory of 1884 3400 jjvvd.exe 94 PID 3400 wrote to memory of 1884 3400 jjvvd.exe 94 PID 1884 wrote to memory of 484 1884 nttnbt.exe 95 PID 1884 wrote to memory of 484 1884 nttnbt.exe 95 PID 1884 wrote to memory of 484 1884 nttnbt.exe 95 PID 484 wrote to memory of 4484 484 vpjdv.exe 96 PID 484 wrote to memory of 4484 484 vpjdv.exe 96 PID 484 wrote to memory of 4484 484 vpjdv.exe 96 PID 4484 wrote to memory of 860 4484 vvppj.exe 97 PID 4484 wrote to memory of 860 4484 vvppj.exe 97 PID 4484 wrote to memory of 860 4484 vvppj.exe 97 PID 860 wrote to memory of 764 860 bhnhhh.exe 100 PID 860 wrote to memory of 764 860 bhnhhh.exe 100 PID 860 wrote to memory of 764 860 bhnhhh.exe 100 PID 764 wrote to memory of 424 764 xlfrxfr.exe 101 PID 764 wrote to memory of 424 764 xlfrxfr.exe 101 PID 764 wrote to memory of 424 764 xlfrxfr.exe 101 PID 424 wrote to memory of 4716 424 djpvv.exe 103 PID 424 wrote to memory of 4716 424 djpvv.exe 103 PID 424 wrote to memory of 4716 424 djpvv.exe 103 PID 4716 wrote to memory of 3604 4716 rxlllll.exe 105 PID 4716 wrote to memory of 3604 4716 rxlllll.exe 105 PID 4716 wrote to memory of 3604 4716 rxlllll.exe 105 PID 3604 wrote to memory of 4764 3604 7tthhh.exe 106 PID 3604 wrote to memory of 4764 3604 7tthhh.exe 106 PID 3604 wrote to memory of 4764 3604 7tthhh.exe 106 PID 4764 wrote to memory of 4136 4764 hntthh.exe 107 PID 4764 wrote to memory of 4136 4764 hntthh.exe 107 PID 4764 wrote to memory of 4136 4764 hntthh.exe 107 PID 4136 wrote to memory of 4648 4136 ntnnht.exe 108 PID 4136 wrote to memory of 4648 4136 ntnnht.exe 108 PID 4136 wrote to memory of 4648 4136 ntnnht.exe 108 PID 4648 wrote to memory of 740 4648 ddjpv.exe 109 PID 4648 wrote to memory of 740 4648 ddjpv.exe 109 PID 4648 wrote to memory of 740 4648 ddjpv.exe 109 PID 740 wrote to memory of 2208 740 9tbbtb.exe 110 PID 740 wrote to memory of 2208 740 9tbbtb.exe 110 PID 740 wrote to memory of 2208 740 9tbbtb.exe 110 PID 2208 wrote to memory of 2432 2208 jpvvv.exe 111 PID 2208 wrote to memory of 2432 2208 jpvvv.exe 111 PID 2208 wrote to memory of 2432 2208 jpvvv.exe 111 PID 2432 wrote to memory of 3240 2432 jdddj.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe"C:\Users\Admin\AppData\Local\Temp\d9da6dd3e0afb5607695c7203372ae6a5441d25e6dc451831c93e09a52daf5f8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\dpjjd.exec:\dpjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rrfxrlr.exec:\rrfxrlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\ppdvj.exec:\ppdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\djjvj.exec:\djjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\ddddv.exec:\ddddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\pjjjp.exec:\pjjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\jjvvd.exec:\jjvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\nttnbt.exec:\nttnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\vpjdv.exec:\vpjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\vvppj.exec:\vvppj.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bhnhhh.exec:\bhnhhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\xlfrxfr.exec:\xlfrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\djpvv.exec:\djpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\rxlllll.exec:\rxlllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\7tthhh.exec:\7tthhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\hntthh.exec:\hntthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\ntnnht.exec:\ntnnht.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\ddjpv.exec:\ddjpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\9tbbtb.exec:\9tbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\jpvvv.exec:\jpvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\jdddj.exec:\jdddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\lllrrxx.exec:\lllrrxx.exe23⤵
- Executes dropped EXE
PID:3240 -
\??\c:\xflrlfr.exec:\xflrlfr.exe24⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ppvvp.exec:\ppvvp.exe25⤵
- Executes dropped EXE
PID:4532 -
\??\c:\hnnnhn.exec:\hnnnhn.exe26⤵
- Executes dropped EXE
PID:1308 -
\??\c:\lxlfffl.exec:\lxlfffl.exe27⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vjvvv.exec:\vjvvv.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\bbbbhb.exec:\bbbbhb.exe29⤵
- Executes dropped EXE
PID:3212 -
\??\c:\jvvvv.exec:\jvvvv.exe30⤵
- Executes dropped EXE
PID:4992 -
\??\c:\dpjdj.exec:\dpjdj.exe31⤵
- Executes dropped EXE
PID:4000 -
\??\c:\ttnhbh.exec:\ttnhbh.exe32⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ppjpv.exec:\ppjpv.exe33⤵
- Executes dropped EXE
PID:4360 -
\??\c:\llffxff.exec:\llffxff.exe34⤵
- Executes dropped EXE
PID:3872 -
\??\c:\xrrrlll.exec:\xrrrlll.exe35⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1lfxxxr.exec:\1lfxxxr.exe36⤵
- Executes dropped EXE
PID:2272 -
\??\c:\tnhhnh.exec:\tnhhnh.exe37⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbnnnn.exec:\bbnnnn.exe38⤵
- Executes dropped EXE
PID:3648 -
\??\c:\ppvpp.exec:\ppvpp.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dddjv.exec:\dddjv.exe40⤵
- Executes dropped EXE
PID:1304 -
\??\c:\pvppv.exec:\pvppv.exe41⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jjvdd.exec:\jjvdd.exe42⤵
- Executes dropped EXE
PID:716 -
\??\c:\jjjpj.exec:\jjjpj.exe43⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xllxlfr.exec:\xllxlfr.exe44⤵
- Executes dropped EXE
PID:3460 -
\??\c:\hhtnnh.exec:\hhtnnh.exe45⤵
- Executes dropped EXE
PID:380 -
\??\c:\tntbnt.exec:\tntbnt.exe46⤵
- Executes dropped EXE
PID:3976 -
\??\c:\ppjjj.exec:\ppjjj.exe47⤵
- Executes dropped EXE
PID:644 -
\??\c:\9ddjd.exec:\9ddjd.exe48⤵
- Executes dropped EXE
PID:684 -
\??\c:\jvjdd.exec:\jvjdd.exe49⤵
- Executes dropped EXE
PID:1312 -
\??\c:\jjppj.exec:\jjppj.exe50⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlfxffx.exec:\rlfxffx.exe51⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fxllrrl.exec:\fxllrrl.exe52⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jjdjv.exec:\jjdjv.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rrxxllf.exec:\rrxxllf.exe54⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rfxrxxx.exec:\rfxrxxx.exe55⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rxfflrr.exec:\rxfflrr.exe56⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jvdjp.exec:\jvdjp.exe57⤵
- Executes dropped EXE
PID:4928 -
\??\c:\dpdvp.exec:\dpdvp.exe58⤵
- Executes dropped EXE
PID:4236 -
\??\c:\pjvpp.exec:\pjvpp.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7pvvp.exec:\7pvvp.exe60⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vdvvd.exec:\vdvvd.exe61⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pvddv.exec:\pvddv.exe62⤵
- Executes dropped EXE
PID:4044 -
\??\c:\vpdvv.exec:\vpdvv.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\dpdvv.exec:\dpdvv.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\djjjj.exec:\djjjj.exe65⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjjdv.exec:\jjjdv.exe66⤵PID:1340
-
\??\c:\dvvvp.exec:\dvvvp.exe67⤵PID:900
-
\??\c:\ppvvp.exec:\ppvvp.exe68⤵PID:3212
-
\??\c:\jpvvp.exec:\jpvvp.exe69⤵PID:3892
-
\??\c:\dvpjd.exec:\dvpjd.exe70⤵PID:1144
-
\??\c:\djpvv.exec:\djpvv.exe71⤵PID:3544
-
\??\c:\ddvjj.exec:\ddvjj.exe72⤵PID:4372
-
\??\c:\lfxlrfl.exec:\lfxlrfl.exe73⤵PID:1984
-
\??\c:\jjvdd.exec:\jjvdd.exe74⤵PID:2016
-
\??\c:\xfxfffl.exec:\xfxfffl.exe75⤵PID:3672
-
\??\c:\lrrrffx.exec:\lrrrffx.exe76⤵PID:4712
-
\??\c:\dvpdj.exec:\dvpdj.exe77⤵PID:736
-
\??\c:\pvddv.exec:\pvddv.exe78⤵PID:484
-
\??\c:\xrlffff.exec:\xrlffff.exe79⤵PID:3836
-
\??\c:\lfffffx.exec:\lfffffx.exe80⤵PID:4640
-
\??\c:\5rxxxrl.exec:\5rxxxrl.exe81⤵PID:1304
-
\??\c:\xffxrxr.exec:\xffxrxr.exe82⤵PID:1104
-
\??\c:\xrlfffx.exec:\xrlfffx.exe83⤵PID:764
-
\??\c:\rlxxlff.exec:\rlxxlff.exe84⤵PID:424
-
\??\c:\rxllllf.exec:\rxllllf.exe85⤵PID:4564
-
\??\c:\tttbhb.exec:\tttbhb.exe86⤵PID:3320
-
\??\c:\bnnhht.exec:\bnnhht.exe87⤵PID:4524
-
\??\c:\tnttbh.exec:\tnttbh.exe88⤵PID:2104
-
\??\c:\tbhhht.exec:\tbhhht.exe89⤵PID:684
-
\??\c:\tnbbtt.exec:\tnbbtt.exe90⤵PID:1064
-
\??\c:\rxlrlfr.exec:\rxlrlfr.exe91⤵PID:3216
-
\??\c:\rffrfxl.exec:\rffrfxl.exe92⤵PID:1300
-
\??\c:\llfxllr.exec:\llfxllr.exe93⤵PID:3896
-
\??\c:\rlrrrxl.exec:\rlrrrxl.exe94⤵PID:1948
-
\??\c:\rrllrrr.exec:\rrllrrr.exe95⤵PID:1080
-
\??\c:\lfffxxr.exec:\lfffxxr.exe96⤵PID:4032
-
\??\c:\llrrllf.exec:\llrrllf.exe97⤵PID:1192
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe98⤵PID:2864
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe99⤵PID:996
-
\??\c:\rffxflx.exec:\rffxflx.exe100⤵PID:3948
-
\??\c:\lfllxxx.exec:\lfllxxx.exe101⤵PID:2912
-
\??\c:\rflfxxr.exec:\rflfxxr.exe102⤵PID:1148
-
\??\c:\xlffxxx.exec:\xlffxxx.exe103⤵PID:832
-
\??\c:\lflllrr.exec:\lflllrr.exe104⤵PID:1360
-
\??\c:\rrxxrxf.exec:\rrxxrxf.exe105⤵PID:356
-
\??\c:\htbbtt.exec:\htbbtt.exe106⤵PID:4044
-
\??\c:\9xxllff.exec:\9xxllff.exe107⤵PID:3200
-
\??\c:\bbtbbb.exec:\bbtbbb.exe108⤵PID:772
-
\??\c:\hhbbbb.exec:\hhbbbb.exe109⤵PID:4016
-
\??\c:\hhnnbb.exec:\hhnnbb.exe110⤵PID:1408
-
\??\c:\hhbbtt.exec:\hhbbtt.exe111⤵PID:5092
-
\??\c:\nthhtb.exec:\nthhtb.exe112⤵PID:4304
-
\??\c:\bnbhnt.exec:\bnbhnt.exe113⤵PID:4608
-
\??\c:\ttbhhh.exec:\ttbhhh.exe114⤵PID:4004
-
\??\c:\httbtt.exec:\httbtt.exe115⤵PID:1144
-
\??\c:\nnnnhh.exec:\nnnnhh.exe116⤵PID:3940
-
\??\c:\ntthnt.exec:\ntthnt.exe117⤵PID:3292
-
\??\c:\rxffxfx.exec:\rxffxfx.exe118⤵PID:3500
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe119⤵PID:1624
-
\??\c:\rrrxflf.exec:\rrrxflf.exe120⤵
- System Location Discovery: System Language Discovery
PID:3400 -
\??\c:\fflxrrr.exec:\fflxrrr.exe121⤵PID:2272
-
\??\c:\hbnnnt.exec:\hbnnnt.exe122⤵PID:1480
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-