Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 23:12
Static task
static1
Behavioral task
behavioral1
Sample
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe
Resource
win7-20241010-en
General
-
Target
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe
-
Size
454KB
-
MD5
5523b2433e4431919418f543a1ffe491
-
SHA1
96c62ba2753c7a4b5e37834b5c780b68fb1d4da2
-
SHA256
821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e
-
SHA512
fdc7832f6b505b76e8b922c6e42fe619d656ddecdea707616a416ccf72ce5256b9183e1dff44a950ff71f6fd367efd2caa57e767674b5b4973aab07d859557b3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3984-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4856-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3420-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/840-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-901-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-1059-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-1153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-1326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4856 jvdpj.exe 1552 ddpjd.exe 3100 pdjjd.exe 4948 btbbbb.exe 4488 fxllffr.exe 4584 dvdpv.exe 2320 thnhhh.exe 3936 ppjjv.exe 4292 rllfxrr.exe 2656 lxlxfxf.exe 1468 vdjdv.exe 2496 lflflff.exe 2720 hthtnn.exe 552 vdjdd.exe 2076 lffxrlf.exe 1148 7tbtnb.exe 3516 rrfxrrr.exe 2576 xrfxxxx.exe 3076 hbhbhb.exe 668 tbbtnn.exe 2540 rxxrrrr.exe 1888 fflfrlf.exe 4060 hbnhht.exe 4204 xrxrrrr.exe 3592 dpjdp.exe 2924 hnbnhn.exe 2984 dddjv.exe 2164 jdjdv.exe 3972 pvdvp.exe 3208 9nhbnh.exe 3944 pvdvv.exe 4228 rfllxxf.exe 644 3hhbtt.exe 1092 ffrlxxl.exe 2752 bthtnn.exe 3740 vpvjd.exe 3620 llrrlrl.exe 4728 lfrlrrf.exe 4752 nhnntt.exe 1320 vvpjp.exe 5000 lrfxrrr.exe 4856 bhhbtt.exe 3420 9vpjp.exe 4776 frlfxxl.exe 4364 bhbtnh.exe 628 dvvpj.exe 3232 fxxrllf.exe 1924 hhhnht.exe 3624 5pjdv.exe 4928 xfxflrx.exe 2980 lrrlffx.exe 4488 nbnhbt.exe 2328 1djdd.exe 2764 rrrfrrl.exe 688 ntnttn.exe 4188 jjjdd.exe 4572 rrxrlff.exe 5040 llxrxxl.exe 2052 9bhhnn.exe 840 pddvp.exe 468 lllfxxx.exe 1548 nhbntn.exe 4716 pjppv.exe 1948 1xxrxrl.exe -
resource yara_rule behavioral2/memory/3984-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3420-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/840-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-920-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 4856 3984 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 83 PID 3984 wrote to memory of 4856 3984 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 83 PID 3984 wrote to memory of 4856 3984 821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe 83 PID 4856 wrote to memory of 1552 4856 jvdpj.exe 84 PID 4856 wrote to memory of 1552 4856 jvdpj.exe 84 PID 4856 wrote to memory of 1552 4856 jvdpj.exe 84 PID 1552 wrote to memory of 3100 1552 ddpjd.exe 85 PID 1552 wrote to memory of 3100 1552 ddpjd.exe 85 PID 1552 wrote to memory of 3100 1552 ddpjd.exe 85 PID 3100 wrote to memory of 4948 3100 pdjjd.exe 86 PID 3100 wrote to memory of 4948 3100 pdjjd.exe 86 PID 3100 wrote to memory of 4948 3100 pdjjd.exe 86 PID 4948 wrote to memory of 4488 4948 btbbbb.exe 87 PID 4948 wrote to memory of 4488 4948 btbbbb.exe 87 PID 4948 wrote to memory of 4488 4948 btbbbb.exe 87 PID 4488 wrote to memory of 4584 4488 fxllffr.exe 88 PID 4488 wrote to memory of 4584 4488 fxllffr.exe 88 PID 4488 wrote to memory of 4584 4488 fxllffr.exe 88 PID 4584 wrote to memory of 2320 4584 dvdpv.exe 89 PID 4584 wrote to memory of 2320 4584 dvdpv.exe 89 PID 4584 wrote to memory of 2320 4584 dvdpv.exe 89 PID 2320 wrote to memory of 3936 2320 thnhhh.exe 90 PID 2320 wrote to memory of 3936 2320 thnhhh.exe 90 PID 2320 wrote to memory of 3936 2320 thnhhh.exe 90 PID 3936 wrote to memory of 4292 3936 ppjjv.exe 91 PID 3936 wrote to memory of 4292 3936 ppjjv.exe 91 PID 3936 wrote to memory of 4292 3936 ppjjv.exe 91 PID 4292 wrote to memory of 2656 4292 rllfxrr.exe 92 PID 4292 wrote to memory of 2656 4292 rllfxrr.exe 92 PID 4292 wrote to memory of 2656 4292 rllfxrr.exe 92 PID 2656 wrote to memory of 1468 2656 lxlxfxf.exe 93 PID 2656 wrote to memory of 1468 2656 lxlxfxf.exe 93 PID 2656 wrote to memory of 1468 2656 lxlxfxf.exe 93 PID 1468 wrote to memory of 2496 1468 vdjdv.exe 94 PID 1468 wrote to memory of 2496 1468 vdjdv.exe 94 PID 1468 wrote to memory of 2496 1468 vdjdv.exe 94 PID 2496 wrote to memory of 2720 2496 lflflff.exe 95 PID 2496 wrote to memory of 2720 2496 lflflff.exe 95 PID 2496 wrote to memory of 2720 2496 lflflff.exe 95 PID 2720 wrote to memory of 552 2720 hthtnn.exe 96 PID 2720 wrote to memory of 552 2720 hthtnn.exe 96 PID 2720 wrote to memory of 552 2720 hthtnn.exe 96 PID 552 wrote to memory of 2076 552 vdjdd.exe 97 PID 552 wrote to memory of 2076 552 vdjdd.exe 97 PID 552 wrote to memory of 2076 552 vdjdd.exe 97 PID 2076 wrote to memory of 1148 2076 lffxrlf.exe 98 PID 2076 wrote to memory of 1148 2076 lffxrlf.exe 98 PID 2076 wrote to memory of 1148 2076 lffxrlf.exe 98 PID 1148 wrote to memory of 3516 1148 7tbtnb.exe 99 PID 1148 wrote to memory of 3516 1148 7tbtnb.exe 99 PID 1148 wrote to memory of 3516 1148 7tbtnb.exe 99 PID 3516 wrote to memory of 2576 3516 rrfxrrr.exe 100 PID 3516 wrote to memory of 2576 3516 rrfxrrr.exe 100 PID 3516 wrote to memory of 2576 3516 rrfxrrr.exe 100 PID 2576 wrote to memory of 3076 2576 xrfxxxx.exe 101 PID 2576 wrote to memory of 3076 2576 xrfxxxx.exe 101 PID 2576 wrote to memory of 3076 2576 xrfxxxx.exe 101 PID 3076 wrote to memory of 668 3076 hbhbhb.exe 102 PID 3076 wrote to memory of 668 3076 hbhbhb.exe 102 PID 3076 wrote to memory of 668 3076 hbhbhb.exe 102 PID 668 wrote to memory of 2540 668 tbbtnn.exe 103 PID 668 wrote to memory of 2540 668 tbbtnn.exe 103 PID 668 wrote to memory of 2540 668 tbbtnn.exe 103 PID 2540 wrote to memory of 1888 2540 rxxrrrr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe"C:\Users\Admin\AppData\Local\Temp\821452e264bbb67e863b82946c7b42ccdb2036c974ae64a51b057a88af32ee1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\jvdpj.exec:\jvdpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ddpjd.exec:\ddpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdjjd.exec:\pdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\btbbbb.exec:\btbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\fxllffr.exec:\fxllffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\dvdpv.exec:\dvdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\thnhhh.exec:\thnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\ppjjv.exec:\ppjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\rllfxrr.exec:\rllfxrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\lxlxfxf.exec:\lxlxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vdjdv.exec:\vdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\lflflff.exec:\lflflff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\hthtnn.exec:\hthtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vdjdd.exec:\vdjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lffxrlf.exec:\lffxrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\7tbtnb.exec:\7tbtnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\hbhbhb.exec:\hbhbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\tbbtnn.exec:\tbbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\fflfrlf.exec:\fflfrlf.exe23⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hbnhht.exec:\hbnhht.exe24⤵
- Executes dropped EXE
PID:4060 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe25⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dpjdp.exec:\dpjdp.exe26⤵
- Executes dropped EXE
PID:3592 -
\??\c:\hnbnhn.exec:\hnbnhn.exe27⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dddjv.exec:\dddjv.exe28⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdjdv.exec:\jdjdv.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pvdvp.exec:\pvdvp.exe30⤵
- Executes dropped EXE
PID:3972 -
\??\c:\9nhbnh.exec:\9nhbnh.exe31⤵
- Executes dropped EXE
PID:3208 -
\??\c:\pvdvv.exec:\pvdvv.exe32⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rfllxxf.exec:\rfllxxf.exe33⤵
- Executes dropped EXE
PID:4228 -
\??\c:\3hhbtt.exec:\3hhbtt.exe34⤵
- Executes dropped EXE
PID:644 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe35⤵
- Executes dropped EXE
PID:1092 -
\??\c:\bthtnn.exec:\bthtnn.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vpvjd.exec:\vpvjd.exe37⤵
- Executes dropped EXE
PID:3740 -
\??\c:\llrrlrl.exec:\llrrlrl.exe38⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lfrlrrf.exec:\lfrlrrf.exe39⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nhnntt.exec:\nhnntt.exe40⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vvpjp.exec:\vvpjp.exe41⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lrfxrrr.exec:\lrfxrrr.exe42⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bhhbtt.exec:\bhhbtt.exe43⤵
- Executes dropped EXE
PID:4856 -
\??\c:\9vpjp.exec:\9vpjp.exe44⤵
- Executes dropped EXE
PID:3420 -
\??\c:\frlfxxl.exec:\frlfxxl.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\bhbtnh.exec:\bhbtnh.exe46⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dvvpj.exec:\dvvpj.exe47⤵
- Executes dropped EXE
PID:628 -
\??\c:\fxxrllf.exec:\fxxrllf.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hhhnht.exec:\hhhnht.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5pjdv.exec:\5pjdv.exe50⤵
- Executes dropped EXE
PID:3624 -
\??\c:\xfxflrx.exec:\xfxflrx.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\lrrlffx.exec:\lrrlffx.exe52⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nbnhbt.exec:\nbnhbt.exe53⤵
- Executes dropped EXE
PID:4488 -
\??\c:\1djdd.exec:\1djdd.exe54⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ntnttn.exec:\ntnttn.exe56⤵
- Executes dropped EXE
PID:688 -
\??\c:\jjjdd.exec:\jjjdd.exe57⤵
- Executes dropped EXE
PID:4188 -
\??\c:\rrxrlff.exec:\rrxrlff.exe58⤵
- Executes dropped EXE
PID:4572 -
\??\c:\llxrxxl.exec:\llxrxxl.exe59⤵
- Executes dropped EXE
PID:5040 -
\??\c:\9bhhnn.exec:\9bhhnn.exe60⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pddvp.exec:\pddvp.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\lllfxxx.exec:\lllfxxx.exe62⤵
- Executes dropped EXE
PID:468 -
\??\c:\nhbntn.exec:\nhbntn.exe63⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pjppv.exec:\pjppv.exe64⤵
- Executes dropped EXE
PID:4716 -
\??\c:\1xxrxrl.exec:\1xxrxrl.exe65⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lffxxxx.exec:\lffxxxx.exe66⤵PID:3500
-
\??\c:\5bhhbb.exec:\5bhhbb.exe67⤵PID:2076
-
\??\c:\dvvvj.exec:\dvvvj.exe68⤵PID:4984
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe69⤵PID:4368
-
\??\c:\rffxrlf.exec:\rffxrlf.exe70⤵PID:316
-
\??\c:\hbnhbh.exec:\hbnhbh.exe71⤵PID:2912
-
\??\c:\djdvp.exec:\djdvp.exe72⤵PID:2592
-
\??\c:\xlrrxxr.exec:\xlrrxxr.exe73⤵PID:4020
-
\??\c:\tthhbt.exec:\tthhbt.exe74⤵PID:4568
-
\??\c:\httnhb.exec:\httnhb.exe75⤵PID:2976
-
\??\c:\vjpjd.exec:\vjpjd.exe76⤵PID:4880
-
\??\c:\xrlllfx.exec:\xrlllfx.exe77⤵PID:668
-
\??\c:\tntttb.exec:\tntttb.exe78⤵PID:2072
-
\??\c:\vdjvp.exec:\vdjvp.exe79⤵PID:1028
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe80⤵PID:3536
-
\??\c:\7hnntt.exec:\7hnntt.exe81⤵PID:2080
-
\??\c:\ppjvp.exec:\ppjvp.exe82⤵PID:3084
-
\??\c:\vpjjd.exec:\vpjjd.exe83⤵PID:4220
-
\??\c:\frlfxxr.exec:\frlfxxr.exe84⤵PID:2364
-
\??\c:\hbbbth.exec:\hbbbth.exe85⤵PID:4376
-
\??\c:\dvvvp.exec:\dvvvp.exe86⤵PID:4576
-
\??\c:\9fllflf.exec:\9fllflf.exe87⤵PID:4564
-
\??\c:\btbthh.exec:\btbthh.exe88⤵PID:4004
-
\??\c:\jjjdd.exec:\jjjdd.exe89⤵PID:964
-
\??\c:\pvddv.exec:\pvddv.exe90⤵PID:4784
-
\??\c:\lxxrlll.exec:\lxxrlll.exe91⤵PID:3988
-
\??\c:\hbtbbb.exec:\hbtbbb.exe92⤵PID:1496
-
\??\c:\pvdvp.exec:\pvdvp.exe93⤵PID:4052
-
\??\c:\rrlfffl.exec:\rrlfffl.exe94⤵PID:1108
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe95⤵PID:4228
-
\??\c:\hhbthh.exec:\hhbthh.exe96⤵PID:988
-
\??\c:\vpjjd.exec:\vpjjd.exe97⤵PID:3144
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe98⤵PID:5024
-
\??\c:\tbhhbb.exec:\tbhhbb.exe99⤵PID:752
-
\??\c:\pddvp.exec:\pddvp.exe100⤵PID:4652
-
\??\c:\vppjd.exec:\vppjd.exe101⤵PID:4352
-
\??\c:\1rxlffx.exec:\1rxlffx.exe102⤵PID:4008
-
\??\c:\hbnhnn.exec:\hbnhnn.exe103⤵PID:2784
-
\??\c:\dddpv.exec:\dddpv.exe104⤵PID:4116
-
\??\c:\fffxfxf.exec:\fffxfxf.exe105⤵PID:1552
-
\??\c:\lrffxrl.exec:\lrffxrl.exe106⤵PID:1260
-
\??\c:\hbtnnh.exec:\hbtnnh.exe107⤵PID:4360
-
\??\c:\vppjd.exec:\vppjd.exe108⤵PID:2824
-
\??\c:\1lrrrlx.exec:\1lrrrlx.exe109⤵PID:3748
-
\??\c:\nhnnnn.exec:\nhnnnn.exe110⤵PID:2400
-
\??\c:\3djdj.exec:\3djdj.exe111⤵PID:3236
-
\??\c:\pjjjd.exec:\pjjjd.exe112⤵PID:852
-
\??\c:\9lrlrrr.exec:\9lrlrrr.exe113⤵PID:4816
-
\??\c:\nnbntn.exec:\nnbntn.exe114⤵PID:3112
-
\??\c:\ddjjd.exec:\ddjjd.exe115⤵PID:2256
-
\??\c:\xrrrlll.exec:\xrrrlll.exe116⤵PID:2288
-
\??\c:\3hthbn.exec:\3hthbn.exe117⤵PID:876
-
\??\c:\7jpjp.exec:\7jpjp.exe118⤵PID:1584
-
\??\c:\vjjjv.exec:\vjjjv.exe119⤵PID:4312
-
\??\c:\rffxrlf.exec:\rffxrlf.exe120⤵PID:3924
-
\??\c:\btbbbt.exec:\btbbbt.exe121⤵PID:4188
-
\??\c:\jvddv.exec:\jvddv.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-