Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 23:17
Behavioral task
behavioral1
Sample
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe
Resource
win7-20240903-en
General
-
Target
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe
-
Size
332KB
-
MD5
3576c8b5fe7b135f7b3c50292490eabb
-
SHA1
b7421cc3b458e70e701b77c2a1190cc1f7b6a6d4
-
SHA256
84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb
-
SHA512
f413172ae22520b2818a1ec704704ca76a64f3305904dc539cb48db9c6eb86bbb54a1d9e147fc9b4346cbb9e53c67443f84572462a9c6c8f4c391c186fc3f4ff
-
SSDEEP
6144:vcm4FmowdHoStJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7t0:94wFHoStJdSjylh2b77BoTMA9gX59sTM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1396-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3092-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1956-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3216-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-511-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-668-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-1000-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4536 hnbbbh.exe 3480 llfffxl.exe 5064 9nhhtn.exe 2348 ppvdv.exe 1016 xrrxrxl.exe 3228 hhtttn.exe 4420 xlxfffl.exe 3380 vjjjj.exe 4896 tbthtt.exe 4804 jdpvd.exe 4244 lflrrxf.exe 856 hhhnhn.exe 2012 pvdjj.exe 2124 lfxffrx.exe 4996 lrffffl.exe 2340 djvdp.exe 3932 fxlrrxf.exe 3996 vvvvj.exe 3516 tntbhn.exe 3092 tnnhtn.exe 632 ppdjj.exe 4016 ffxxxll.exe 5108 ddvvv.exe 3904 rrrlffx.exe 4588 rlfrrlx.exe 1956 hntbhn.exe 1192 nhbbhn.exe 3592 vpjjd.exe 1112 rrfflxx.exe 368 lfxfflr.exe 976 7tbhht.exe 2332 bhhhhn.exe 3776 jpvdd.exe 1532 lrfxffx.exe 4912 xffflrr.exe 2028 hthhhh.exe 2796 jjvvp.exe 1632 jdvvj.exe 3924 xfxfrlf.exe 1648 tntbbn.exe 916 tnnhht.exe 4512 vvdjj.exe 1928 lrrrfrf.exe 4776 xlllllr.exe 3668 hbtnbn.exe 2272 djpdj.exe 2920 jpppd.exe 2640 lrlxlfr.exe 3612 nnhhhn.exe 4084 vpvpj.exe 4828 jddvd.exe 3104 flfrxll.exe 2448 bnhbbb.exe 3408 jjvvp.exe 3328 bttbbb.exe 1396 nbbtnb.exe 2392 pvpvv.exe 4268 djdjv.exe 4008 bntbhn.exe 3656 5pvdd.exe 3768 bhbhhb.exe 2200 ntttbt.exe 2792 rrlrfll.exe 4620 xxrxrxr.exe -
resource yara_rule behavioral2/memory/1396-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b43-3.dat upx behavioral2/memory/1396-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-8.dat upx behavioral2/memory/4536-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-11.dat upx behavioral2/memory/5064-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2348-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-20.dat upx behavioral2/memory/1016-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-25.dat upx behavioral2/memory/3480-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-29.dat upx behavioral2/memory/1016-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-34.dat upx behavioral2/memory/3228-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9d-39.dat upx behavioral2/memory/4420-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-45.dat upx behavioral2/memory/3380-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-50.dat upx behavioral2/memory/4896-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-54.dat upx behavioral2/files/0x000a000000023ba2-63.dat upx behavioral2/memory/2012-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba4-75.dat upx behavioral2/files/0x000a000000023ba5-78.dat upx behavioral2/memory/4996-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-70.dat upx behavioral2/memory/856-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba1-60.dat upx behavioral2/memory/4804-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba6-83.dat upx behavioral2/files/0x000b000000023b94-89.dat upx behavioral2/memory/3932-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3996-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-93.dat upx behavioral2/files/0x000a000000023ba9-97.dat upx behavioral2/files/0x000a000000023baa-102.dat upx behavioral2/memory/3092-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-108.dat upx behavioral2/memory/4016-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5108-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bae-123.dat upx behavioral2/files/0x000a000000023baf-127.dat upx behavioral2/files/0x000a000000023bb0-132.dat upx behavioral2/files/0x000a000000023bb1-137.dat upx behavioral2/files/0x000b000000023bb2-142.dat upx behavioral2/memory/1532-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3924-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3776-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2332-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bbc-156.dat upx behavioral2/files/0x000b000000023bb4-152.dat upx behavioral2/memory/368-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb3-147.dat upx behavioral2/memory/1112-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3592-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1956-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3904-120-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 4536 1396 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 82 PID 1396 wrote to memory of 4536 1396 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 82 PID 1396 wrote to memory of 4536 1396 84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe 82 PID 4536 wrote to memory of 3480 4536 hnbbbh.exe 83 PID 4536 wrote to memory of 3480 4536 hnbbbh.exe 83 PID 4536 wrote to memory of 3480 4536 hnbbbh.exe 83 PID 3480 wrote to memory of 5064 3480 llfffxl.exe 84 PID 3480 wrote to memory of 5064 3480 llfffxl.exe 84 PID 3480 wrote to memory of 5064 3480 llfffxl.exe 84 PID 5064 wrote to memory of 2348 5064 9nhhtn.exe 85 PID 5064 wrote to memory of 2348 5064 9nhhtn.exe 85 PID 5064 wrote to memory of 2348 5064 9nhhtn.exe 85 PID 2348 wrote to memory of 1016 2348 ppvdv.exe 86 PID 2348 wrote to memory of 1016 2348 ppvdv.exe 86 PID 2348 wrote to memory of 1016 2348 ppvdv.exe 86 PID 1016 wrote to memory of 3228 1016 xrrxrxl.exe 87 PID 1016 wrote to memory of 3228 1016 xrrxrxl.exe 87 PID 1016 wrote to memory of 3228 1016 xrrxrxl.exe 87 PID 3228 wrote to memory of 4420 3228 hhtttn.exe 88 PID 3228 wrote to memory of 4420 3228 hhtttn.exe 88 PID 3228 wrote to memory of 4420 3228 hhtttn.exe 88 PID 4420 wrote to memory of 3380 4420 xlxfffl.exe 89 PID 4420 wrote to memory of 3380 4420 xlxfffl.exe 89 PID 4420 wrote to memory of 3380 4420 xlxfffl.exe 89 PID 3380 wrote to memory of 4896 3380 vjjjj.exe 90 PID 3380 wrote to memory of 4896 3380 vjjjj.exe 90 PID 3380 wrote to memory of 4896 3380 vjjjj.exe 90 PID 4896 wrote to memory of 4804 4896 tbthtt.exe 91 PID 4896 wrote to memory of 4804 4896 tbthtt.exe 91 PID 4896 wrote to memory of 4804 4896 tbthtt.exe 91 PID 4804 wrote to memory of 4244 4804 jdpvd.exe 92 PID 4804 wrote to memory of 4244 4804 jdpvd.exe 92 PID 4804 wrote to memory of 4244 4804 jdpvd.exe 92 PID 4244 wrote to memory of 856 4244 lflrrxf.exe 93 PID 4244 wrote to memory of 856 4244 lflrrxf.exe 93 PID 4244 wrote to memory of 856 4244 lflrrxf.exe 93 PID 856 wrote to memory of 2012 856 hhhnhn.exe 94 PID 856 wrote to memory of 2012 856 hhhnhn.exe 94 PID 856 wrote to memory of 2012 856 hhhnhn.exe 94 PID 2012 wrote to memory of 2124 2012 pvdjj.exe 95 PID 2012 wrote to memory of 2124 2012 pvdjj.exe 95 PID 2012 wrote to memory of 2124 2012 pvdjj.exe 95 PID 2124 wrote to memory of 4996 2124 lfxffrx.exe 96 PID 2124 wrote to memory of 4996 2124 lfxffrx.exe 96 PID 2124 wrote to memory of 4996 2124 lfxffrx.exe 96 PID 4996 wrote to memory of 2340 4996 lrffffl.exe 97 PID 4996 wrote to memory of 2340 4996 lrffffl.exe 97 PID 4996 wrote to memory of 2340 4996 lrffffl.exe 97 PID 2340 wrote to memory of 3932 2340 djvdp.exe 98 PID 2340 wrote to memory of 3932 2340 djvdp.exe 98 PID 2340 wrote to memory of 3932 2340 djvdp.exe 98 PID 3932 wrote to memory of 3996 3932 fxlrrxf.exe 99 PID 3932 wrote to memory of 3996 3932 fxlrrxf.exe 99 PID 3932 wrote to memory of 3996 3932 fxlrrxf.exe 99 PID 3996 wrote to memory of 3516 3996 vvvvj.exe 100 PID 3996 wrote to memory of 3516 3996 vvvvj.exe 100 PID 3996 wrote to memory of 3516 3996 vvvvj.exe 100 PID 3516 wrote to memory of 3092 3516 tntbhn.exe 101 PID 3516 wrote to memory of 3092 3516 tntbhn.exe 101 PID 3516 wrote to memory of 3092 3516 tntbhn.exe 101 PID 3092 wrote to memory of 632 3092 tnnhtn.exe 102 PID 3092 wrote to memory of 632 3092 tnnhtn.exe 102 PID 3092 wrote to memory of 632 3092 tnnhtn.exe 102 PID 632 wrote to memory of 4016 632 ppdjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe"C:\Users\Admin\AppData\Local\Temp\84ad9fda14d613cfd665b5fe37ad915b8db34e888ab8ccdc877a95da97c3cbbb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hnbbbh.exec:\hnbbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\llfffxl.exec:\llfffxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\9nhhtn.exec:\9nhhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\ppvdv.exec:\ppvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\xrrxrxl.exec:\xrrxrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\hhtttn.exec:\hhtttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\xlxfffl.exec:\xlxfffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\vjjjj.exec:\vjjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\tbthtt.exec:\tbthtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\jdpvd.exec:\jdpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lflrrxf.exec:\lflrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\hhhnhn.exec:\hhhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\pvdjj.exec:\pvdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\lfxffrx.exec:\lfxffrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lrffffl.exec:\lrffffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\djvdp.exec:\djvdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\vvvvj.exec:\vvvvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\tntbhn.exec:\tntbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\tnnhtn.exec:\tnnhtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\ppdjj.exec:\ppdjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\ffxxxll.exec:\ffxxxll.exe23⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ddvvv.exec:\ddvvv.exe24⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rrrlffx.exec:\rrrlffx.exe25⤵
- Executes dropped EXE
PID:3904 -
\??\c:\rlfrrlx.exec:\rlfrrlx.exe26⤵
- Executes dropped EXE
PID:4588 -
\??\c:\hntbhn.exec:\hntbhn.exe27⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhbbhn.exec:\nhbbhn.exe28⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vpjjd.exec:\vpjjd.exe29⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rrfflxx.exec:\rrfflxx.exe30⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lfxfflr.exec:\lfxfflr.exe31⤵
- Executes dropped EXE
PID:368 -
\??\c:\7tbhht.exec:\7tbhht.exe32⤵
- Executes dropped EXE
PID:976 -
\??\c:\bhhhhn.exec:\bhhhhn.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jpvdd.exec:\jpvdd.exe34⤵
- Executes dropped EXE
PID:3776 -
\??\c:\lrfxffx.exec:\lrfxffx.exe35⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xffflrr.exec:\xffflrr.exe36⤵
- Executes dropped EXE
PID:4912 -
\??\c:\hthhhh.exec:\hthhhh.exe37⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jjvvp.exec:\jjvvp.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdvvj.exec:\jdvvj.exe39⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xfxfrlf.exec:\xfxfrlf.exe40⤵
- Executes dropped EXE
PID:3924 -
\??\c:\tntbbn.exec:\tntbbn.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tnnhht.exec:\tnnhht.exe42⤵
- Executes dropped EXE
PID:916 -
\??\c:\vvdjj.exec:\vvdjj.exe43⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lrrrfrf.exec:\lrrrfrf.exe44⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xlllllr.exec:\xlllllr.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\hbtnbn.exec:\hbtnbn.exe46⤵
- Executes dropped EXE
PID:3668 -
\??\c:\djpdj.exec:\djpdj.exe47⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jpppd.exec:\jpppd.exe48⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe49⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nnhhhn.exec:\nnhhhn.exe50⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vpvpj.exec:\vpvpj.exe51⤵
- Executes dropped EXE
PID:4084 -
\??\c:\jddvd.exec:\jddvd.exe52⤵
- Executes dropped EXE
PID:4828 -
\??\c:\flfrxll.exec:\flfrxll.exe53⤵
- Executes dropped EXE
PID:3104 -
\??\c:\bnhbbb.exec:\bnhbbb.exe54⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjvvp.exec:\jjvvp.exe55⤵
- Executes dropped EXE
PID:3408 -
\??\c:\bttbbb.exec:\bttbbb.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\dvjdv.exec:\dvjdv.exe57⤵PID:3028
-
\??\c:\nbbtnb.exec:\nbbtnb.exe58⤵
- Executes dropped EXE
PID:1396 -
\??\c:\pvpvv.exec:\pvpvv.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\djdjv.exec:\djdjv.exe60⤵
- Executes dropped EXE
PID:4268 -
\??\c:\bntbhn.exec:\bntbhn.exe61⤵
- Executes dropped EXE
PID:4008 -
\??\c:\5pvdd.exec:\5pvdd.exe62⤵
- Executes dropped EXE
PID:3656 -
\??\c:\bhbhhb.exec:\bhbhhb.exe63⤵
- Executes dropped EXE
PID:3768 -
\??\c:\ntttbt.exec:\ntttbt.exe64⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rrlrfll.exec:\rrlrfll.exe65⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxrxrxr.exec:\xxrxrxr.exe66⤵
- Executes dropped EXE
PID:4620 -
\??\c:\ddjdj.exec:\ddjdj.exe67⤵PID:3216
-
\??\c:\lfxflrx.exec:\lfxflrx.exe68⤵PID:3228
-
\??\c:\bthhhh.exec:\bthhhh.exe69⤵PID:2896
-
\??\c:\jpddv.exec:\jpddv.exe70⤵PID:1184
-
\??\c:\bbnnnb.exec:\bbnnnb.exe71⤵PID:4896
-
\??\c:\xrffrrf.exec:\xrffrrf.exe72⤵PID:2052
-
\??\c:\nhtbbh.exec:\nhtbbh.exe73⤵PID:4804
-
\??\c:\bththb.exec:\bththb.exe74⤵PID:396
-
\??\c:\1rlllll.exec:\1rlllll.exe75⤵PID:4800
-
\??\c:\9lxfrrr.exec:\9lxfrrr.exe76⤵PID:4864
-
\??\c:\nttttt.exec:\nttttt.exe77⤵PID:2084
-
\??\c:\hntttb.exec:\hntttb.exe78⤵PID:2588
-
\??\c:\vpppv.exec:\vpppv.exe79⤵PID:4964
-
\??\c:\5lxrrxx.exec:\5lxrrxx.exe80⤵PID:4952
-
\??\c:\xrlflll.exec:\xrlflll.exe81⤵PID:4548
-
\??\c:\bbnntb.exec:\bbnntb.exe82⤵PID:1072
-
\??\c:\pvddv.exec:\pvddv.exe83⤵PID:2144
-
\??\c:\lrfrrxf.exec:\lrfrrxf.exe84⤵PID:3996
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe85⤵PID:2376
-
\??\c:\ttbbtt.exec:\ttbbtt.exe86⤵PID:4072
-
\??\c:\pvpvv.exec:\pvpvv.exe87⤵PID:4584
-
\??\c:\1dpdd.exec:\1dpdd.exe88⤵
- System Location Discovery: System Language Discovery
PID:4248 -
\??\c:\nhbbbb.exec:\nhbbbb.exe89⤵PID:4380
-
\??\c:\nnbnth.exec:\nnbnth.exe90⤵PID:4308
-
\??\c:\ddppd.exec:\ddppd.exe91⤵
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\rrxxflr.exec:\rrxxflr.exe92⤵PID:4588
-
\??\c:\hnhnbh.exec:\hnhnbh.exe93⤵PID:624
-
\??\c:\tbbnnt.exec:\tbbnnt.exe94⤵PID:5020
-
\??\c:\jvppp.exec:\jvppp.exe95⤵PID:2652
-
\??\c:\5llrlrr.exec:\5llrlrr.exe96⤵PID:2624
-
\??\c:\1bbbbt.exec:\1bbbbt.exe97⤵PID:368
-
\??\c:\bttbbt.exec:\bttbbt.exe98⤵PID:1948
-
\??\c:\ppddd.exec:\ppddd.exe99⤵PID:2332
-
\??\c:\jjppp.exec:\jjppp.exe100⤵PID:1456
-
\??\c:\xrfffll.exec:\xrfffll.exe101⤵PID:1848
-
\??\c:\nnttbh.exec:\nnttbh.exe102⤵PID:4912
-
\??\c:\tthhnt.exec:\tthhnt.exe103⤵PID:4920
-
\??\c:\ppjpp.exec:\ppjpp.exe104⤵PID:2564
-
\??\c:\1lxflrx.exec:\1lxflrx.exe105⤵PID:3868
-
\??\c:\htbhht.exec:\htbhht.exe106⤵PID:648
-
\??\c:\bhhthn.exec:\bhhthn.exe107⤵PID:3472
-
\??\c:\jpddp.exec:\jpddp.exe108⤵PID:4104
-
\??\c:\lrxflrx.exec:\lrxflrx.exe109⤵PID:4512
-
\??\c:\nhhttt.exec:\nhhttt.exe110⤵PID:4540
-
\??\c:\nhhhtt.exec:\nhhhtt.exe111⤵PID:2444
-
\??\c:\vvjjp.exec:\vvjjp.exe112⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\lfxxxfl.exec:\lfxxxfl.exe113⤵PID:4552
-
\??\c:\hnnnhn.exec:\hnnnhn.exe114⤵PID:1156
-
\??\c:\djjpv.exec:\djjpv.exe115⤵PID:3668
-
\??\c:\rxxffff.exec:\rxxffff.exe116⤵PID:2272
-
\??\c:\bnbnbt.exec:\bnbnbt.exe117⤵PID:2920
-
\??\c:\hbtttb.exec:\hbtttb.exe118⤵PID:2640
-
\??\c:\vpjjp.exec:\vpjjp.exe119⤵PID:3476
-
\??\c:\ddpvd.exec:\ddpvd.exe120⤵PID:5072
-
\??\c:\xfxxrlf.exec:\xfxxrlf.exe121⤵PID:1432
-
\??\c:\hnntnb.exec:\hnntnb.exe122⤵PID:4288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-