Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 22:22
Behavioral task
behavioral1
Sample
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
Resource
win7-20240903-en
General
-
Target
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
-
Size
79KB
-
MD5
cb863cf8e93ff7a43298f94c189444f3
-
SHA1
3588f9310b77dbf1090386779171d43b3650f89e
-
SHA256
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3
-
SHA512
449141698b3ab7120a47c017e3c2c91b2df0874e0916db01ac9fd6c123684116006c8112987981807f664c2298e00ed911efddd0c8dc047bb03804d120221841
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2B:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3092-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2960-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-713-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-873-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-938-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-1036-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-1394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2764 dddpd.exe 2912 rfxlfxr.exe 5060 rxxrllf.exe 4432 thhbtn.exe 3944 jpppp.exe 232 rlrflll.exe 3460 btnhbt.exe 876 vdvpd.exe 4280 vpvvp.exe 2648 rllfllr.exe 628 bbhbth.exe 2116 vpdpj.exe 4952 ddvpv.exe 3124 flfxlfr.exe 2156 bbbtnh.exe 2452 7bhbbb.exe 812 jvvpd.exe 4664 dvjvj.exe 4584 jvddp.exe 2872 7rflxrr.exe 216 btnhbt.exe 4536 1vdpj.exe 3960 rfffxlf.exe 2264 5xxrffr.exe 752 hhthtn.exe 2336 pjvpj.exe 4640 ffrlxxl.exe 3760 5bnnbt.exe 1416 pdjdv.exe 2540 llrlxxx.exe 4780 lfrlfxr.exe 2868 hnhbbt.exe 4852 bbbtbt.exe 4180 3dvpj.exe 436 lxxxrxx.exe 3716 ffxrlfx.exe 3100 ppjdd.exe 3584 ddvvp.exe 3604 3lxfxlx.exe 2228 rllfrlf.exe 2544 tbbhbh.exe 5056 dpjdp.exe 3360 fllxlfl.exe 2044 hbbttt.exe 1440 ddvpd.exe 4984 1jdpv.exe 1752 hnnhtn.exe 1072 jpjdv.exe 2980 fxrfrlf.exe 2732 btbtnh.exe 2960 dpjdv.exe 4196 pjdvv.exe 5076 xlfxlxl.exe 3868 lllxxrl.exe 2668 tntntn.exe 952 ddjjj.exe 5028 vvjjd.exe 2492 xfxfxrr.exe 4840 rflxrxr.exe 1168 ttttnn.exe 876 djddv.exe 2808 rxxrrlf.exe 2104 frrlxxr.exe 4636 ttbthh.exe -
resource yara_rule behavioral2/memory/3092-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bb6-3.dat upx behavioral2/memory/3092-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c98-9.dat upx behavioral2/memory/2764-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca1-13.dat upx behavioral2/memory/5060-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2912-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca2-22.dat upx behavioral2/memory/5060-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca3-29.dat upx behavioral2/memory/4432-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca5-34.dat upx behavioral2/memory/3944-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/232-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-42.dat upx behavioral2/files/0x0007000000023ca7-46.dat upx behavioral2/files/0x0007000000023ca8-51.dat upx behavioral2/memory/876-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca9-57.dat upx behavioral2/files/0x0007000000023caa-62.dat upx behavioral2/files/0x0007000000023cab-67.dat upx behavioral2/files/0x0007000000023cac-72.dat upx behavioral2/memory/2116-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cad-79.dat upx behavioral2/memory/3124-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cae-85.dat upx behavioral2/files/0x0007000000023caf-90.dat upx behavioral2/memory/4952-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-96.dat upx behavioral2/memory/812-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-102.dat upx behavioral2/memory/4664-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2452-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-109.dat upx behavioral2/files/0x0007000000023cb3-114.dat upx behavioral2/memory/2872-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4584-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ca6-121.dat upx behavioral2/files/0x0007000000023cb4-125.dat upx behavioral2/files/0x0007000000023cb5-131.dat upx behavioral2/memory/4536-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3960-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-137.dat upx behavioral2/files/0x0007000000023cb7-142.dat upx behavioral2/files/0x0007000000023cb8-149.dat upx behavioral2/memory/752-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-154.dat upx behavioral2/files/0x0007000000023cba-160.dat upx behavioral2/memory/4640-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-166.dat upx behavioral2/memory/3760-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c99-171.dat upx behavioral2/memory/2540-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-177.dat upx behavioral2/files/0x0007000000023cbd-181.dat upx behavioral2/memory/2868-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4180-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/436-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3100-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3604-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2544-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3360-225-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-229-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 2764 3092 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 3092 wrote to memory of 2764 3092 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 3092 wrote to memory of 2764 3092 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 2764 wrote to memory of 2912 2764 dddpd.exe 84 PID 2764 wrote to memory of 2912 2764 dddpd.exe 84 PID 2764 wrote to memory of 2912 2764 dddpd.exe 84 PID 2912 wrote to memory of 5060 2912 rfxlfxr.exe 85 PID 2912 wrote to memory of 5060 2912 rfxlfxr.exe 85 PID 2912 wrote to memory of 5060 2912 rfxlfxr.exe 85 PID 5060 wrote to memory of 4432 5060 rxxrllf.exe 86 PID 5060 wrote to memory of 4432 5060 rxxrllf.exe 86 PID 5060 wrote to memory of 4432 5060 rxxrllf.exe 86 PID 4432 wrote to memory of 3944 4432 thhbtn.exe 87 PID 4432 wrote to memory of 3944 4432 thhbtn.exe 87 PID 4432 wrote to memory of 3944 4432 thhbtn.exe 87 PID 3944 wrote to memory of 232 3944 jpppp.exe 88 PID 3944 wrote to memory of 232 3944 jpppp.exe 88 PID 3944 wrote to memory of 232 3944 jpppp.exe 88 PID 232 wrote to memory of 3460 232 rlrflll.exe 89 PID 232 wrote to memory of 3460 232 rlrflll.exe 89 PID 232 wrote to memory of 3460 232 rlrflll.exe 89 PID 3460 wrote to memory of 876 3460 btnhbt.exe 90 PID 3460 wrote to memory of 876 3460 btnhbt.exe 90 PID 3460 wrote to memory of 876 3460 btnhbt.exe 90 PID 876 wrote to memory of 4280 876 vdvpd.exe 91 PID 876 wrote to memory of 4280 876 vdvpd.exe 91 PID 876 wrote to memory of 4280 876 vdvpd.exe 91 PID 4280 wrote to memory of 2648 4280 vpvvp.exe 92 PID 4280 wrote to memory of 2648 4280 vpvvp.exe 92 PID 4280 wrote to memory of 2648 4280 vpvvp.exe 92 PID 2648 wrote to memory of 628 2648 rllfllr.exe 93 PID 2648 wrote to memory of 628 2648 rllfllr.exe 93 PID 2648 wrote to memory of 628 2648 rllfllr.exe 93 PID 628 wrote to memory of 2116 628 bbhbth.exe 94 PID 628 wrote to memory of 2116 628 bbhbth.exe 94 PID 628 wrote to memory of 2116 628 bbhbth.exe 94 PID 2116 wrote to memory of 4952 2116 vpdpj.exe 95 PID 2116 wrote to memory of 4952 2116 vpdpj.exe 95 PID 2116 wrote to memory of 4952 2116 vpdpj.exe 95 PID 4952 wrote to memory of 3124 4952 ddvpv.exe 96 PID 4952 wrote to memory of 3124 4952 ddvpv.exe 96 PID 4952 wrote to memory of 3124 4952 ddvpv.exe 96 PID 3124 wrote to memory of 2156 3124 flfxlfr.exe 97 PID 3124 wrote to memory of 2156 3124 flfxlfr.exe 97 PID 3124 wrote to memory of 2156 3124 flfxlfr.exe 97 PID 2156 wrote to memory of 2452 2156 bbbtnh.exe 98 PID 2156 wrote to memory of 2452 2156 bbbtnh.exe 98 PID 2156 wrote to memory of 2452 2156 bbbtnh.exe 98 PID 2452 wrote to memory of 812 2452 7bhbbb.exe 99 PID 2452 wrote to memory of 812 2452 7bhbbb.exe 99 PID 2452 wrote to memory of 812 2452 7bhbbb.exe 99 PID 812 wrote to memory of 4664 812 jvvpd.exe 100 PID 812 wrote to memory of 4664 812 jvvpd.exe 100 PID 812 wrote to memory of 4664 812 jvvpd.exe 100 PID 4664 wrote to memory of 4584 4664 dvjvj.exe 101 PID 4664 wrote to memory of 4584 4664 dvjvj.exe 101 PID 4664 wrote to memory of 4584 4664 dvjvj.exe 101 PID 4584 wrote to memory of 2872 4584 jvddp.exe 102 PID 4584 wrote to memory of 2872 4584 jvddp.exe 102 PID 4584 wrote to memory of 2872 4584 jvddp.exe 102 PID 2872 wrote to memory of 216 2872 7rflxrr.exe 103 PID 2872 wrote to memory of 216 2872 7rflxrr.exe 103 PID 2872 wrote to memory of 216 2872 7rflxrr.exe 103 PID 216 wrote to memory of 4536 216 btnhbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\dddpd.exec:\dddpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rfxlfxr.exec:\rfxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rxxrllf.exec:\rxxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\thhbtn.exec:\thhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\jpppp.exec:\jpppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\rlrflll.exec:\rlrflll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\btnhbt.exec:\btnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\vdvpd.exec:\vdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\vpvvp.exec:\vpvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\rllfllr.exec:\rllfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\bbhbth.exec:\bbhbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\vpdpj.exec:\vpdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\ddvpv.exec:\ddvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\flfxlfr.exec:\flfxlfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\bbbtnh.exec:\bbbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\7bhbbb.exec:\7bhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\jvvpd.exec:\jvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\dvjvj.exec:\dvjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\jvddp.exec:\jvddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\7rflxrr.exec:\7rflxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\btnhbt.exec:\btnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\1vdpj.exec:\1vdpj.exe23⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rfffxlf.exec:\rfffxlf.exe24⤵
- Executes dropped EXE
PID:3960 -
\??\c:\5xxrffr.exec:\5xxrffr.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hhthtn.exec:\hhthtn.exe26⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjvpj.exec:\pjvpj.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe28⤵
- Executes dropped EXE
PID:4640 -
\??\c:\5bnnbt.exec:\5bnnbt.exe29⤵
- Executes dropped EXE
PID:3760 -
\??\c:\pdjdv.exec:\pdjdv.exe30⤵
- Executes dropped EXE
PID:1416 -
\??\c:\llrlxxx.exec:\llrlxxx.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe32⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hnhbbt.exec:\hnhbbt.exe33⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bbbtbt.exec:\bbbtbt.exe34⤵
- Executes dropped EXE
PID:4852 -
\??\c:\3dvpj.exec:\3dvpj.exe35⤵
- Executes dropped EXE
PID:4180 -
\??\c:\lxxxrxx.exec:\lxxxrxx.exe36⤵
- Executes dropped EXE
PID:436 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe37⤵
- Executes dropped EXE
PID:3716 -
\??\c:\ppjdd.exec:\ppjdd.exe38⤵
- Executes dropped EXE
PID:3100 -
\??\c:\ddvvp.exec:\ddvvp.exe39⤵
- Executes dropped EXE
PID:3584 -
\??\c:\3lxfxlx.exec:\3lxfxlx.exe40⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rllfrlf.exec:\rllfrlf.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tbbhbh.exec:\tbbhbh.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\dpjdp.exec:\dpjdp.exe43⤵
- Executes dropped EXE
PID:5056 -
\??\c:\fllxlfl.exec:\fllxlfl.exe44⤵
- Executes dropped EXE
PID:3360 -
\??\c:\hbbttt.exec:\hbbttt.exe45⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ddvpd.exec:\ddvpd.exe46⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1jdpv.exec:\1jdpv.exe47⤵
- Executes dropped EXE
PID:4984 -
\??\c:\hnnhtn.exec:\hnnhtn.exe48⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jpjdv.exec:\jpjdv.exe49⤵
- Executes dropped EXE
PID:1072 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe50⤵
- Executes dropped EXE
PID:2980 -
\??\c:\3rffllf.exec:\3rffllf.exe51⤵PID:4292
-
\??\c:\btbtnh.exec:\btbtnh.exe52⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dpjdv.exec:\dpjdv.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pjdvv.exec:\pjdvv.exe54⤵
- Executes dropped EXE
PID:4196 -
\??\c:\xlfxlxl.exec:\xlfxlxl.exe55⤵
- Executes dropped EXE
PID:5076 -
\??\c:\lllxxrl.exec:\lllxxrl.exe56⤵
- Executes dropped EXE
PID:3868 -
\??\c:\tntntn.exec:\tntntn.exe57⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ddjjj.exec:\ddjjj.exe58⤵
- Executes dropped EXE
PID:952 -
\??\c:\vvjjd.exec:\vvjjd.exe59⤵
- Executes dropped EXE
PID:5028 -
\??\c:\xfxfxrr.exec:\xfxfxrr.exe60⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rflxrxr.exec:\rflxrxr.exe61⤵
- Executes dropped EXE
PID:4840 -
\??\c:\ttttnn.exec:\ttttnn.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\djddv.exec:\djddv.exe63⤵
- Executes dropped EXE
PID:876 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe64⤵
- Executes dropped EXE
PID:2808 -
\??\c:\frrlxxr.exec:\frrlxxr.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ttbthh.exec:\ttbthh.exe66⤵
- Executes dropped EXE
PID:4636 -
\??\c:\ddvpd.exec:\ddvpd.exe67⤵PID:3020
-
\??\c:\llfrlxr.exec:\llfrlxr.exe68⤵PID:4316
-
\??\c:\9hbbtn.exec:\9hbbtn.exe69⤵PID:636
-
\??\c:\vdjvd.exec:\vdjvd.exe70⤵PID:4952
-
\??\c:\xxfrlfl.exec:\xxfrlfl.exe71⤵PID:4756
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe72⤵PID:2440
-
\??\c:\5tnnnh.exec:\5tnnnh.exe73⤵PID:4284
-
\??\c:\nnnnbt.exec:\nnnnbt.exe74⤵PID:2424
-
\??\c:\xrflflf.exec:\xrflflf.exe75⤵PID:812
-
\??\c:\9nnnhn.exec:\9nnnhn.exe76⤵PID:2944
-
\??\c:\pvddv.exec:\pvddv.exe77⤵PID:2296
-
\??\c:\jvpvp.exec:\jvpvp.exe78⤵PID:4772
-
\??\c:\llfxllx.exec:\llfxllx.exe79⤵PID:3552
-
\??\c:\lfrlxxl.exec:\lfrlxxl.exe80⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\tntnbt.exec:\tntnbt.exe81⤵PID:4004
-
\??\c:\hnhbbb.exec:\hnhbbb.exe82⤵PID:216
-
\??\c:\vjddv.exec:\vjddv.exe83⤵PID:1796
-
\??\c:\pjpjv.exec:\pjpjv.exe84⤵PID:2824
-
\??\c:\lxrrrrf.exec:\lxrrrrf.exe85⤵PID:1504
-
\??\c:\fxfrfff.exec:\fxfrfff.exe86⤵PID:1648
-
\??\c:\1hbthb.exec:\1hbthb.exe87⤵PID:5004
-
\??\c:\bbtbtn.exec:\bbtbtn.exe88⤵PID:4236
-
\??\c:\hbhhht.exec:\hbhhht.exe89⤵PID:1952
-
\??\c:\vvdvv.exec:\vvdvv.exe90⤵PID:2888
-
\??\c:\xxlfrff.exec:\xxlfrff.exe91⤵PID:4916
-
\??\c:\bbbbbb.exec:\bbbbbb.exe92⤵PID:3452
-
\??\c:\vpdvp.exec:\vpdvp.exe93⤵PID:4424
-
\??\c:\vpvdd.exec:\vpvdd.exe94⤵PID:4780
-
\??\c:\9lffffx.exec:\9lffffx.exe95⤵PID:2852
-
\??\c:\frlxrrl.exec:\frlxrrl.exe96⤵PID:884
-
\??\c:\nttntb.exec:\nttntb.exe97⤵PID:3012
-
\??\c:\3btnhh.exec:\3btnhh.exe98⤵PID:436
-
\??\c:\dvddj.exec:\dvddj.exe99⤵PID:4548
-
\??\c:\pvvjd.exec:\pvvjd.exe100⤵PID:4452
-
\??\c:\lfllfxr.exec:\lfllfxr.exe101⤵PID:924
-
\??\c:\fflxxxx.exec:\fflxxxx.exe102⤵PID:1568
-
\??\c:\nhnnhb.exec:\nhnnhb.exe103⤵PID:4508
-
\??\c:\nhnhht.exec:\nhnhht.exe104⤵PID:2228
-
\??\c:\5ddvp.exec:\5ddvp.exe105⤵PID:1836
-
\??\c:\pvdpd.exec:\pvdpd.exe106⤵PID:4356
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe107⤵PID:2892
-
\??\c:\thhtnh.exec:\thhtnh.exe108⤵PID:2044
-
\??\c:\htbhtn.exec:\htbhtn.exe109⤵PID:5068
-
\??\c:\jvppv.exec:\jvppv.exe110⤵PID:1356
-
\??\c:\djvvj.exec:\djvvj.exe111⤵PID:1852
-
\??\c:\fllfxrx.exec:\fllfxrx.exe112⤵PID:1940
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe113⤵PID:3048
-
\??\c:\nnhbtt.exec:\nnhbtt.exe114⤵PID:368
-
\??\c:\tbhhhh.exec:\tbhhhh.exe115⤵PID:3128
-
\??\c:\vvjdj.exec:\vvjdj.exe116⤵PID:1524
-
\??\c:\xrllllx.exec:\xrllllx.exe117⤵PID:976
-
\??\c:\xffxllf.exec:\xffxllf.exe118⤵PID:5060
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe119⤵PID:5076
-
\??\c:\tnhbnb.exec:\tnhbnb.exe120⤵PID:116
-
\??\c:\9pppd.exec:\9pppd.exe121⤵PID:872
-
\??\c:\rxrllff.exec:\rxrllff.exe122⤵PID:736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-