Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 22:30
Behavioral task
behavioral1
Sample
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
Resource
win7-20241010-en
General
-
Target
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe
-
Size
79KB
-
MD5
cb863cf8e93ff7a43298f94c189444f3
-
SHA1
3588f9310b77dbf1090386779171d43b3650f89e
-
SHA256
8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3
-
SHA512
449141698b3ab7120a47c017e3c2c91b2df0874e0916db01ac9fd6c123684116006c8112987981807f664c2298e00ed911efddd0c8dc047bb03804d120221841
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2B:xhOmTsF93UYfwC6GIout03LzGFE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3576-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2032-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/512-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-685-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-792-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-919-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-992-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-1029-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-1810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-2049-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 vvppj.exe 2188 7fllfll.exe 2032 ffllflf.exe 1816 bnnbbh.exe 2576 jjjjj.exe 5024 flrllff.exe 996 nntbtt.exe 936 jjppj.exe 1036 jpdvp.exe 3608 frllrxf.exe 2704 hbhnnn.exe 3548 rrxrrrr.exe 1552 nhhhbh.exe 4004 vjppp.exe 4516 pvvdv.exe 3928 rlrxxff.exe 3956 hnthhb.exe 4128 3dvpd.exe 4528 llrrfff.exe 4172 1lxfxfl.exe 512 7tnttt.exe 5028 dpjdp.exe 1932 9fxxrfr.exe 3228 djppj.exe 1804 pjjjj.exe 3260 ttbttt.exe 60 vvjjj.exe 4308 fxxxxfl.exe 4796 hhnntn.exe 3572 fxxxffl.exe 3940 bhhntt.exe 868 djjjj.exe 1876 jjppp.exe 4024 rrlrlfx.exe 212 hbntbt.exe 3280 pjjjj.exe 4676 pvddd.exe 3328 xrlffll.exe 1884 ntttnt.exe 2436 thnnnt.exe 4344 djddd.exe 4356 lrlxxlf.exe 4928 rfxflfl.exe 1824 nbhbtb.exe 4496 vjdvp.exe 436 jdvvv.exe 2820 frxxxrx.exe 3700 hhhttn.exe 1616 vddpj.exe 1228 rrxxffl.exe 3524 flxxrxl.exe 2408 nhbhbb.exe 4824 3bhnnt.exe 3304 djppv.exe 1112 xxxxxxx.exe 1964 rrfflrf.exe 3316 htbbhn.exe 3480 dppdv.exe 3616 xxxxrxx.exe 2572 lxrrflx.exe 3312 vdppd.exe 4596 5dppp.exe 3892 xxlllxx.exe 3152 hnnttb.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b33-3.dat upx behavioral2/memory/3576-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2856-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b92-10.dat upx behavioral2/memory/2188-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b93-14.dat upx behavioral2/memory/2032-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b94-22.dat upx behavioral2/files/0x000a000000023b95-27.dat upx behavioral2/memory/2576-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b96-36.dat upx behavioral2/memory/5024-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1816-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b97-40.dat upx behavioral2/memory/5024-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b98-46.dat upx behavioral2/memory/996-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b99-52.dat upx behavioral2/memory/936-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9a-57.dat upx behavioral2/memory/3608-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-62.dat upx behavioral2/files/0x000a000000023b9c-68.dat upx behavioral2/files/0x000a000000023b9d-73.dat upx behavioral2/memory/3548-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-79.dat upx behavioral2/memory/1552-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-86.dat upx behavioral2/files/0x000a000000023ba0-90.dat upx behavioral2/files/0x000a000000023ba1-95.dat upx behavioral2/memory/3928-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba2-101.dat upx behavioral2/memory/3956-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4128-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-109.dat upx behavioral2/memory/4528-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023ba4-115.dat upx behavioral2/files/0x000a000000023ba5-119.dat upx behavioral2/memory/4172-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0058000000023ba6-124.dat upx behavioral2/memory/512-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5028-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba7-132.dat upx behavioral2/memory/1932-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b8f-136.dat upx behavioral2/memory/3228-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba8-143.dat upx behavioral2/files/0x000a000000023ba9-149.dat upx behavioral2/memory/1804-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3260-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023baa-155.dat upx behavioral2/files/0x000a000000023bab-160.dat upx behavioral2/memory/60-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4308-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-167.dat upx behavioral2/files/0x000a000000023bad-172.dat upx behavioral2/files/0x000a000000023bae-177.dat upx behavioral2/files/0x000a000000023baf-181.dat upx behavioral2/memory/3328-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1884-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4344-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1824-226-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 2856 3576 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 3576 wrote to memory of 2856 3576 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 3576 wrote to memory of 2856 3576 8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe 83 PID 2856 wrote to memory of 2188 2856 vvppj.exe 84 PID 2856 wrote to memory of 2188 2856 vvppj.exe 84 PID 2856 wrote to memory of 2188 2856 vvppj.exe 84 PID 2188 wrote to memory of 2032 2188 7fllfll.exe 85 PID 2188 wrote to memory of 2032 2188 7fllfll.exe 85 PID 2188 wrote to memory of 2032 2188 7fllfll.exe 85 PID 2032 wrote to memory of 1816 2032 ffllflf.exe 86 PID 2032 wrote to memory of 1816 2032 ffllflf.exe 86 PID 2032 wrote to memory of 1816 2032 ffllflf.exe 86 PID 1816 wrote to memory of 2576 1816 bnnbbh.exe 87 PID 1816 wrote to memory of 2576 1816 bnnbbh.exe 87 PID 1816 wrote to memory of 2576 1816 bnnbbh.exe 87 PID 2576 wrote to memory of 5024 2576 jjjjj.exe 88 PID 2576 wrote to memory of 5024 2576 jjjjj.exe 88 PID 2576 wrote to memory of 5024 2576 jjjjj.exe 88 PID 5024 wrote to memory of 996 5024 flrllff.exe 89 PID 5024 wrote to memory of 996 5024 flrllff.exe 89 PID 5024 wrote to memory of 996 5024 flrllff.exe 89 PID 996 wrote to memory of 936 996 nntbtt.exe 90 PID 996 wrote to memory of 936 996 nntbtt.exe 90 PID 996 wrote to memory of 936 996 nntbtt.exe 90 PID 936 wrote to memory of 1036 936 jjppj.exe 91 PID 936 wrote to memory of 1036 936 jjppj.exe 91 PID 936 wrote to memory of 1036 936 jjppj.exe 91 PID 1036 wrote to memory of 3608 1036 jpdvp.exe 92 PID 1036 wrote to memory of 3608 1036 jpdvp.exe 92 PID 1036 wrote to memory of 3608 1036 jpdvp.exe 92 PID 3608 wrote to memory of 2704 3608 frllrxf.exe 93 PID 3608 wrote to memory of 2704 3608 frllrxf.exe 93 PID 3608 wrote to memory of 2704 3608 frllrxf.exe 93 PID 2704 wrote to memory of 3548 2704 hbhnnn.exe 94 PID 2704 wrote to memory of 3548 2704 hbhnnn.exe 94 PID 2704 wrote to memory of 3548 2704 hbhnnn.exe 94 PID 3548 wrote to memory of 1552 3548 rrxrrrr.exe 95 PID 3548 wrote to memory of 1552 3548 rrxrrrr.exe 95 PID 3548 wrote to memory of 1552 3548 rrxrrrr.exe 95 PID 1552 wrote to memory of 4004 1552 nhhhbh.exe 96 PID 1552 wrote to memory of 4004 1552 nhhhbh.exe 96 PID 1552 wrote to memory of 4004 1552 nhhhbh.exe 96 PID 4004 wrote to memory of 4516 4004 vjppp.exe 97 PID 4004 wrote to memory of 4516 4004 vjppp.exe 97 PID 4004 wrote to memory of 4516 4004 vjppp.exe 97 PID 4516 wrote to memory of 3928 4516 pvvdv.exe 98 PID 4516 wrote to memory of 3928 4516 pvvdv.exe 98 PID 4516 wrote to memory of 3928 4516 pvvdv.exe 98 PID 3928 wrote to memory of 3956 3928 rlrxxff.exe 99 PID 3928 wrote to memory of 3956 3928 rlrxxff.exe 99 PID 3928 wrote to memory of 3956 3928 rlrxxff.exe 99 PID 3956 wrote to memory of 4128 3956 hnthhb.exe 100 PID 3956 wrote to memory of 4128 3956 hnthhb.exe 100 PID 3956 wrote to memory of 4128 3956 hnthhb.exe 100 PID 4128 wrote to memory of 4528 4128 3dvpd.exe 101 PID 4128 wrote to memory of 4528 4128 3dvpd.exe 101 PID 4128 wrote to memory of 4528 4128 3dvpd.exe 101 PID 4528 wrote to memory of 4172 4528 llrrfff.exe 102 PID 4528 wrote to memory of 4172 4528 llrrfff.exe 102 PID 4528 wrote to memory of 4172 4528 llrrfff.exe 102 PID 4172 wrote to memory of 512 4172 1lxfxfl.exe 103 PID 4172 wrote to memory of 512 4172 1lxfxfl.exe 103 PID 4172 wrote to memory of 512 4172 1lxfxfl.exe 103 PID 512 wrote to memory of 5028 512 7tnttt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"C:\Users\Admin\AppData\Local\Temp\8a4bd9b703c2e89b17e7a180cb57b3e287cafad8e9f53df6f6914240048af2c3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\vvppj.exec:\vvppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7fllfll.exec:\7fllfll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\ffllflf.exec:\ffllflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\bnnbbh.exec:\bnnbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jjjjj.exec:\jjjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\flrllff.exec:\flrllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\nntbtt.exec:\nntbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\jjppj.exec:\jjppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:936 -
\??\c:\jpdvp.exec:\jpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\frllrxf.exec:\frllrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\hbhnnn.exec:\hbhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\nhhhbh.exec:\nhhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\vjppp.exec:\vjppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\pvvdv.exec:\pvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rlrxxff.exec:\rlrxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\hnthhb.exec:\hnthhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\3dvpd.exec:\3dvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\llrrfff.exec:\llrrfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\1lxfxfl.exec:\1lxfxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\7tnttt.exec:\7tnttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\dpjdp.exec:\dpjdp.exe23⤵
- Executes dropped EXE
PID:5028 -
\??\c:\9fxxrfr.exec:\9fxxrfr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\djppj.exec:\djppj.exe25⤵
- Executes dropped EXE
PID:3228 -
\??\c:\pjjjj.exec:\pjjjj.exe26⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ttbttt.exec:\ttbttt.exe27⤵
- Executes dropped EXE
PID:3260 -
\??\c:\vvjjj.exec:\vvjjj.exe28⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe29⤵
- Executes dropped EXE
PID:4308 -
\??\c:\hhnntn.exec:\hhnntn.exe30⤵
- Executes dropped EXE
PID:4796 -
\??\c:\fxxxffl.exec:\fxxxffl.exe31⤵
- Executes dropped EXE
PID:3572 -
\??\c:\bhhntt.exec:\bhhntt.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\djjjj.exec:\djjjj.exe33⤵
- Executes dropped EXE
PID:868 -
\??\c:\jjppp.exec:\jjppp.exe34⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rrlrlfx.exec:\rrlrlfx.exe35⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hbntbt.exec:\hbntbt.exe36⤵
- Executes dropped EXE
PID:212 -
\??\c:\pjjjj.exec:\pjjjj.exe37⤵
- Executes dropped EXE
PID:3280 -
\??\c:\pvddd.exec:\pvddd.exe38⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xrlffll.exec:\xrlffll.exe39⤵
- Executes dropped EXE
PID:3328 -
\??\c:\ntttnt.exec:\ntttnt.exe40⤵
- Executes dropped EXE
PID:1884 -
\??\c:\thnnnt.exec:\thnnnt.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\djddd.exec:\djddd.exe42⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lrlxxlf.exec:\lrlxxlf.exe43⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rfxflfl.exec:\rfxflfl.exe44⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nbhbtb.exec:\nbhbtb.exe45⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vjdvp.exec:\vjdvp.exe46⤵
- Executes dropped EXE
PID:4496 -
\??\c:\jdvvv.exec:\jdvvv.exe47⤵
- Executes dropped EXE
PID:436 -
\??\c:\frxxxrx.exec:\frxxxrx.exe48⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhhttn.exec:\hhhttn.exe49⤵
- Executes dropped EXE
PID:3700 -
\??\c:\vddpj.exec:\vddpj.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rrxxffl.exec:\rrxxffl.exe51⤵
- Executes dropped EXE
PID:1228 -
\??\c:\flxxrxl.exec:\flxxrxl.exe52⤵
- Executes dropped EXE
PID:3524 -
\??\c:\nhbhbb.exec:\nhbhbb.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\3bhnnt.exec:\3bhnnt.exe54⤵
- Executes dropped EXE
PID:4824 -
\??\c:\djppv.exec:\djppv.exe55⤵
- Executes dropped EXE
PID:3304 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe56⤵
- Executes dropped EXE
PID:1112 -
\??\c:\rrfflrf.exec:\rrfflrf.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\htbbhn.exec:\htbbhn.exe58⤵
- Executes dropped EXE
PID:3316 -
\??\c:\dppdv.exec:\dppdv.exe59⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe60⤵
- Executes dropped EXE
PID:3616 -
\??\c:\lxrrflx.exec:\lxrrflx.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vdppd.exec:\vdppd.exe62⤵
- Executes dropped EXE
PID:3312 -
\??\c:\5dppp.exec:\5dppp.exe63⤵
- Executes dropped EXE
PID:4596 -
\??\c:\xxlllxx.exec:\xxlllxx.exe64⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hnnttb.exec:\hnnttb.exe65⤵
- Executes dropped EXE
PID:3152 -
\??\c:\vdjpp.exec:\vdjpp.exe66⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\lrxxrxf.exec:\lrxxrxf.exe67⤵PID:3508
-
\??\c:\nntntb.exec:\nntntb.exe68⤵PID:4368
-
\??\c:\bnttbh.exec:\bnttbh.exe69⤵PID:3040
-
\??\c:\pjppp.exec:\pjppp.exe70⤵PID:4144
-
\??\c:\rfxxrrf.exec:\rfxxrrf.exe71⤵PID:840
-
\??\c:\tnhhhn.exec:\tnhhhn.exe72⤵PID:4556
-
\??\c:\htbhhn.exec:\htbhhn.exe73⤵PID:1488
-
\??\c:\jjdvd.exec:\jjdvd.exe74⤵PID:680
-
\??\c:\xfxflrf.exec:\xfxflrf.exe75⤵PID:5116
-
\??\c:\hhbbnn.exec:\hhbbnn.exe76⤵PID:748
-
\??\c:\tttnhh.exec:\tttnhh.exe77⤵PID:4256
-
\??\c:\jdjjv.exec:\jdjjv.exe78⤵PID:4840
-
\??\c:\jppvv.exec:\jppvv.exe79⤵PID:2796
-
\??\c:\fxrrrxf.exec:\fxrrrxf.exe80⤵PID:60
-
\??\c:\httbnn.exec:\httbnn.exe81⤵PID:3776
-
\??\c:\thtttb.exec:\thtttb.exe82⤵PID:4436
-
\??\c:\ppvvv.exec:\ppvvv.exe83⤵PID:4796
-
\??\c:\lllllrl.exec:\lllllrl.exe84⤵PID:1904
-
\??\c:\frxxflx.exec:\frxxflx.exe85⤵PID:4692
-
\??\c:\xlllfff.exec:\xlllfff.exe86⤵PID:4672
-
\??\c:\7btttb.exec:\7btttb.exe87⤵PID:3544
-
\??\c:\vpjjd.exec:\vpjjd.exe88⤵PID:4068
-
\??\c:\fxllrrr.exec:\fxllrrr.exe89⤵PID:1876
-
\??\c:\flxxxfl.exec:\flxxxfl.exe90⤵PID:4024
-
\??\c:\7hbttb.exec:\7hbttb.exe91⤵PID:2028
-
\??\c:\jjjpp.exec:\jjjpp.exe92⤵PID:4980
-
\??\c:\lxxflrx.exec:\lxxflrx.exe93⤵PID:4924
-
\??\c:\ntthtn.exec:\ntthtn.exe94⤵PID:752
-
\??\c:\nthtnn.exec:\nthtnn.exe95⤵PID:2424
-
\??\c:\pvvvp.exec:\pvvvp.exe96⤵PID:2448
-
\??\c:\xxffllx.exec:\xxffllx.exe97⤵PID:5092
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe98⤵PID:4204
-
\??\c:\jpvvv.exec:\jpvvv.exe99⤵PID:4260
-
\??\c:\5flfllr.exec:\5flfllr.exe100⤵PID:1040
-
\??\c:\bhtntn.exec:\bhtntn.exe101⤵PID:1888
-
\??\c:\jddvv.exec:\jddvv.exe102⤵PID:2700
-
\??\c:\thbbbb.exec:\thbbbb.exe103⤵PID:412
-
\??\c:\bnthnb.exec:\bnthnb.exe104⤵PID:2720
-
\??\c:\pppjd.exec:\pppjd.exe105⤵PID:4496
-
\??\c:\7jjjd.exec:\7jjjd.exe106⤵PID:2032
-
\??\c:\llrlfll.exec:\llrlfll.exe107⤵PID:3020
-
\??\c:\bhhnnn.exec:\bhhnnn.exe108⤵
- System Location Discovery: System Language Discovery
PID:1472 -
\??\c:\jjdvp.exec:\jjdvp.exe109⤵PID:4592
-
\??\c:\vvvpp.exec:\vvvpp.exe110⤵PID:4576
-
\??\c:\5xlrrxx.exec:\5xlrrxx.exe111⤵PID:3244
-
\??\c:\nhhnnn.exec:\nhhnnn.exe112⤵PID:1028
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:2220
-
\??\c:\vvjpj.exec:\vvjpj.exe114⤵PID:4272
-
\??\c:\xlxlfrl.exec:\xlxlfrl.exe115⤵PID:4176
-
\??\c:\nhttnn.exec:\nhttnn.exe116⤵PID:4440
-
\??\c:\jddjj.exec:\jddjj.exe117⤵PID:1112
-
\??\c:\djjvv.exec:\djjvv.exe118⤵PID:1964
-
\??\c:\rrfrrrx.exec:\rrfrrrx.exe119⤵PID:5076
-
\??\c:\7lxlllf.exec:\7lxlllf.exe120⤵PID:3548
-
\??\c:\vpdvj.exec:\vpdvj.exe121⤵PID:3476
-
\??\c:\xrrllff.exec:\xrrllff.exe122⤵
- System Location Discovery: System Language Discovery
PID:2864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-