Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe
Resource
win7-20240903-en
General
-
Target
b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe
-
Size
454KB
-
MD5
959e7ea521375c770c2e24040d61f14f
-
SHA1
9c34282fbb3062bf037b7be14b5d400a498d0e1d
-
SHA256
b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509
-
SHA512
efd803216fd0ca06025c96f8d8a78dae5787ad74541ab24695fbb8fe2a7f05cedb1c324dfe922162d7a02205e410b9edd298f55db306d1a6d1162656ee1d09b6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4548-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2080-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/472-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1636-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1216-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2644-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1716-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4336-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-1059-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-1353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4752 pvdvp.exe 2020 btbtnn.exe 4428 dvdvv.exe 3684 jdjdd.exe 3440 nhbtnn.exe 4468 bthbnn.exe 2456 lfffxfx.exe 676 ttbbhn.exe 1156 tnbthh.exe 5028 bthbnh.exe 4028 dpvvv.exe 2880 thnnhb.exe 2644 htbttt.exe 4168 rlxxxff.exe 4152 nbnnhb.exe 2168 jpddd.exe 4508 flrllll.exe 2080 ntnntt.exe 1940 ppvvj.exe 472 djvjp.exe 3504 hthbnn.exe 5000 ddjjd.exe 1176 xxlllll.exe 1636 xlrrlll.exe 1408 pjpjj.exe 2424 bbntht.exe 2096 htnhbt.exe 2380 xrlffxx.exe 3280 jjvvd.exe 4340 nbbtnn.exe 3820 lflrxxr.exe 2164 vjjdp.exe 1808 ttbttt.exe 1452 3thbhh.exe 2392 dvvvv.exe 4580 ffxxffl.exe 4560 9dddp.exe 1644 rlffrxx.exe 1216 lfxrxrl.exe 2256 bhhhht.exe 4024 xfrfxrf.exe 2276 bhbhbb.exe 2588 bthhht.exe 3500 vvpjv.exe 5020 fffxxrl.exe 4372 tbnnbb.exe 4872 jjpjv.exe 3952 1xfffll.exe 4752 vppdv.exe 4144 lxlrflx.exe 4640 hnnntb.exe 5052 hhttnn.exe 3276 jvddd.exe 1684 fxfxxxx.exe 3440 hbnhnn.exe 3688 vvjdv.exe 1304 rfrxxfl.exe 2996 hthhnn.exe 3008 djdjd.exe 2188 vddpv.exe 1964 frfxfrx.exe 4860 bbtthh.exe 2004 vvddd.exe 4292 xxllrrl.exe -
resource yara_rule behavioral2/memory/4548-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2080-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/472-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1636-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1216-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2644-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1716-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4336-726-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 4752 4548 b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe 84 PID 4548 wrote to memory of 4752 4548 b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe 84 PID 4548 wrote to memory of 4752 4548 b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe 84 PID 4752 wrote to memory of 2020 4752 pvdvp.exe 85 PID 4752 wrote to memory of 2020 4752 pvdvp.exe 85 PID 4752 wrote to memory of 2020 4752 pvdvp.exe 85 PID 2020 wrote to memory of 4428 2020 btbtnn.exe 86 PID 2020 wrote to memory of 4428 2020 btbtnn.exe 86 PID 2020 wrote to memory of 4428 2020 btbtnn.exe 86 PID 4428 wrote to memory of 3684 4428 dvdvv.exe 87 PID 4428 wrote to memory of 3684 4428 dvdvv.exe 87 PID 4428 wrote to memory of 3684 4428 dvdvv.exe 87 PID 3684 wrote to memory of 3440 3684 jdjdd.exe 88 PID 3684 wrote to memory of 3440 3684 jdjdd.exe 88 PID 3684 wrote to memory of 3440 3684 jdjdd.exe 88 PID 3440 wrote to memory of 4468 3440 nhbtnn.exe 89 PID 3440 wrote to memory of 4468 3440 nhbtnn.exe 89 PID 3440 wrote to memory of 4468 3440 nhbtnn.exe 89 PID 4468 wrote to memory of 2456 4468 bthbnn.exe 90 PID 4468 wrote to memory of 2456 4468 bthbnn.exe 90 PID 4468 wrote to memory of 2456 4468 bthbnn.exe 90 PID 2456 wrote to memory of 676 2456 lfffxfx.exe 91 PID 2456 wrote to memory of 676 2456 lfffxfx.exe 91 PID 2456 wrote to memory of 676 2456 lfffxfx.exe 91 PID 676 wrote to memory of 1156 676 ttbbhn.exe 92 PID 676 wrote to memory of 1156 676 ttbbhn.exe 92 PID 676 wrote to memory of 1156 676 ttbbhn.exe 92 PID 1156 wrote to memory of 5028 1156 tnbthh.exe 93 PID 1156 wrote to memory of 5028 1156 tnbthh.exe 93 PID 1156 wrote to memory of 5028 1156 tnbthh.exe 93 PID 5028 wrote to memory of 4028 5028 bthbnh.exe 94 PID 5028 wrote to memory of 4028 5028 bthbnh.exe 94 PID 5028 wrote to memory of 4028 5028 bthbnh.exe 94 PID 4028 wrote to memory of 2880 4028 dpvvv.exe 95 PID 4028 wrote to memory of 2880 4028 dpvvv.exe 95 PID 4028 wrote to memory of 2880 4028 dpvvv.exe 95 PID 2880 wrote to memory of 2644 2880 thnnhb.exe 96 PID 2880 wrote to memory of 2644 2880 thnnhb.exe 96 PID 2880 wrote to memory of 2644 2880 thnnhb.exe 96 PID 2644 wrote to memory of 4168 2644 htbttt.exe 97 PID 2644 wrote to memory of 4168 2644 htbttt.exe 97 PID 2644 wrote to memory of 4168 2644 htbttt.exe 97 PID 4168 wrote to memory of 4152 4168 rlxxxff.exe 98 PID 4168 wrote to memory of 4152 4168 rlxxxff.exe 98 PID 4168 wrote to memory of 4152 4168 rlxxxff.exe 98 PID 4152 wrote to memory of 2168 4152 nbnnhb.exe 99 PID 4152 wrote to memory of 2168 4152 nbnnhb.exe 99 PID 4152 wrote to memory of 2168 4152 nbnnhb.exe 99 PID 2168 wrote to memory of 4508 2168 jpddd.exe 100 PID 2168 wrote to memory of 4508 2168 jpddd.exe 100 PID 2168 wrote to memory of 4508 2168 jpddd.exe 100 PID 4508 wrote to memory of 2080 4508 flrllll.exe 101 PID 4508 wrote to memory of 2080 4508 flrllll.exe 101 PID 4508 wrote to memory of 2080 4508 flrllll.exe 101 PID 2080 wrote to memory of 1940 2080 ntnntt.exe 102 PID 2080 wrote to memory of 1940 2080 ntnntt.exe 102 PID 2080 wrote to memory of 1940 2080 ntnntt.exe 102 PID 1940 wrote to memory of 472 1940 ppvvj.exe 103 PID 1940 wrote to memory of 472 1940 ppvvj.exe 103 PID 1940 wrote to memory of 472 1940 ppvvj.exe 103 PID 472 wrote to memory of 3504 472 djvjp.exe 104 PID 472 wrote to memory of 3504 472 djvjp.exe 104 PID 472 wrote to memory of 3504 472 djvjp.exe 104 PID 3504 wrote to memory of 5000 3504 hthbnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe"C:\Users\Admin\AppData\Local\Temp\b7a3decc84911b26abb58571f953fd91386f877a92211ab788c8fd197f9a9509.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\pvdvp.exec:\pvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\btbtnn.exec:\btbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jdjdd.exec:\jdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\nhbtnn.exec:\nhbtnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\bthbnn.exec:\bthbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\lfffxfx.exec:\lfffxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ttbbhn.exec:\ttbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\tnbthh.exec:\tnbthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\bthbnh.exec:\bthbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\dpvvv.exec:\dpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\thnnhb.exec:\thnnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\htbttt.exec:\htbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rlxxxff.exec:\rlxxxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\nbnnhb.exec:\nbnnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\jpddd.exec:\jpddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\flrllll.exec:\flrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\ntnntt.exec:\ntnntt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ppvvj.exec:\ppvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\djvjp.exec:\djvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\hthbnn.exec:\hthbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\ddjjd.exec:\ddjjd.exe23⤵
- Executes dropped EXE
PID:5000 -
\??\c:\xxlllll.exec:\xxlllll.exe24⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xlrrlll.exec:\xlrrlll.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pjpjj.exec:\pjpjj.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bbntht.exec:\bbntht.exe27⤵
- Executes dropped EXE
PID:2424 -
\??\c:\htnhbt.exec:\htnhbt.exe28⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrlffxx.exec:\xrlffxx.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjvvd.exec:\jjvvd.exe30⤵
- Executes dropped EXE
PID:3280 -
\??\c:\nbbtnn.exec:\nbbtnn.exe31⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lflrxxr.exec:\lflrxxr.exe32⤵
- Executes dropped EXE
PID:3820 -
\??\c:\vjjdp.exec:\vjjdp.exe33⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ttbttt.exec:\ttbttt.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3thbhh.exec:\3thbhh.exe35⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvvvv.exec:\dvvvv.exe36⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ffxxffl.exec:\ffxxffl.exe37⤵
- Executes dropped EXE
PID:4580 -
\??\c:\9dddp.exec:\9dddp.exe38⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rlffrxx.exec:\rlffrxx.exe39⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe40⤵
- Executes dropped EXE
PID:1216 -
\??\c:\bhhhht.exec:\bhhhht.exe41⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xfrfxrf.exec:\xfrfxrf.exe42⤵
- Executes dropped EXE
PID:4024 -
\??\c:\bhbhbb.exec:\bhbhbb.exe43⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bthhht.exec:\bthhht.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\vvpjv.exec:\vvpjv.exe45⤵
- Executes dropped EXE
PID:3500 -
\??\c:\fffxxrl.exec:\fffxxrl.exe46⤵
- Executes dropped EXE
PID:5020 -
\??\c:\tbnnbb.exec:\tbnnbb.exe47⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jjpjv.exec:\jjpjv.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\1xfffll.exec:\1xfffll.exe49⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vppdv.exec:\vppdv.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\lxlrflx.exec:\lxlrflx.exe51⤵
- Executes dropped EXE
PID:4144 -
\??\c:\hnnntb.exec:\hnnntb.exe52⤵
- Executes dropped EXE
PID:4640 -
\??\c:\hhttnn.exec:\hhttnn.exe53⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jvddd.exec:\jvddd.exe54⤵
- Executes dropped EXE
PID:3276 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe55⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hbnhnn.exec:\hbnhnn.exe56⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vvjdv.exec:\vvjdv.exe57⤵
- Executes dropped EXE
PID:3688 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hthhnn.exec:\hthhnn.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\djdjd.exec:\djdjd.exe60⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vddpv.exec:\vddpv.exe61⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frfxfrx.exec:\frfxfrx.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
\??\c:\bbtthh.exec:\bbtthh.exe63⤵
- Executes dropped EXE
PID:4860 -
\??\c:\vvddd.exec:\vvddd.exe64⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xxllrrl.exec:\xxllrrl.exe65⤵
- Executes dropped EXE
PID:4292 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe66⤵PID:4132
-
\??\c:\nnttnt.exec:\nnttnt.exe67⤵PID:4764
-
\??\c:\dvddj.exec:\dvddj.exe68⤵PID:4168
-
\??\c:\rrffrxx.exec:\rrffrxx.exe69⤵PID:4804
-
\??\c:\tbhhhh.exec:\tbhhhh.exe70⤵PID:3392
-
\??\c:\vvddd.exec:\vvddd.exe71⤵PID:3692
-
\??\c:\fxlfflr.exec:\fxlfflr.exe72⤵PID:2220
-
\??\c:\nhhbhn.exec:\nhhbhn.exe73⤵PID:2080
-
\??\c:\vpdjj.exec:\vpdjj.exe74⤵PID:1848
-
\??\c:\llflxxx.exec:\llflxxx.exe75⤵PID:4384
-
\??\c:\nnbbtt.exec:\nnbbtt.exe76⤵PID:980
-
\??\c:\jpvdj.exec:\jpvdj.exe77⤵PID:444
-
\??\c:\jjjjj.exec:\jjjjj.exe78⤵PID:212
-
\??\c:\rrffxxx.exec:\rrffxxx.exe79⤵PID:5096
-
\??\c:\tttbtt.exec:\tttbtt.exe80⤵PID:916
-
\??\c:\vvdpv.exec:\vvdpv.exe81⤵PID:1860
-
\??\c:\frfflrr.exec:\frfflrr.exe82⤵PID:3828
-
\??\c:\lffffll.exec:\lffffll.exe83⤵PID:2428
-
\??\c:\ttttbb.exec:\ttttbb.exe84⤵PID:764
-
\??\c:\jvjvp.exec:\jvjvp.exe85⤵PID:2700
-
\??\c:\llrlflf.exec:\llrlflf.exe86⤵PID:2460
-
\??\c:\tnttnt.exec:\tnttnt.exe87⤵PID:1816
-
\??\c:\hntntt.exec:\hntntt.exe88⤵PID:3544
-
\??\c:\pjvpp.exec:\pjvpp.exe89⤵PID:3756
-
\??\c:\xxflrxx.exec:\xxflrxx.exe90⤵PID:4340
-
\??\c:\fxflfll.exec:\fxflfll.exe91⤵PID:2840
-
\??\c:\btbttt.exec:\btbttt.exe92⤵PID:4964
-
\??\c:\jjjvj.exec:\jjjvj.exe93⤵PID:4868
-
\??\c:\lxllrxf.exec:\lxllrxf.exe94⤵PID:1912
-
\??\c:\ttbtbt.exec:\ttbtbt.exe95⤵PID:960
-
\??\c:\1jdvp.exec:\1jdvp.exe96⤵PID:1368
-
\??\c:\djdvd.exec:\djdvd.exe97⤵PID:3644
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe98⤵PID:1004
-
\??\c:\hbnnhn.exec:\hbnnhn.exe99⤵PID:1644
-
\??\c:\vvjdj.exec:\vvjdj.exe100⤵PID:1216
-
\??\c:\7flfrxr.exec:\7flfrxr.exe101⤵PID:2256
-
\??\c:\btbbtb.exec:\btbbtb.exe102⤵PID:2464
-
\??\c:\jpdvp.exec:\jpdvp.exe103⤵PID:2276
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe104⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\bthhbh.exec:\bthhbh.exe105⤵PID:1412
-
\??\c:\ntbbhh.exec:\ntbbhh.exe106⤵PID:4420
-
\??\c:\djjpp.exec:\djjpp.exe107⤵PID:4076
-
\??\c:\fxlllxf.exec:\fxlllxf.exe108⤵PID:4776
-
\??\c:\htbnhh.exec:\htbnhh.exe109⤵PID:548
-
\??\c:\jvjjd.exec:\jvjjd.exe110⤵PID:4496
-
\??\c:\xrffllx.exec:\xrffllx.exe111⤵PID:3064
-
\??\c:\hnhhtt.exec:\hnhhtt.exe112⤵PID:1428
-
\??\c:\7nnhhh.exec:\7nnhhh.exe113⤵PID:4140
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:3684
-
\??\c:\fxlrffr.exec:\fxlrffr.exe115⤵PID:2688
-
\??\c:\bntnhh.exec:\bntnhh.exe116⤵PID:2252
-
\??\c:\hnbtnn.exec:\hnbtnn.exe117⤵PID:948
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵PID:1796
-
\??\c:\9hbttt.exec:\9hbttt.exe119⤵PID:2456
-
\??\c:\jdddv.exec:\jdddv.exe120⤵PID:4688
-
\??\c:\jjpjp.exec:\jjpjp.exe121⤵PID:4084
-
\??\c:\xlrlffx.exec:\xlrlffx.exe122⤵PID:3104
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-