Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
Resource
win7-20240903-en
General
-
Target
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe
-
Size
454KB
-
MD5
20b111875971d37c6362dd0f4099814d
-
SHA1
5623bd2fcc32c842c3518127c31d0acd7681f260
-
SHA256
adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a
-
SHA512
0c1ebd0b3434877e217a34696bd6c77a32df28337b60d436caada2d811b88cbb788b3c08a7b08aa8fa8c60205d54a7a10d800243799cf42428257191378b49ee
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/3240-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3276-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3288-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3676-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-1174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 pjvvd.exe 916 dpdpj.exe 5060 5lrxrrr.exe 4572 nnhthh.exe 3772 pppdv.exe 908 tbbttb.exe 512 xfxxxfl.exe 3600 jjpvj.exe 2316 xflllrr.exe 1528 ppppj.exe 408 dvjjj.exe 4812 lflfllr.exe 2920 bthhnt.exe 100 rrrrxfx.exe 1668 hnbhbh.exe 4840 xxxxxrr.exe 1860 nnnnhh.exe 4936 hbhbtt.exe 2732 pdddv.exe 3276 vjpjj.exe 552 9fffxfl.exe 4952 nbnbhh.exe 5044 bnnbtb.exe 852 rrlxxxx.exe 2796 tttnhh.exe 2564 3jdvv.exe 3616 bthhnb.exe 3476 3ffxrrl.exe 4644 tnnhnt.exe 2228 1rxlllf.exe 5040 bnhbbt.exe 3472 tttnhb.exe 756 bntnhb.exe 1624 fflxxrr.exe 3964 1dpvj.exe 3696 fffxrlf.exe 3180 ttbbbh.exe 4428 rrfxllr.exe 4012 rlxxxfr.exe 1000 htnhhh.exe 372 jdpvd.exe 4536 xlffxxx.exe 1072 hbnntb.exe 4808 dpjpp.exe 4516 ffxfxll.exe 1044 tbhbnn.exe 3904 vdjjd.exe 3340 9rxrllx.exe 1704 btbbbb.exe 1660 ppvjv.exe 4296 3llfrrl.exe 3212 ffrrxxf.exe 544 hbttbh.exe 2352 ddpjd.exe 636 lfllxxx.exe 5060 3nttnn.exe 3496 jpddp.exe 4568 jvdvv.exe 1460 xrlrflf.exe 3872 hbnhbb.exe 2592 jvjdv.exe 3584 xxfllrr.exe 224 nnbtnt.exe 1060 9jjjj.exe -
resource yara_rule behavioral2/memory/3240-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3276-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3288-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-911-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-951-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3676-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3240 wrote to memory of 2224 3240 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 82 PID 3240 wrote to memory of 2224 3240 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 82 PID 3240 wrote to memory of 2224 3240 adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe 82 PID 2224 wrote to memory of 916 2224 pjvvd.exe 83 PID 2224 wrote to memory of 916 2224 pjvvd.exe 83 PID 2224 wrote to memory of 916 2224 pjvvd.exe 83 PID 916 wrote to memory of 5060 916 dpdpj.exe 84 PID 916 wrote to memory of 5060 916 dpdpj.exe 84 PID 916 wrote to memory of 5060 916 dpdpj.exe 84 PID 5060 wrote to memory of 4572 5060 5lrxrrr.exe 85 PID 5060 wrote to memory of 4572 5060 5lrxrrr.exe 85 PID 5060 wrote to memory of 4572 5060 5lrxrrr.exe 85 PID 4572 wrote to memory of 3772 4572 nnhthh.exe 86 PID 4572 wrote to memory of 3772 4572 nnhthh.exe 86 PID 4572 wrote to memory of 3772 4572 nnhthh.exe 86 PID 3772 wrote to memory of 908 3772 pppdv.exe 87 PID 3772 wrote to memory of 908 3772 pppdv.exe 87 PID 3772 wrote to memory of 908 3772 pppdv.exe 87 PID 908 wrote to memory of 512 908 tbbttb.exe 88 PID 908 wrote to memory of 512 908 tbbttb.exe 88 PID 908 wrote to memory of 512 908 tbbttb.exe 88 PID 512 wrote to memory of 3600 512 xfxxxfl.exe 89 PID 512 wrote to memory of 3600 512 xfxxxfl.exe 89 PID 512 wrote to memory of 3600 512 xfxxxfl.exe 89 PID 3600 wrote to memory of 2316 3600 jjpvj.exe 90 PID 3600 wrote to memory of 2316 3600 jjpvj.exe 90 PID 3600 wrote to memory of 2316 3600 jjpvj.exe 90 PID 2316 wrote to memory of 1528 2316 xflllrr.exe 91 PID 2316 wrote to memory of 1528 2316 xflllrr.exe 91 PID 2316 wrote to memory of 1528 2316 xflllrr.exe 91 PID 1528 wrote to memory of 408 1528 ppppj.exe 92 PID 1528 wrote to memory of 408 1528 ppppj.exe 92 PID 1528 wrote to memory of 408 1528 ppppj.exe 92 PID 408 wrote to memory of 4812 408 dvjjj.exe 93 PID 408 wrote to memory of 4812 408 dvjjj.exe 93 PID 408 wrote to memory of 4812 408 dvjjj.exe 93 PID 4812 wrote to memory of 2920 4812 lflfllr.exe 94 PID 4812 wrote to memory of 2920 4812 lflfllr.exe 94 PID 4812 wrote to memory of 2920 4812 lflfllr.exe 94 PID 2920 wrote to memory of 100 2920 bthhnt.exe 95 PID 2920 wrote to memory of 100 2920 bthhnt.exe 95 PID 2920 wrote to memory of 100 2920 bthhnt.exe 95 PID 100 wrote to memory of 1668 100 rrrrxfx.exe 96 PID 100 wrote to memory of 1668 100 rrrrxfx.exe 96 PID 100 wrote to memory of 1668 100 rrrrxfx.exe 96 PID 1668 wrote to memory of 4840 1668 hnbhbh.exe 97 PID 1668 wrote to memory of 4840 1668 hnbhbh.exe 97 PID 1668 wrote to memory of 4840 1668 hnbhbh.exe 97 PID 4840 wrote to memory of 1860 4840 xxxxxrr.exe 98 PID 4840 wrote to memory of 1860 4840 xxxxxrr.exe 98 PID 4840 wrote to memory of 1860 4840 xxxxxrr.exe 98 PID 1860 wrote to memory of 4936 1860 nnnnhh.exe 99 PID 1860 wrote to memory of 4936 1860 nnnnhh.exe 99 PID 1860 wrote to memory of 4936 1860 nnnnhh.exe 99 PID 4936 wrote to memory of 2732 4936 hbhbtt.exe 100 PID 4936 wrote to memory of 2732 4936 hbhbtt.exe 100 PID 4936 wrote to memory of 2732 4936 hbhbtt.exe 100 PID 2732 wrote to memory of 3276 2732 pdddv.exe 101 PID 2732 wrote to memory of 3276 2732 pdddv.exe 101 PID 2732 wrote to memory of 3276 2732 pdddv.exe 101 PID 3276 wrote to memory of 552 3276 vjpjj.exe 102 PID 3276 wrote to memory of 552 3276 vjpjj.exe 102 PID 3276 wrote to memory of 552 3276 vjpjj.exe 102 PID 552 wrote to memory of 4952 552 9fffxfl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"C:\Users\Admin\AppData\Local\Temp\adc403419c5634df7855943b88aaba26d45ef447e4576405dec7781eb05a627a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\pjvvd.exec:\pjvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\dpdpj.exec:\dpdpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\5lrxrrr.exec:\5lrxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\nnhthh.exec:\nnhthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\pppdv.exec:\pppdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\tbbttb.exec:\tbbttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\xfxxxfl.exec:\xfxxxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\jjpvj.exec:\jjpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\xflllrr.exec:\xflllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ppppj.exec:\ppppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\dvjjj.exec:\dvjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\lflfllr.exec:\lflfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\bthhnt.exec:\bthhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\hnbhbh.exec:\hnbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xxxxxrr.exec:\xxxxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\nnnnhh.exec:\nnnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\hbhbtt.exec:\hbhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\pdddv.exec:\pdddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\vjpjj.exec:\vjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\9fffxfl.exec:\9fffxfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\nbnbhh.exec:\nbnbhh.exe23⤵
- Executes dropped EXE
PID:4952 -
\??\c:\bnnbtb.exec:\bnnbtb.exe24⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rrlxxxx.exec:\rrlxxxx.exe25⤵
- Executes dropped EXE
PID:852 -
\??\c:\tttnhh.exec:\tttnhh.exe26⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3jdvv.exec:\3jdvv.exe27⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bthhnb.exec:\bthhnb.exe28⤵
- Executes dropped EXE
PID:3616 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe29⤵
- Executes dropped EXE
PID:3476 -
\??\c:\tnnhnt.exec:\tnnhnt.exe30⤵
- Executes dropped EXE
PID:4644 -
\??\c:\1rxlllf.exec:\1rxlllf.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\bnhbbt.exec:\bnhbbt.exe32⤵
- Executes dropped EXE
PID:5040 -
\??\c:\tttnhb.exec:\tttnhb.exe33⤵
- Executes dropped EXE
PID:3472 -
\??\c:\bntnhb.exec:\bntnhb.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\fflxxrr.exec:\fflxxrr.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1dpvj.exec:\1dpvj.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3964 -
\??\c:\fffxrlf.exec:\fffxrlf.exe37⤵
- Executes dropped EXE
PID:3696 -
\??\c:\ttbbbh.exec:\ttbbbh.exe38⤵
- Executes dropped EXE
PID:3180 -
\??\c:\rrfxllr.exec:\rrfxllr.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe40⤵
- Executes dropped EXE
PID:4012 -
\??\c:\htnhhh.exec:\htnhhh.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1000 -
\??\c:\jdpvd.exec:\jdpvd.exe42⤵
- Executes dropped EXE
PID:372 -
\??\c:\xlffxxx.exec:\xlffxxx.exe43⤵
- Executes dropped EXE
PID:4536 -
\??\c:\hbnntb.exec:\hbnntb.exe44⤵
- Executes dropped EXE
PID:1072 -
\??\c:\dpjpp.exec:\dpjpp.exe45⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ffxfxll.exec:\ffxfxll.exe46⤵
- Executes dropped EXE
PID:4516 -
\??\c:\tbhbnn.exec:\tbhbnn.exe47⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vdjjd.exec:\vdjjd.exe48⤵
- Executes dropped EXE
PID:3904 -
\??\c:\9rxrllx.exec:\9rxrllx.exe49⤵
- Executes dropped EXE
PID:3340 -
\??\c:\btbbbb.exec:\btbbbb.exe50⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ppvjv.exec:\ppvjv.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3llfrrl.exec:\3llfrrl.exe52⤵
- Executes dropped EXE
PID:4296 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe53⤵
- Executes dropped EXE
PID:3212 -
\??\c:\hbttbh.exec:\hbttbh.exe54⤵
- Executes dropped EXE
PID:544 -
\??\c:\ddpjd.exec:\ddpjd.exe55⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lfllxxx.exec:\lfllxxx.exe56⤵
- Executes dropped EXE
PID:636 -
\??\c:\3nttnn.exec:\3nttnn.exe57⤵
- Executes dropped EXE
PID:5060 -
\??\c:\jpddp.exec:\jpddp.exe58⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jvdvv.exec:\jvdvv.exe59⤵
- Executes dropped EXE
PID:4568 -
\??\c:\xrlrflf.exec:\xrlrflf.exe60⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hbnhbb.exec:\hbnhbb.exe61⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jvjdv.exec:\jvjdv.exe62⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxfllrr.exec:\xxfllrr.exe63⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nnbtnt.exec:\nnbtnt.exe64⤵
- Executes dropped EXE
PID:224 -
\??\c:\9jjjj.exec:\9jjjj.exe65⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe66⤵PID:2480
-
\??\c:\nbhhhn.exec:\nbhhhn.exe67⤵PID:532
-
\??\c:\dpdvp.exec:\dpdvp.exe68⤵PID:1124
-
\??\c:\1vvpj.exec:\1vvpj.exe69⤵PID:4544
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe70⤵PID:2580
-
\??\c:\hnbbbn.exec:\hnbbbn.exe71⤵PID:2148
-
\??\c:\vjjdv.exec:\vjjdv.exe72⤵PID:3144
-
\??\c:\dpdvj.exec:\dpdvj.exe73⤵PID:3684
-
\??\c:\rrffrrf.exec:\rrffrrf.exe74⤵PID:5048
-
\??\c:\nhtttb.exec:\nhtttb.exe75⤵PID:4684
-
\??\c:\pvjjj.exec:\pvjjj.exe76⤵PID:1668
-
\??\c:\1frlllf.exec:\1frlllf.exe77⤵PID:2444
-
\??\c:\nthbtt.exec:\nthbtt.exe78⤵PID:2820
-
\??\c:\jjddv.exec:\jjddv.exe79⤵PID:212
-
\??\c:\1flfxxx.exec:\1flfxxx.exe80⤵PID:4936
-
\??\c:\1htthh.exec:\1htthh.exe81⤵PID:2732
-
\??\c:\ddvpj.exec:\ddvpj.exe82⤵PID:2268
-
\??\c:\xllfrrl.exec:\xllfrrl.exe83⤵PID:880
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe84⤵PID:2036
-
\??\c:\nhnhbt.exec:\nhnhbt.exe85⤵PID:3828
-
\??\c:\djvvj.exec:\djvvj.exe86⤵PID:3220
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe87⤵PID:3260
-
\??\c:\nbbbbb.exec:\nbbbbb.exe88⤵PID:2460
-
\??\c:\jjvpd.exec:\jjvpd.exe89⤵PID:1928
-
\??\c:\9xlffxf.exec:\9xlffxf.exe90⤵PID:5028
-
\??\c:\fxlffll.exec:\fxlffll.exe91⤵PID:4888
-
\??\c:\hthbhh.exec:\hthbhh.exe92⤵PID:1524
-
\??\c:\pjjdv.exec:\pjjdv.exe93⤵PID:3820
-
\??\c:\rlrrfrr.exec:\rlrrfrr.exe94⤵PID:4644
-
\??\c:\xrrrrll.exec:\xrrrrll.exe95⤵PID:3592
-
\??\c:\hhhhhn.exec:\hhhhhn.exe96⤵PID:2228
-
\??\c:\7djdv.exec:\7djdv.exe97⤵PID:3196
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe98⤵PID:1748
-
\??\c:\hbbbbh.exec:\hbbbbh.exe99⤵PID:64
-
\??\c:\pdjjj.exec:\pdjjj.exe100⤵PID:4988
-
\??\c:\llxrxxf.exec:\llxrxxf.exe101⤵PID:1576
-
\??\c:\1rrlxxr.exec:\1rrlxxr.exe102⤵PID:3964
-
\??\c:\hthbnn.exec:\hthbnn.exe103⤵PID:4524
-
\??\c:\jdddp.exec:\jdddp.exe104⤵PID:4744
-
\??\c:\vddvp.exec:\vddvp.exe105⤵PID:4428
-
\??\c:\nnttbh.exec:\nnttbh.exe106⤵PID:5080
-
\??\c:\hthbnn.exec:\hthbnn.exe107⤵PID:1000
-
\??\c:\dvdvd.exec:\dvdvd.exe108⤵PID:2012
-
\??\c:\fxrlrxr.exec:\fxrlrxr.exe109⤵PID:1680
-
\??\c:\tbnnnn.exec:\tbnnnn.exe110⤵PID:444
-
\??\c:\9pppj.exec:\9pppj.exe111⤵PID:4884
-
\??\c:\3llfxlf.exec:\3llfxlf.exe112⤵PID:4532
-
\??\c:\nhnhnn.exec:\nhnhnn.exe113⤵PID:1028
-
\??\c:\jpdpv.exec:\jpdpv.exe114⤵PID:3288
-
\??\c:\jpvjd.exec:\jpvjd.exe115⤵PID:3688
-
\??\c:\llrfxxr.exec:\llrfxxr.exe116⤵PID:3176
-
\??\c:\ttnhbt.exec:\ttnhbt.exe117⤵PID:1936
-
\??\c:\1hbtnn.exec:\1hbtnn.exe118⤵PID:2552
-
\??\c:\fffxrlr.exec:\fffxrlr.exe119⤵PID:4020
-
\??\c:\9lrfxrl.exec:\9lrfxrl.exe120⤵PID:840
-
\??\c:\bhnhtt.exec:\bhnhtt.exe121⤵PID:3680
-
\??\c:\pvddv.exec:\pvddv.exe122⤵PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-