Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe
Resource
win7-20240903-en
General
-
Target
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe
-
Size
454KB
-
MD5
b2ba63df2c440cba32dba8d540953ef0
-
SHA1
661b62e72dbfab87aea13d0677633b9113139d78
-
SHA256
1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77
-
SHA512
21adf3990b7daf8b5771dedb7ec402179dacd36c6098e192a6cbe96467674a4c520e91e0c82b8889188d4660483f042b0a3f2d894257b7207998acde732f1055
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1268-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4968-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1040-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4088-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/932-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1428-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-819-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-981-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-1270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-1418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 1jvvv.exe 4944 3vvpj.exe 4968 tthhtt.exe 3668 btbbtb.exe 4804 pjpdj.exe 4048 jpdvj.exe 220 ddddp.exe 1040 rfllxxr.exe 1136 tbnnth.exe 4868 ddvpv.exe 2000 bbttnn.exe 5052 rrffllf.exe 3096 tnnnnn.exe 3664 vvjjp.exe 1568 xrxrxxf.exe 2232 5btttt.exe 4108 ddppd.exe 1536 xlfxxxx.exe 1604 bbhhbn.exe 2284 jjjjp.exe 4904 1tbtnt.exe 4304 tnhbbb.exe 2040 ppvvj.exe 1964 7rrrrxx.exe 4656 jdjdd.exe 1144 1ntnnn.exe 2756 dvjdd.exe 1336 djpjd.exe 3632 llrrrrr.exe 5108 vpvvd.exe 3204 rffrrrx.exe 4164 hbhhbn.exe 4508 vddvv.exe 2792 xflllll.exe 1828 5nbthn.exe 1880 pjdvj.exe 1320 dvddv.exe 3296 tnbbtb.exe 392 frrrlrr.exe 3372 1xffxfx.exe 396 hbbtnn.exe 5080 jdpdj.exe 1304 tbbbbb.exe 2780 vjdvp.exe 4848 9rlllrl.exe 4040 7bhtth.exe 3504 jpddd.exe 4400 jjddv.exe 1216 llxrxfl.exe 4324 nnhhbh.exe 864 jvddv.exe 3964 lrrfxxl.exe 4536 thtbbh.exe 4828 tbhbbb.exe 1332 jjvjd.exe 3036 1lrrlrr.exe 1100 tnbhhn.exe 224 dddvv.exe 4804 9fffflf.exe 3076 ffrllrr.exe 376 jvjjd.exe 32 jppdv.exe 1612 frxxrxr.exe 3564 bthhht.exe -
resource yara_rule behavioral2/memory/1268-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1040-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4088-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/932-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1428-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-794-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 2056 1268 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 83 PID 1268 wrote to memory of 2056 1268 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 83 PID 1268 wrote to memory of 2056 1268 1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe 83 PID 2056 wrote to memory of 4944 2056 1jvvv.exe 84 PID 2056 wrote to memory of 4944 2056 1jvvv.exe 84 PID 2056 wrote to memory of 4944 2056 1jvvv.exe 84 PID 4944 wrote to memory of 4968 4944 3vvpj.exe 85 PID 4944 wrote to memory of 4968 4944 3vvpj.exe 85 PID 4944 wrote to memory of 4968 4944 3vvpj.exe 85 PID 4968 wrote to memory of 3668 4968 tthhtt.exe 86 PID 4968 wrote to memory of 3668 4968 tthhtt.exe 86 PID 4968 wrote to memory of 3668 4968 tthhtt.exe 86 PID 3668 wrote to memory of 4804 3668 btbbtb.exe 87 PID 3668 wrote to memory of 4804 3668 btbbtb.exe 87 PID 3668 wrote to memory of 4804 3668 btbbtb.exe 87 PID 4804 wrote to memory of 4048 4804 pjpdj.exe 88 PID 4804 wrote to memory of 4048 4804 pjpdj.exe 88 PID 4804 wrote to memory of 4048 4804 pjpdj.exe 88 PID 4048 wrote to memory of 220 4048 jpdvj.exe 89 PID 4048 wrote to memory of 220 4048 jpdvj.exe 89 PID 4048 wrote to memory of 220 4048 jpdvj.exe 89 PID 220 wrote to memory of 1040 220 ddddp.exe 90 PID 220 wrote to memory of 1040 220 ddddp.exe 90 PID 220 wrote to memory of 1040 220 ddddp.exe 90 PID 1040 wrote to memory of 1136 1040 rfllxxr.exe 91 PID 1040 wrote to memory of 1136 1040 rfllxxr.exe 91 PID 1040 wrote to memory of 1136 1040 rfllxxr.exe 91 PID 1136 wrote to memory of 4868 1136 tbnnth.exe 92 PID 1136 wrote to memory of 4868 1136 tbnnth.exe 92 PID 1136 wrote to memory of 4868 1136 tbnnth.exe 92 PID 4868 wrote to memory of 2000 4868 ddvpv.exe 93 PID 4868 wrote to memory of 2000 4868 ddvpv.exe 93 PID 4868 wrote to memory of 2000 4868 ddvpv.exe 93 PID 2000 wrote to memory of 5052 2000 bbttnn.exe 94 PID 2000 wrote to memory of 5052 2000 bbttnn.exe 94 PID 2000 wrote to memory of 5052 2000 bbttnn.exe 94 PID 5052 wrote to memory of 3096 5052 rrffllf.exe 95 PID 5052 wrote to memory of 3096 5052 rrffllf.exe 95 PID 5052 wrote to memory of 3096 5052 rrffllf.exe 95 PID 3096 wrote to memory of 3664 3096 tnnnnn.exe 96 PID 3096 wrote to memory of 3664 3096 tnnnnn.exe 96 PID 3096 wrote to memory of 3664 3096 tnnnnn.exe 96 PID 3664 wrote to memory of 1568 3664 vvjjp.exe 97 PID 3664 wrote to memory of 1568 3664 vvjjp.exe 97 PID 3664 wrote to memory of 1568 3664 vvjjp.exe 97 PID 1568 wrote to memory of 2232 1568 xrxrxxf.exe 98 PID 1568 wrote to memory of 2232 1568 xrxrxxf.exe 98 PID 1568 wrote to memory of 2232 1568 xrxrxxf.exe 98 PID 2232 wrote to memory of 4108 2232 5btttt.exe 99 PID 2232 wrote to memory of 4108 2232 5btttt.exe 99 PID 2232 wrote to memory of 4108 2232 5btttt.exe 99 PID 4108 wrote to memory of 1536 4108 ddppd.exe 100 PID 4108 wrote to memory of 1536 4108 ddppd.exe 100 PID 4108 wrote to memory of 1536 4108 ddppd.exe 100 PID 1536 wrote to memory of 1604 1536 xlfxxxx.exe 101 PID 1536 wrote to memory of 1604 1536 xlfxxxx.exe 101 PID 1536 wrote to memory of 1604 1536 xlfxxxx.exe 101 PID 1604 wrote to memory of 2284 1604 bbhhbn.exe 102 PID 1604 wrote to memory of 2284 1604 bbhhbn.exe 102 PID 1604 wrote to memory of 2284 1604 bbhhbn.exe 102 PID 2284 wrote to memory of 4904 2284 jjjjp.exe 103 PID 2284 wrote to memory of 4904 2284 jjjjp.exe 103 PID 2284 wrote to memory of 4904 2284 jjjjp.exe 103 PID 4904 wrote to memory of 4304 4904 1tbtnt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe"C:\Users\Admin\AppData\Local\Temp\1fdf6f0bd4ecf75e40b3149d127614435494a31fd9aacb616c87300e0f0e7b77N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\1jvvv.exec:\1jvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\3vvpj.exec:\3vvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\tthhtt.exec:\tthhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\btbbtb.exec:\btbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\pjpdj.exec:\pjpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\jpdvj.exec:\jpdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\ddddp.exec:\ddddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rfllxxr.exec:\rfllxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\tbnnth.exec:\tbnnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\ddvpv.exec:\ddvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\bbttnn.exec:\bbttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\rrffllf.exec:\rrffllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\tnnnnn.exec:\tnnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\vvjjp.exec:\vvjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\xrxrxxf.exec:\xrxrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\5btttt.exec:\5btttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\ddppd.exec:\ddppd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\bbhhbn.exec:\bbhhbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\jjjjp.exec:\jjjjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\1tbtnt.exec:\1tbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\tnhbbb.exec:\tnhbbb.exe23⤵
- Executes dropped EXE
PID:4304 -
\??\c:\ppvvj.exec:\ppvvj.exe24⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7rrrrxx.exec:\7rrrrxx.exe25⤵
- Executes dropped EXE
PID:1964 -
\??\c:\jdjdd.exec:\jdjdd.exe26⤵
- Executes dropped EXE
PID:4656 -
\??\c:\1ntnnn.exec:\1ntnnn.exe27⤵
- Executes dropped EXE
PID:1144 -
\??\c:\dvjdd.exec:\dvjdd.exe28⤵
- Executes dropped EXE
PID:2756 -
\??\c:\djpjd.exec:\djpjd.exe29⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llrrrrr.exec:\llrrrrr.exe30⤵
- Executes dropped EXE
PID:3632 -
\??\c:\vpvvd.exec:\vpvvd.exe31⤵
- Executes dropped EXE
PID:5108 -
\??\c:\rffrrrx.exec:\rffrrrx.exe32⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hbhhbn.exec:\hbhhbn.exe33⤵
- Executes dropped EXE
PID:4164 -
\??\c:\vddvv.exec:\vddvv.exe34⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xflllll.exec:\xflllll.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\5nbthn.exec:\5nbthn.exe36⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjdvj.exec:\pjdvj.exe37⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dvddv.exec:\dvddv.exe38⤵
- Executes dropped EXE
PID:1320 -
\??\c:\tnbbtb.exec:\tnbbtb.exe39⤵
- Executes dropped EXE
PID:3296 -
\??\c:\frrrlrr.exec:\frrrlrr.exe40⤵
- Executes dropped EXE
PID:392 -
\??\c:\1xffxfx.exec:\1xffxfx.exe41⤵
- Executes dropped EXE
PID:3372 -
\??\c:\hbbtnn.exec:\hbbtnn.exe42⤵
- Executes dropped EXE
PID:396 -
\??\c:\jdpdj.exec:\jdpdj.exe43⤵
- Executes dropped EXE
PID:5080 -
\??\c:\tbbbbb.exec:\tbbbbb.exe44⤵
- Executes dropped EXE
PID:1304 -
\??\c:\vjdvp.exec:\vjdvp.exe45⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9rlllrl.exec:\9rlllrl.exe46⤵
- Executes dropped EXE
PID:4848 -
\??\c:\7bhtth.exec:\7bhtth.exe47⤵
- Executes dropped EXE
PID:4040 -
\??\c:\jpddd.exec:\jpddd.exe48⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jjddv.exec:\jjddv.exe49⤵
- Executes dropped EXE
PID:4400 -
\??\c:\llxrxfl.exec:\llxrxfl.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nnhhbh.exec:\nnhhbh.exe51⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jvddv.exec:\jvddv.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\lrrfxxl.exec:\lrrfxxl.exe53⤵
- Executes dropped EXE
PID:3964 -
\??\c:\thtbbh.exec:\thtbbh.exe54⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tbhbbb.exec:\tbhbbb.exe55⤵
- Executes dropped EXE
PID:4828 -
\??\c:\jjvjd.exec:\jjvjd.exe56⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe57⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnbhhn.exec:\tnbhhn.exe58⤵
- Executes dropped EXE
PID:1100 -
\??\c:\dddvv.exec:\dddvv.exe59⤵
- Executes dropped EXE
PID:224 -
\??\c:\9fffflf.exec:\9fffflf.exe60⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ffrllrr.exec:\ffrllrr.exe61⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jvjjd.exec:\jvjjd.exe62⤵
- Executes dropped EXE
PID:376 -
\??\c:\jppdv.exec:\jppdv.exe63⤵
- Executes dropped EXE
PID:32 -
\??\c:\frxxrxr.exec:\frxxrxr.exe64⤵
- Executes dropped EXE
PID:1612 -
\??\c:\bthhht.exec:\bthhht.exe65⤵
- Executes dropped EXE
PID:3564 -
\??\c:\ddjjj.exec:\ddjjj.exe66⤵PID:1920
-
\??\c:\fxrxxll.exec:\fxrxxll.exe67⤵PID:4052
-
\??\c:\7lfffll.exec:\7lfffll.exe68⤵PID:452
-
\??\c:\nthbbb.exec:\nthbbb.exe69⤵PID:2000
-
\??\c:\7pdjj.exec:\7pdjj.exe70⤵PID:4276
-
\??\c:\ffrfrlx.exec:\ffrfrlx.exe71⤵PID:3096
-
\??\c:\llrrrxx.exec:\llrrrxx.exe72⤵PID:1864
-
\??\c:\9dppp.exec:\9dppp.exe73⤵PID:1624
-
\??\c:\1fxrrrr.exec:\1fxrrrr.exe74⤵PID:4088
-
\??\c:\3lrxfll.exec:\3lrxfll.exe75⤵PID:4900
-
\??\c:\ntbnhh.exec:\ntbnhh.exe76⤵PID:5068
-
\??\c:\pjvvv.exec:\pjvvv.exe77⤵PID:4824
-
\??\c:\rrffllr.exec:\rrffllr.exe78⤵PID:228
-
\??\c:\bbnhhb.exec:\bbnhhb.exe79⤵PID:4392
-
\??\c:\nnnhhb.exec:\nnnhhb.exe80⤵PID:3152
-
\??\c:\vdppp.exec:\vdppp.exe81⤵PID:4988
-
\??\c:\fxlfffl.exec:\fxlfffl.exe82⤵PID:2932
-
\??\c:\bttthh.exec:\bttthh.exe83⤵PID:3764
-
\??\c:\vjpjd.exec:\vjpjd.exe84⤵PID:748
-
\??\c:\7jjjj.exec:\7jjjj.exe85⤵PID:1676
-
\??\c:\xfxflrx.exec:\xfxflrx.exe86⤵PID:3164
-
\??\c:\hhtthn.exec:\hhtthn.exe87⤵PID:3324
-
\??\c:\vvvvj.exec:\vvvvj.exe88⤵PID:4704
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe89⤵PID:3160
-
\??\c:\hthhhh.exec:\hthhhh.exe90⤵PID:2756
-
\??\c:\7ppdj.exec:\7ppdj.exe91⤵PID:4196
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe92⤵PID:4368
-
\??\c:\nnbnnt.exec:\nnbnnt.exe93⤵PID:5072
-
\??\c:\ddjpj.exec:\ddjpj.exe94⤵PID:1680
-
\??\c:\flfffrr.exec:\flfffrr.exe95⤵PID:1640
-
\??\c:\1lrllrr.exec:\1lrllrr.exe96⤵PID:932
-
\??\c:\pjpjd.exec:\pjpjd.exe97⤵
- System Location Discovery: System Language Discovery
PID:1596 -
\??\c:\5ffllll.exec:\5ffllll.exe98⤵PID:1548
-
\??\c:\flxlfxl.exec:\flxlfxl.exe99⤵PID:736
-
\??\c:\tnhbbt.exec:\tnhbbt.exe100⤵PID:4744
-
\??\c:\vvdvv.exec:\vvdvv.exe101⤵PID:3656
-
\??\c:\xllfxrl.exec:\xllfxrl.exe102⤵PID:2288
-
\??\c:\rlfxflr.exec:\rlfxflr.exe103⤵PID:2340
-
\??\c:\nbhhbb.exec:\nbhhbb.exe104⤵PID:4340
-
\??\c:\jdddv.exec:\jdddv.exe105⤵PID:776
-
\??\c:\fxrxfxx.exec:\fxrxfxx.exe106⤵PID:3860
-
\??\c:\nbbtnn.exec:\nbbtnn.exe107⤵PID:2240
-
\??\c:\nbhbtt.exec:\nbhbtt.exe108⤵PID:2196
-
\??\c:\5djdv.exec:\5djdv.exe109⤵PID:3672
-
\??\c:\xrflflr.exec:\xrflflr.exe110⤵PID:4836
-
\??\c:\1hhhtb.exec:\1hhhtb.exe111⤵PID:3332
-
\??\c:\pjjdv.exec:\pjjdv.exe112⤵PID:3292
-
\??\c:\rxlfrlr.exec:\rxlfrlr.exe113⤵PID:3504
-
\??\c:\7lrrffr.exec:\7lrrffr.exe114⤵PID:1268
-
\??\c:\tntnnh.exec:\tntnnh.exe115⤵PID:4148
-
\??\c:\pjvvp.exec:\pjvvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:3000 -
\??\c:\llllllr.exec:\llllllr.exe117⤵PID:4036
-
\??\c:\bhhhbb.exec:\bhhhbb.exe118⤵PID:4916
-
\??\c:\jdppp.exec:\jdppp.exe119⤵PID:4092
-
\??\c:\5pjjj.exec:\5pjjj.exe120⤵PID:1048
-
\??\c:\xlxrrxr.exec:\xlxrrxr.exe121⤵PID:964
-
\??\c:\tntnhh.exec:\tntnhh.exe122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-