Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 00:47
Behavioral task
behavioral1
Sample
1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe
Resource
win7-20240729-en
General
-
Target
1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe
-
Size
332KB
-
MD5
246a5c7ee9e210bece204aaffc95b6ce
-
SHA1
2e78dd70dd639ec3cdb63f0ac28f2350aebd7c75
-
SHA256
1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026
-
SHA512
c186d7d09e75aea0910322ad10db819e11b25585093bc74f2368b15cd70c7c66f9f29cfbef4dd33a1b1746188535fe280c2272dc623e466ab644967379f2ccbe
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbex:R4wFHoSHYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2300-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2736-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4220-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-569-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-888-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-1405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3396 rlrrrxx.exe 64 nnttnn.exe 1328 9vvvv.exe 3660 ppvpj.exe 4924 lxffxxf.exe 1968 nbttnn.exe 1988 rrffxxf.exe 1740 dvdpj.exe 2488 djppp.exe 1132 lllffrx.exe 852 jjjdj.exe 4792 bbnhhh.exe 4304 9rllffx.exe 1056 htnhbh.exe 3532 btbbbb.exe 4876 rrxxlrx.exe 2468 nntnnb.exe 1528 xxlrffx.exe 4480 frfxrxx.exe 3500 jvvvv.exe 1568 rlrxxxf.exe 3664 fxfrrxf.exe 2436 lrfffxl.exe 2584 djvvp.exe 2852 bbttnn.exe 4252 vpvjp.exe 2764 rlxlflx.exe 3244 nttttb.exe 4176 vpjdj.exe 1732 ddppp.exe 2880 rrfllrl.exe 3464 rrxllxx.exe 3012 djddd.exe 1600 lrllrrr.exe 4536 5dppv.exe 3680 fflffff.exe 636 pjddd.exe 968 5bnnnb.exe 1044 vdvvp.exe 1272 lrrrrxx.exe 760 nnntnt.exe 4964 djpjj.exe 2204 vdddd.exe 4556 1flrrxl.exe 4356 bbtttt.exe 5044 3vdjj.exe 1072 9xlfflx.exe 2300 bhthht.exe 1444 jdpjp.exe 4708 dpvpv.exe 3460 rrlllll.exe 2288 nhtthh.exe 864 vvjjj.exe 3716 dpddd.exe 4880 rrrxlll.exe 2680 tntbtn.exe 3016 hhbtbh.exe 2736 dpjjd.exe 3228 xfrlfff.exe 2088 hhbbtb.exe 3508 htbtnn.exe 4100 vvdjp.exe 1256 lflfllf.exe 2244 rrrrlll.exe -
resource yara_rule behavioral2/memory/2300-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b0e-4.dat upx behavioral2/memory/2300-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b5f-9.dat upx behavioral2/files/0x000a000000023b63-11.dat upx behavioral2/files/0x000a000000023b64-19.dat upx behavioral2/memory/64-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3396-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b66-23.dat upx behavioral2/files/0x000a000000023b67-27.dat upx behavioral2/memory/4924-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b68-32.dat upx behavioral2/memory/1968-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b69-37.dat upx behavioral2/memory/1988-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6a-42.dat upx behavioral2/memory/1740-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6b-47.dat upx behavioral2/files/0x000a000000023b6c-51.dat upx behavioral2/memory/1132-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6d-56.dat upx behavioral2/memory/852-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b6e-61.dat upx behavioral2/files/0x000a000000023b6f-65.dat upx behavioral2/memory/1056-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4304-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b70-71.dat upx behavioral2/files/0x000b000000023b60-76.dat upx behavioral2/memory/3532-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b71-81.dat upx behavioral2/memory/4876-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b73-85.dat upx behavioral2/memory/1528-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2468-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b74-91.dat upx behavioral2/files/0x0031000000023b75-96.dat upx behavioral2/files/0x0031000000023b76-99.dat upx behavioral2/memory/1568-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b77-104.dat upx behavioral2/memory/1568-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-110.dat upx behavioral2/memory/3664-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-114.dat upx behavioral2/memory/2584-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-118.dat upx behavioral2/files/0x000a000000023b7b-125.dat upx behavioral2/memory/2852-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-134.dat upx behavioral2/memory/3244-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2764-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4252-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-129.dat upx behavioral2/files/0x000a000000023b7e-139.dat upx behavioral2/memory/4480-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-144.dat upx behavioral2/memory/4176-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-149.dat upx behavioral2/files/0x000a000000023b81-153.dat upx behavioral2/memory/3464-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3012-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3012-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1600-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4536-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2300 wrote to memory of 3396 2300 1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe 83 PID 2300 wrote to memory of 3396 2300 1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe 83 PID 2300 wrote to memory of 3396 2300 1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe 83 PID 3396 wrote to memory of 64 3396 rlrrrxx.exe 84 PID 3396 wrote to memory of 64 3396 rlrrrxx.exe 84 PID 3396 wrote to memory of 64 3396 rlrrrxx.exe 84 PID 64 wrote to memory of 1328 64 nnttnn.exe 85 PID 64 wrote to memory of 1328 64 nnttnn.exe 85 PID 64 wrote to memory of 1328 64 nnttnn.exe 85 PID 1328 wrote to memory of 3660 1328 9vvvv.exe 86 PID 1328 wrote to memory of 3660 1328 9vvvv.exe 86 PID 1328 wrote to memory of 3660 1328 9vvvv.exe 86 PID 3660 wrote to memory of 4924 3660 ppvpj.exe 87 PID 3660 wrote to memory of 4924 3660 ppvpj.exe 87 PID 3660 wrote to memory of 4924 3660 ppvpj.exe 87 PID 4924 wrote to memory of 1968 4924 lxffxxf.exe 88 PID 4924 wrote to memory of 1968 4924 lxffxxf.exe 88 PID 4924 wrote to memory of 1968 4924 lxffxxf.exe 88 PID 1968 wrote to memory of 1988 1968 nbttnn.exe 89 PID 1968 wrote to memory of 1988 1968 nbttnn.exe 89 PID 1968 wrote to memory of 1988 1968 nbttnn.exe 89 PID 1988 wrote to memory of 1740 1988 rrffxxf.exe 90 PID 1988 wrote to memory of 1740 1988 rrffxxf.exe 90 PID 1988 wrote to memory of 1740 1988 rrffxxf.exe 90 PID 1740 wrote to memory of 2488 1740 dvdpj.exe 91 PID 1740 wrote to memory of 2488 1740 dvdpj.exe 91 PID 1740 wrote to memory of 2488 1740 dvdpj.exe 91 PID 2488 wrote to memory of 1132 2488 djppp.exe 92 PID 2488 wrote to memory of 1132 2488 djppp.exe 92 PID 2488 wrote to memory of 1132 2488 djppp.exe 92 PID 1132 wrote to memory of 852 1132 lllffrx.exe 93 PID 1132 wrote to memory of 852 1132 lllffrx.exe 93 PID 1132 wrote to memory of 852 1132 lllffrx.exe 93 PID 852 wrote to memory of 4792 852 jjjdj.exe 94 PID 852 wrote to memory of 4792 852 jjjdj.exe 94 PID 852 wrote to memory of 4792 852 jjjdj.exe 94 PID 4792 wrote to memory of 4304 4792 bbnhhh.exe 95 PID 4792 wrote to memory of 4304 4792 bbnhhh.exe 95 PID 4792 wrote to memory of 4304 4792 bbnhhh.exe 95 PID 4304 wrote to memory of 1056 4304 9rllffx.exe 96 PID 4304 wrote to memory of 1056 4304 9rllffx.exe 96 PID 4304 wrote to memory of 1056 4304 9rllffx.exe 96 PID 1056 wrote to memory of 3532 1056 htnhbh.exe 97 PID 1056 wrote to memory of 3532 1056 htnhbh.exe 97 PID 1056 wrote to memory of 3532 1056 htnhbh.exe 97 PID 3532 wrote to memory of 4876 3532 btbbbb.exe 98 PID 3532 wrote to memory of 4876 3532 btbbbb.exe 98 PID 3532 wrote to memory of 4876 3532 btbbbb.exe 98 PID 4876 wrote to memory of 2468 4876 rrxxlrx.exe 99 PID 4876 wrote to memory of 2468 4876 rrxxlrx.exe 99 PID 4876 wrote to memory of 2468 4876 rrxxlrx.exe 99 PID 2468 wrote to memory of 1528 2468 nntnnb.exe 100 PID 2468 wrote to memory of 1528 2468 nntnnb.exe 100 PID 2468 wrote to memory of 1528 2468 nntnnb.exe 100 PID 1528 wrote to memory of 4480 1528 xxlrffx.exe 101 PID 1528 wrote to memory of 4480 1528 xxlrffx.exe 101 PID 1528 wrote to memory of 4480 1528 xxlrffx.exe 101 PID 4480 wrote to memory of 3500 4480 frfxrxx.exe 102 PID 4480 wrote to memory of 3500 4480 frfxrxx.exe 102 PID 4480 wrote to memory of 3500 4480 frfxrxx.exe 102 PID 3500 wrote to memory of 1568 3500 jvvvv.exe 103 PID 3500 wrote to memory of 1568 3500 jvvvv.exe 103 PID 3500 wrote to memory of 1568 3500 jvvvv.exe 103 PID 1568 wrote to memory of 3664 1568 rlrxxxf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe"C:\Users\Admin\AppData\Local\Temp\1c208e7028ba0a317dda21ed989c905e49cc9792db3da93d37a7b53bd98c6026.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\nnttnn.exec:\nnttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\9vvvv.exec:\9vvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\ppvpj.exec:\ppvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\lxffxxf.exec:\lxffxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\nbttnn.exec:\nbttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\rrffxxf.exec:\rrffxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\dvdpj.exec:\dvdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\djppp.exec:\djppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\lllffrx.exec:\lllffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\jjjdj.exec:\jjjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\bbnhhh.exec:\bbnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\9rllffx.exec:\9rllffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\htnhbh.exec:\htnhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\btbbbb.exec:\btbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\nntnnb.exec:\nntnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xxlrffx.exec:\xxlrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\frfxrxx.exec:\frfxrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jvvvv.exec:\jvvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\rlrxxxf.exec:\rlrxxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\fxfrrxf.exec:\fxfrrxf.exe23⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lrfffxl.exec:\lrfffxl.exe24⤵
- Executes dropped EXE
PID:2436 -
\??\c:\djvvp.exec:\djvvp.exe25⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbttnn.exec:\bbttnn.exe26⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpvjp.exec:\vpvjp.exe27⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rlxlflx.exec:\rlxlflx.exe28⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nttttb.exec:\nttttb.exe29⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vpjdj.exec:\vpjdj.exe30⤵
- Executes dropped EXE
PID:4176 -
\??\c:\ddppp.exec:\ddppp.exe31⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rrfllrl.exec:\rrfllrl.exe32⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rrxllxx.exec:\rrxllxx.exe33⤵
- Executes dropped EXE
PID:3464 -
\??\c:\djddd.exec:\djddd.exe34⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lrllrrr.exec:\lrllrrr.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5dppv.exec:\5dppv.exe36⤵
- Executes dropped EXE
PID:4536 -
\??\c:\fflffff.exec:\fflffff.exe37⤵
- Executes dropped EXE
PID:3680 -
\??\c:\pjddd.exec:\pjddd.exe38⤵
- Executes dropped EXE
PID:636 -
\??\c:\5bnnnb.exec:\5bnnnb.exe39⤵
- Executes dropped EXE
PID:968 -
\??\c:\vdvvp.exec:\vdvvp.exe40⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe41⤵
- Executes dropped EXE
PID:1272 -
\??\c:\nnntnt.exec:\nnntnt.exe42⤵
- Executes dropped EXE
PID:760 -
\??\c:\djpjj.exec:\djpjj.exe43⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vdddd.exec:\vdddd.exe44⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1flrrxl.exec:\1flrrxl.exe45⤵
- Executes dropped EXE
PID:4556 -
\??\c:\bbtttt.exec:\bbtttt.exe46⤵
- Executes dropped EXE
PID:4356 -
\??\c:\3vdjj.exec:\3vdjj.exe47⤵
- Executes dropped EXE
PID:5044 -
\??\c:\9xlfflx.exec:\9xlfflx.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bhthht.exec:\bhthht.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jdpjp.exec:\jdpjp.exe50⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dpvpv.exec:\dpvpv.exe51⤵
- Executes dropped EXE
PID:4708 -
\??\c:\rrlllll.exec:\rrlllll.exe52⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nhtthh.exec:\nhtthh.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vvjjj.exec:\vvjjj.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\dpddd.exec:\dpddd.exe55⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rrrxlll.exec:\rrrxlll.exe56⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tntbtn.exec:\tntbtn.exe57⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hhbtbh.exec:\hhbtbh.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dpjjd.exec:\dpjjd.exe59⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xfrlfff.exec:\xfrlfff.exe60⤵
- Executes dropped EXE
PID:3228 -
\??\c:\hhbbtb.exec:\hhbbtb.exe61⤵
- Executes dropped EXE
PID:2088 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vvdjp.exec:\vvdjp.exe63⤵
- Executes dropped EXE
PID:4100 -
\??\c:\lflfllf.exec:\lflfllf.exe64⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rrrrlll.exec:\rrrrlll.exe65⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nnbbhh.exec:\nnbbhh.exe66⤵PID:2652
-
\??\c:\7pppd.exec:\7pppd.exe67⤵PID:3192
-
\??\c:\pdvpp.exec:\pdvpp.exe68⤵PID:1132
-
\??\c:\xllrlrf.exec:\xllrlrf.exe69⤵PID:3912
-
\??\c:\bbnnhh.exec:\bbnnhh.exe70⤵PID:4948
-
\??\c:\jpvvv.exec:\jpvvv.exe71⤵PID:4032
-
\??\c:\5jvjj.exec:\5jvjj.exe72⤵PID:4392
-
\??\c:\bbhhbh.exec:\bbhhbh.exe73⤵PID:1128
-
\??\c:\dpddd.exec:\dpddd.exe74⤵PID:3532
-
\??\c:\jddvj.exec:\jddvj.exe75⤵PID:1164
-
\??\c:\fflffxr.exec:\fflffxr.exe76⤵PID:2692
-
\??\c:\nhtnht.exec:\nhtnht.exe77⤵PID:3840
-
\??\c:\vjvvj.exec:\vjvvj.exe78⤵PID:4936
-
\??\c:\3fllffl.exec:\3fllffl.exe79⤵PID:2968
-
\??\c:\xfrlllf.exec:\xfrlllf.exe80⤵PID:3556
-
\??\c:\9hnhhh.exec:\9hnhhh.exe81⤵PID:1320
-
\??\c:\1jjdv.exec:\1jjdv.exe82⤵PID:4488
-
\??\c:\xfrlflf.exec:\xfrlflf.exe83⤵PID:4760
-
\??\c:\xxflfff.exec:\xxflfff.exe84⤵PID:4784
-
\??\c:\nhhhhh.exec:\nhhhhh.exe85⤵PID:4888
-
\??\c:\hhntbb.exec:\hhntbb.exe86⤵PID:4836
-
\??\c:\3dpjd.exec:\3dpjd.exe87⤵PID:2560
-
\??\c:\1rlfrrf.exec:\1rlfrrf.exe88⤵PID:3356
-
\??\c:\9ttnbb.exec:\9ttnbb.exe89⤵
- System Location Discovery: System Language Discovery
PID:3752 -
\??\c:\tnbbbb.exec:\tnbbbb.exe90⤵PID:5024
-
\??\c:\jvjdv.exec:\jvjdv.exe91⤵PID:2564
-
\??\c:\7frrrrf.exec:\7frrrrf.exe92⤵PID:2808
-
\??\c:\xxffxxx.exec:\xxffxxx.exe93⤵PID:1872
-
\??\c:\1nnnnn.exec:\1nnnnn.exe94⤵PID:1192
-
\??\c:\pjjjd.exec:\pjjjd.exe95⤵PID:3160
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe96⤵PID:4308
-
\??\c:\hnbnhh.exec:\hnbnhh.exe97⤵PID:2784
-
\??\c:\vpvpp.exec:\vpvpp.exe98⤵PID:4640
-
\??\c:\jpppd.exec:\jpppd.exe99⤵PID:2880
-
\??\c:\lflxlfr.exec:\lflxlfr.exe100⤵PID:3464
-
\??\c:\bbbbtb.exec:\bbbbtb.exe101⤵PID:4220
-
\??\c:\5hhhbb.exec:\5hhhbb.exe102⤵PID:4112
-
\??\c:\pjdjv.exec:\pjdjv.exe103⤵PID:4808
-
\??\c:\frxxrll.exec:\frxxrll.exe104⤵PID:5000
-
\??\c:\hbhbtn.exec:\hbhbtn.exe105⤵PID:2408
-
\??\c:\pjjvp.exec:\pjjvp.exe106⤵PID:3584
-
\??\c:\vddvp.exec:\vddvp.exe107⤵PID:1564
-
\??\c:\rflfffx.exec:\rflfffx.exe108⤵PID:516
-
\??\c:\9bbbtt.exec:\9bbbtt.exe109⤵
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\1hnhbb.exec:\1hnhbb.exe110⤵PID:4416
-
\??\c:\jvppp.exec:\jvppp.exe111⤵PID:3164
-
\??\c:\xxllrrl.exec:\xxllrrl.exe112⤵PID:1448
-
\??\c:\fxfrrrl.exec:\fxfrrrl.exe113⤵
- System Location Discovery: System Language Discovery
PID:5076 -
\??\c:\bbbbbh.exec:\bbbbbh.exe114⤵
- System Location Discovery: System Language Discovery
PID:2216 -
\??\c:\dddjd.exec:\dddjd.exe115⤵PID:3316
-
\??\c:\pppjp.exec:\pppjp.exe116⤵PID:4548
-
\??\c:\7rrrrfl.exec:\7rrrrfl.exe117⤵PID:4400
-
\??\c:\hbhbth.exec:\hbhbth.exe118⤵PID:1544
-
\??\c:\vdjdd.exec:\vdjdd.exe119⤵PID:3540
-
\??\c:\dpjjd.exec:\dpjjd.exe120⤵PID:4592
-
\??\c:\ffrffrx.exec:\ffrffrx.exe121⤵PID:4796
-
\??\c:\lflllll.exec:\lflllll.exe122⤵PID:1444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-