Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 00:52
Static task
static1
Behavioral task
behavioral1
Sample
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe
Resource
win7-20240903-en
General
-
Target
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe
-
Size
455KB
-
MD5
34ba055ccefa7f7c51290aab003a3646
-
SHA1
3268a60f7a4be956c8a67c2bf2153f2e6958e835
-
SHA256
9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946
-
SHA512
04db03670f95875a3088c9680e52b97586c1ead7274c2dec23b89224a627b6c9283915e5c90adc1e35104244c1dfec3b5783fe1e9dd854c4af151c04e91c4b05
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTT:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2772-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1528-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1832-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/776-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2856-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1984-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2980-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3924-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-974-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-1008-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5080 ttnntt.exe 4144 pjjjj.exe 4744 llxfxrl.exe 5108 fxffxll.exe 3148 ppppd.exe 2128 1djdv.exe 2852 xxrllxx.exe 3204 httnhb.exe 4896 pppjv.exe 448 nbbnht.exe 1700 rlfxlfr.exe 2780 hbtnbb.exe 3636 1pvvv.exe 4108 nbhhtt.exe 1876 ppvpj.exe 4408 frlfxxx.exe 4188 bnbthh.exe 1528 vppjj.exe 1016 1xlxxxr.exe 1620 nnnhbh.exe 2600 ppjdj.exe 1832 lxrlrxx.exe 4512 5dpdd.exe 4480 llllfff.exe 1448 9bbbbh.exe 3768 vpvvp.exe 3940 btttnn.exe 776 dpvvp.exe 4488 tttthh.exe 5008 9fffxxr.exe 2164 fffffff.exe 1404 vpvvv.exe 4104 vvppv.exe 1524 7hhbtt.exe 4472 nhnnbn.exe 2940 fffxrxx.exe 4996 ntbbbt.exe 3004 xxffxll.exe 3316 hbhhhh.exe 628 jdddd.exe 1492 1ddvp.exe 2924 rlrrrrr.exe 2856 nhhnbn.exe 348 1jjjj.exe 1092 xlrfxxr.exe 4424 9hnnbh.exe 4584 ppjjv.exe 3252 ddppd.exe 1608 frlllll.exe 536 hhnhhh.exe 2592 ddvvv.exe 3140 xxfflll.exe 4744 rrfffll.exe 1984 tnbtnt.exe 1920 vdvpj.exe 4928 fxxrrrl.exe 3300 nhnnhh.exe 936 hhhhnt.exe 4944 jvdvp.exe 2804 pvvdp.exe 1416 7xllflr.exe 4840 tthbhh.exe 468 pdddd.exe 3092 9xfxrrl.exe -
resource yara_rule behavioral2/memory/5080-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1528-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1832-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/776-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2856-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1984-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1416-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2980-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3924-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-762-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 5080 2772 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 83 PID 2772 wrote to memory of 5080 2772 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 83 PID 2772 wrote to memory of 5080 2772 9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe 83 PID 5080 wrote to memory of 4144 5080 ttnntt.exe 84 PID 5080 wrote to memory of 4144 5080 ttnntt.exe 84 PID 5080 wrote to memory of 4144 5080 ttnntt.exe 84 PID 4144 wrote to memory of 4744 4144 pjjjj.exe 85 PID 4144 wrote to memory of 4744 4144 pjjjj.exe 85 PID 4144 wrote to memory of 4744 4144 pjjjj.exe 85 PID 4744 wrote to memory of 5108 4744 llxfxrl.exe 86 PID 4744 wrote to memory of 5108 4744 llxfxrl.exe 86 PID 4744 wrote to memory of 5108 4744 llxfxrl.exe 86 PID 5108 wrote to memory of 3148 5108 fxffxll.exe 87 PID 5108 wrote to memory of 3148 5108 fxffxll.exe 87 PID 5108 wrote to memory of 3148 5108 fxffxll.exe 87 PID 3148 wrote to memory of 2128 3148 ppppd.exe 88 PID 3148 wrote to memory of 2128 3148 ppppd.exe 88 PID 3148 wrote to memory of 2128 3148 ppppd.exe 88 PID 2128 wrote to memory of 2852 2128 1djdv.exe 89 PID 2128 wrote to memory of 2852 2128 1djdv.exe 89 PID 2128 wrote to memory of 2852 2128 1djdv.exe 89 PID 2852 wrote to memory of 3204 2852 xxrllxx.exe 90 PID 2852 wrote to memory of 3204 2852 xxrllxx.exe 90 PID 2852 wrote to memory of 3204 2852 xxrllxx.exe 90 PID 3204 wrote to memory of 4896 3204 httnhb.exe 91 PID 3204 wrote to memory of 4896 3204 httnhb.exe 91 PID 3204 wrote to memory of 4896 3204 httnhb.exe 91 PID 4896 wrote to memory of 448 4896 pppjv.exe 92 PID 4896 wrote to memory of 448 4896 pppjv.exe 92 PID 4896 wrote to memory of 448 4896 pppjv.exe 92 PID 448 wrote to memory of 1700 448 nbbnht.exe 93 PID 448 wrote to memory of 1700 448 nbbnht.exe 93 PID 448 wrote to memory of 1700 448 nbbnht.exe 93 PID 1700 wrote to memory of 2780 1700 rlfxlfr.exe 94 PID 1700 wrote to memory of 2780 1700 rlfxlfr.exe 94 PID 1700 wrote to memory of 2780 1700 rlfxlfr.exe 94 PID 2780 wrote to memory of 3636 2780 hbtnbb.exe 95 PID 2780 wrote to memory of 3636 2780 hbtnbb.exe 95 PID 2780 wrote to memory of 3636 2780 hbtnbb.exe 95 PID 3636 wrote to memory of 4108 3636 1pvvv.exe 96 PID 3636 wrote to memory of 4108 3636 1pvvv.exe 96 PID 3636 wrote to memory of 4108 3636 1pvvv.exe 96 PID 4108 wrote to memory of 1876 4108 nbhhtt.exe 97 PID 4108 wrote to memory of 1876 4108 nbhhtt.exe 97 PID 4108 wrote to memory of 1876 4108 nbhhtt.exe 97 PID 1876 wrote to memory of 4408 1876 ppvpj.exe 98 PID 1876 wrote to memory of 4408 1876 ppvpj.exe 98 PID 1876 wrote to memory of 4408 1876 ppvpj.exe 98 PID 4408 wrote to memory of 4188 4408 frlfxxx.exe 99 PID 4408 wrote to memory of 4188 4408 frlfxxx.exe 99 PID 4408 wrote to memory of 4188 4408 frlfxxx.exe 99 PID 4188 wrote to memory of 1528 4188 bnbthh.exe 100 PID 4188 wrote to memory of 1528 4188 bnbthh.exe 100 PID 4188 wrote to memory of 1528 4188 bnbthh.exe 100 PID 1528 wrote to memory of 1016 1528 vppjj.exe 101 PID 1528 wrote to memory of 1016 1528 vppjj.exe 101 PID 1528 wrote to memory of 1016 1528 vppjj.exe 101 PID 1016 wrote to memory of 1620 1016 1xlxxxr.exe 102 PID 1016 wrote to memory of 1620 1016 1xlxxxr.exe 102 PID 1016 wrote to memory of 1620 1016 1xlxxxr.exe 102 PID 1620 wrote to memory of 2600 1620 nnnhbh.exe 103 PID 1620 wrote to memory of 2600 1620 nnnhbh.exe 103 PID 1620 wrote to memory of 2600 1620 nnnhbh.exe 103 PID 2600 wrote to memory of 1832 2600 ppjdj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe"C:\Users\Admin\AppData\Local\Temp\9ee11916504a12e3af36c7567edccd61f858debc92bfcb66f93a92d1f6164946.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ttnntt.exec:\ttnntt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pjjjj.exec:\pjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\llxfxrl.exec:\llxfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\fxffxll.exec:\fxffxll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\ppppd.exec:\ppppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\1djdv.exec:\1djdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xxrllxx.exec:\xxrllxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\httnhb.exec:\httnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\pppjv.exec:\pppjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\nbbnht.exec:\nbbnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hbtnbb.exec:\hbtnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\1pvvv.exec:\1pvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\nbhhtt.exec:\nbhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\ppvpj.exec:\ppvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\frlfxxx.exec:\frlfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\bnbthh.exec:\bnbthh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\vppjj.exec:\vppjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\1xlxxxr.exec:\1xlxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\nnnhbh.exec:\nnnhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\ppjdj.exec:\ppjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\lxrlrxx.exec:\lxrlrxx.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\5dpdd.exec:\5dpdd.exe24⤵
- Executes dropped EXE
PID:4512 -
\??\c:\llllfff.exec:\llllfff.exe25⤵
- Executes dropped EXE
PID:4480 -
\??\c:\9bbbbh.exec:\9bbbbh.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vpvvp.exec:\vpvvp.exe27⤵
- Executes dropped EXE
PID:3768 -
\??\c:\btttnn.exec:\btttnn.exe28⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dpvvp.exec:\dpvvp.exe29⤵
- Executes dropped EXE
PID:776 -
\??\c:\tttthh.exec:\tttthh.exe30⤵
- Executes dropped EXE
PID:4488 -
\??\c:\9fffxxr.exec:\9fffxxr.exe31⤵
- Executes dropped EXE
PID:5008 -
\??\c:\fffffff.exec:\fffffff.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpvvv.exec:\vpvvv.exe33⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vvppv.exec:\vvppv.exe34⤵
- Executes dropped EXE
PID:4104 -
\??\c:\7hhbtt.exec:\7hhbtt.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nhnnbn.exec:\nhnnbn.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\fffxrxx.exec:\fffxrxx.exe37⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ntbbbt.exec:\ntbbbt.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xxffxll.exec:\xxffxll.exe39⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hbhhhh.exec:\hbhhhh.exe40⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jdddd.exec:\jdddd.exe41⤵
- Executes dropped EXE
PID:628 -
\??\c:\1ddvp.exec:\1ddvp.exe42⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe43⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhhnbn.exec:\nhhnbn.exe44⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1jjjj.exec:\1jjjj.exe45⤵
- Executes dropped EXE
PID:348 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe46⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9hnnbh.exec:\9hnnbh.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\ppjjv.exec:\ppjjv.exe48⤵
- Executes dropped EXE
PID:4584 -
\??\c:\ddppd.exec:\ddppd.exe49⤵
- Executes dropped EXE
PID:3252 -
\??\c:\frlllll.exec:\frlllll.exe50⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhnhhh.exec:\hhnhhh.exe51⤵
- Executes dropped EXE
PID:536 -
\??\c:\ddvvv.exec:\ddvvv.exe52⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xxfflll.exec:\xxfflll.exe53⤵
- Executes dropped EXE
PID:3140 -
\??\c:\rrfffll.exec:\rrfffll.exe54⤵
- Executes dropped EXE
PID:4744 -
\??\c:\tnbtnt.exec:\tnbtnt.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vdvpj.exec:\vdvpj.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe57⤵
- Executes dropped EXE
PID:4928 -
\??\c:\nhnnhh.exec:\nhnnhh.exe58⤵
- Executes dropped EXE
PID:3300 -
\??\c:\hhhhnt.exec:\hhhhnt.exe59⤵
- Executes dropped EXE
PID:936 -
\??\c:\jvdvp.exec:\jvdvp.exe60⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pvvdp.exec:\pvvdp.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7xllflr.exec:\7xllflr.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tthbhh.exec:\tthbhh.exe63⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pdddd.exec:\pdddd.exe64⤵
- Executes dropped EXE
PID:468 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe65⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nbhhnn.exec:\nbhhnn.exe66⤵PID:3720
-
\??\c:\vjdvp.exec:\vjdvp.exe67⤵PID:2740
-
\??\c:\ffrrlfl.exec:\ffrrlfl.exe68⤵PID:2980
-
\??\c:\tnnnnn.exec:\tnnnnn.exe69⤵PID:2396
-
\??\c:\7tttbh.exec:\7tttbh.exe70⤵PID:3668
-
\??\c:\jpvpj.exec:\jpvpj.exe71⤵PID:1876
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe72⤵PID:4644
-
\??\c:\bthttt.exec:\bthttt.exe73⤵PID:3900
-
\??\c:\vppvj.exec:\vppvj.exe74⤵PID:2036
-
\??\c:\7jvpj.exec:\7jvpj.exe75⤵PID:2304
-
\??\c:\rllffxr.exec:\rllffxr.exe76⤵PID:4864
-
\??\c:\httbtt.exec:\httbtt.exe77⤵PID:4160
-
\??\c:\jjddj.exec:\jjddj.exe78⤵PID:4404
-
\??\c:\rllfxxx.exec:\rllfxxx.exe79⤵PID:208
-
\??\c:\thnnhh.exec:\thnnhh.exe80⤵PID:3440
-
\??\c:\pjjjp.exec:\pjjjp.exe81⤵PID:4924
-
\??\c:\7llxllf.exec:\7llxllf.exe82⤵PID:3708
-
\??\c:\hhttbb.exec:\hhttbb.exe83⤵
- System Location Discovery: System Language Discovery
PID:2724 -
\??\c:\jppjd.exec:\jppjd.exe84⤵PID:4480
-
\??\c:\pvppj.exec:\pvppj.exe85⤵PID:1448
-
\??\c:\lrxxxff.exec:\lrxxxff.exe86⤵PID:3888
-
\??\c:\hbhhbh.exec:\hbhhbh.exe87⤵PID:3448
-
\??\c:\pvddv.exec:\pvddv.exe88⤵PID:4736
-
\??\c:\lflllrr.exec:\lflllrr.exe89⤵PID:3616
-
\??\c:\9hhhhn.exec:\9hhhhn.exe90⤵PID:776
-
\??\c:\vdddd.exec:\vdddd.exe91⤵PID:4488
-
\??\c:\lrfxlxx.exec:\lrfxlxx.exe92⤵PID:4728
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe93⤵PID:4272
-
\??\c:\bthbbb.exec:\bthbbb.exe94⤵PID:4124
-
\??\c:\vvjdj.exec:\vvjdj.exe95⤵PID:1404
-
\??\c:\7rlfllx.exec:\7rlfllx.exe96⤵PID:3376
-
\??\c:\bhbttt.exec:\bhbttt.exe97⤵PID:2448
-
\??\c:\bnnnnt.exec:\bnnnnt.exe98⤵PID:1600
-
\??\c:\dvvpj.exec:\dvvpj.exe99⤵PID:4520
-
\??\c:\lrlffff.exec:\lrlffff.exe100⤵PID:4140
-
\??\c:\bbntbb.exec:\bbntbb.exe101⤵PID:4996
-
\??\c:\htbttt.exec:\htbttt.exe102⤵PID:3464
-
\??\c:\vdjjj.exec:\vdjjj.exe103⤵PID:1824
-
\??\c:\lflllll.exec:\lflllll.exe104⤵PID:4252
-
\??\c:\thbbbb.exec:\thbbbb.exe105⤵PID:4292
-
\??\c:\5jpjv.exec:\5jpjv.exe106⤵PID:4576
-
\??\c:\9llxlll.exec:\9llxlll.exe107⤵PID:3260
-
\??\c:\7bthbh.exec:\7bthbh.exe108⤵PID:2844
-
\??\c:\pjjjp.exec:\pjjjp.exe109⤵PID:4368
-
\??\c:\lfrlfff.exec:\lfrlfff.exe110⤵PID:1960
-
\??\c:\btbttb.exec:\btbttb.exe111⤵PID:4568
-
\??\c:\vvpjp.exec:\vvpjp.exe112⤵PID:3724
-
\??\c:\pjdpd.exec:\pjdpd.exe113⤵PID:2052
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe114⤵PID:4008
-
\??\c:\htbbtt.exec:\htbbtt.exe115⤵PID:4420
-
\??\c:\pjjdd.exec:\pjjdd.exe116⤵PID:2592
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe117⤵PID:3140
-
\??\c:\btbbtt.exec:\btbbtt.exe118⤵PID:3924
-
\??\c:\tntnhh.exec:\tntnhh.exe119⤵PID:1984
-
\??\c:\vvjjp.exec:\vvjjp.exe120⤵PID:2084
-
\??\c:\lllxlxl.exec:\lllxlxl.exe121⤵PID:4928
-
\??\c:\nnnhhh.exec:\nnnhhh.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-