Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 00:18
Static task
static1
Behavioral task
behavioral1
Sample
9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe
Resource
win7-20241010-en
General
-
Target
9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe
-
Size
453KB
-
MD5
8a455a6a7bb854e7e369d5eb6ec931c5
-
SHA1
06f45e7a87c7436b4332601af212dd7cd7d4c746
-
SHA256
9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf
-
SHA512
7c17fd0cce4f88854ea25251ec838c51616c4518b54e99265f27cef5ef7fdedeb6c9cf512efb08a502e756fa78232cb78f7f95400fd8aef3024251db603ff124
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbety:q7Tc2NYHUrAwfMp3CDty
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/872-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/720-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/792-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4596-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3800-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-886-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3412 lffxxrr.exe 5000 tntntn.exe 4984 pdjdd.exe 720 frflfff.exe 4616 rlxxffr.exe 1780 nbnnnt.exe 3340 rrrrlll.exe 2380 hbnhhh.exe 3700 vvpvj.exe 2536 xxrxfrx.exe 2760 3nnnnn.exe 1604 7xffffr.exe 3200 bnhbtt.exe 4596 ppjpp.exe 4364 fxrlrrr.exe 2124 1hnhbh.exe 2256 lxxxrrr.exe 4328 lfffxrr.exe 3308 tnhbnh.exe 4104 jjpdv.exe 4624 fxrfrfl.exe 8 xrxllfx.exe 4732 vppjp.exe 932 pjjvp.exe 4108 fxfxxrr.exe 3000 tntnbb.exe 740 tbnbnh.exe 3672 pdppd.exe 4992 3flfxrf.exe 2044 xxrfrlr.exe 2284 tbbnhb.exe 3384 pjdvp.exe 4392 xxxlfxl.exe 2208 3lrfrll.exe 2864 nbnhbt.exe 3536 jvjjd.exe 4152 3pjdv.exe 4240 lrxrfxx.exe 1288 nbbbtn.exe 3872 3pvpj.exe 3212 jjjdp.exe 1124 frxrlll.exe 2228 hhtnbb.exe 1160 nnthbb.exe 4524 vvjdv.exe 3544 7flfxxr.exe 4224 1nnhbb.exe 792 tnbttt.exe 2332 jppjv.exe 4576 xffxrrl.exe 4048 vpdvp.exe 3328 lxlxxrr.exe 3436 dvvjd.exe 3108 lxfxxxr.exe 2652 nbhbtn.exe 2716 pvpvd.exe 3800 7llffxr.exe 1948 rxxrlfx.exe 2364 hhhnnn.exe 836 3jdpd.exe 2380 llxlfxr.exe 4728 rlllflr.exe 1468 hhnhhb.exe 1304 jdpjp.exe -
resource yara_rule behavioral2/memory/872-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/720-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/792-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4596-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3800-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-563-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 3412 872 9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe 83 PID 872 wrote to memory of 3412 872 9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe 83 PID 872 wrote to memory of 3412 872 9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe 83 PID 3412 wrote to memory of 5000 3412 lffxxrr.exe 84 PID 3412 wrote to memory of 5000 3412 lffxxrr.exe 84 PID 3412 wrote to memory of 5000 3412 lffxxrr.exe 84 PID 5000 wrote to memory of 4984 5000 tntntn.exe 85 PID 5000 wrote to memory of 4984 5000 tntntn.exe 85 PID 5000 wrote to memory of 4984 5000 tntntn.exe 85 PID 4984 wrote to memory of 720 4984 pdjdd.exe 86 PID 4984 wrote to memory of 720 4984 pdjdd.exe 86 PID 4984 wrote to memory of 720 4984 pdjdd.exe 86 PID 720 wrote to memory of 4616 720 frflfff.exe 87 PID 720 wrote to memory of 4616 720 frflfff.exe 87 PID 720 wrote to memory of 4616 720 frflfff.exe 87 PID 4616 wrote to memory of 1780 4616 rlxxffr.exe 88 PID 4616 wrote to memory of 1780 4616 rlxxffr.exe 88 PID 4616 wrote to memory of 1780 4616 rlxxffr.exe 88 PID 1780 wrote to memory of 3340 1780 nbnnnt.exe 89 PID 1780 wrote to memory of 3340 1780 nbnnnt.exe 89 PID 1780 wrote to memory of 3340 1780 nbnnnt.exe 89 PID 3340 wrote to memory of 2380 3340 rrrrlll.exe 90 PID 3340 wrote to memory of 2380 3340 rrrrlll.exe 90 PID 3340 wrote to memory of 2380 3340 rrrrlll.exe 90 PID 2380 wrote to memory of 3700 2380 hbnhhh.exe 91 PID 2380 wrote to memory of 3700 2380 hbnhhh.exe 91 PID 2380 wrote to memory of 3700 2380 hbnhhh.exe 91 PID 3700 wrote to memory of 2536 3700 vvpvj.exe 92 PID 3700 wrote to memory of 2536 3700 vvpvj.exe 92 PID 3700 wrote to memory of 2536 3700 vvpvj.exe 92 PID 2536 wrote to memory of 2760 2536 xxrxfrx.exe 93 PID 2536 wrote to memory of 2760 2536 xxrxfrx.exe 93 PID 2536 wrote to memory of 2760 2536 xxrxfrx.exe 93 PID 2760 wrote to memory of 1604 2760 3nnnnn.exe 94 PID 2760 wrote to memory of 1604 2760 3nnnnn.exe 94 PID 2760 wrote to memory of 1604 2760 3nnnnn.exe 94 PID 1604 wrote to memory of 3200 1604 7xffffr.exe 95 PID 1604 wrote to memory of 3200 1604 7xffffr.exe 95 PID 1604 wrote to memory of 3200 1604 7xffffr.exe 95 PID 3200 wrote to memory of 4596 3200 bnhbtt.exe 96 PID 3200 wrote to memory of 4596 3200 bnhbtt.exe 96 PID 3200 wrote to memory of 4596 3200 bnhbtt.exe 96 PID 4596 wrote to memory of 4364 4596 ppjpp.exe 97 PID 4596 wrote to memory of 4364 4596 ppjpp.exe 97 PID 4596 wrote to memory of 4364 4596 ppjpp.exe 97 PID 4364 wrote to memory of 2124 4364 fxrlrrr.exe 98 PID 4364 wrote to memory of 2124 4364 fxrlrrr.exe 98 PID 4364 wrote to memory of 2124 4364 fxrlrrr.exe 98 PID 2124 wrote to memory of 2256 2124 1hnhbh.exe 99 PID 2124 wrote to memory of 2256 2124 1hnhbh.exe 99 PID 2124 wrote to memory of 2256 2124 1hnhbh.exe 99 PID 2256 wrote to memory of 4328 2256 lxxxrrr.exe 100 PID 2256 wrote to memory of 4328 2256 lxxxrrr.exe 100 PID 2256 wrote to memory of 4328 2256 lxxxrrr.exe 100 PID 4328 wrote to memory of 3308 4328 lfffxrr.exe 101 PID 4328 wrote to memory of 3308 4328 lfffxrr.exe 101 PID 4328 wrote to memory of 3308 4328 lfffxrr.exe 101 PID 3308 wrote to memory of 4104 3308 tnhbnh.exe 102 PID 3308 wrote to memory of 4104 3308 tnhbnh.exe 102 PID 3308 wrote to memory of 4104 3308 tnhbnh.exe 102 PID 4104 wrote to memory of 4624 4104 jjpdv.exe 103 PID 4104 wrote to memory of 4624 4104 jjpdv.exe 103 PID 4104 wrote to memory of 4624 4104 jjpdv.exe 103 PID 4624 wrote to memory of 8 4624 fxrfrfl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe"C:\Users\Admin\AppData\Local\Temp\9239bac235588057c11e6b6a5990867e3b77c65bbae1dc312b014a08fe4367bf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\lffxxrr.exec:\lffxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\tntntn.exec:\tntntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\pdjdd.exec:\pdjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\frflfff.exec:\frflfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\rlxxffr.exec:\rlxxffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nbnnnt.exec:\nbnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rrrrlll.exec:\rrrrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\hbnhhh.exec:\hbnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vvpvj.exec:\vvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\3nnnnn.exec:\3nnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\7xffffr.exec:\7xffffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\bnhbtt.exec:\bnhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\ppjpp.exec:\ppjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\1hnhbh.exec:\1hnhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\lfffxrr.exec:\lfffxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\tnhbnh.exec:\tnhbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\jjpdv.exec:\jjpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\fxrfrfl.exec:\fxrfrfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\xrxllfx.exec:\xrxllfx.exe23⤵
- Executes dropped EXE
PID:8 -
\??\c:\vppjp.exec:\vppjp.exe24⤵
- Executes dropped EXE
PID:4732 -
\??\c:\pjjvp.exec:\pjjvp.exe25⤵
- Executes dropped EXE
PID:932 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe26⤵
- Executes dropped EXE
PID:4108 -
\??\c:\tntnbb.exec:\tntnbb.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tbnbnh.exec:\tbnbnh.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:740 -
\??\c:\pdppd.exec:\pdppd.exe29⤵
- Executes dropped EXE
PID:3672 -
\??\c:\3flfxrf.exec:\3flfxrf.exe30⤵
- Executes dropped EXE
PID:4992 -
\??\c:\xxrfrlr.exec:\xxrfrlr.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\tbbnhb.exec:\tbbnhb.exe32⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pjdvp.exec:\pjdvp.exe33⤵
- Executes dropped EXE
PID:3384 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe34⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3lrfrll.exec:\3lrfrll.exe35⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nbnhbt.exec:\nbnhbt.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jvjjd.exec:\jvjjd.exe37⤵
- Executes dropped EXE
PID:3536 -
\??\c:\3pjdv.exec:\3pjdv.exe38⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lrxrfxx.exec:\lrxrfxx.exe39⤵
- Executes dropped EXE
PID:4240 -
\??\c:\nbbbtn.exec:\nbbbtn.exe40⤵
- Executes dropped EXE
PID:1288 -
\??\c:\3pvpj.exec:\3pvpj.exe41⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jjjdp.exec:\jjjdp.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3212 -
\??\c:\frxrlll.exec:\frxrlll.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hhtnbb.exec:\hhtnbb.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnthbb.exec:\nnthbb.exe45⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vvjdv.exec:\vvjdv.exe46⤵
- Executes dropped EXE
PID:4524 -
\??\c:\7flfxxr.exec:\7flfxxr.exe47⤵
- Executes dropped EXE
PID:3544 -
\??\c:\1nnhbb.exec:\1nnhbb.exe48⤵
- Executes dropped EXE
PID:4224 -
\??\c:\tnbttt.exec:\tnbttt.exe49⤵
- Executes dropped EXE
PID:792 -
\??\c:\jppjv.exec:\jppjv.exe50⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xffxrrl.exec:\xffxrrl.exe51⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vpdvp.exec:\vpdvp.exe52⤵
- Executes dropped EXE
PID:4048 -
\??\c:\lxlxxrr.exec:\lxlxxrr.exe53⤵
- Executes dropped EXE
PID:3328 -
\??\c:\dvvjd.exec:\dvvjd.exe54⤵
- Executes dropped EXE
PID:3436 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe55⤵
- Executes dropped EXE
PID:3108 -
\??\c:\nbhbtn.exec:\nbhbtn.exe56⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pvpvd.exec:\pvpvd.exe57⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7llffxr.exec:\7llffxr.exe58⤵
- Executes dropped EXE
PID:3800 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe59⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhhnnn.exec:\hhhnnn.exe60⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3jdpd.exec:\3jdpd.exe61⤵
- Executes dropped EXE
PID:836 -
\??\c:\llxlfxr.exec:\llxlfxr.exe62⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rlllflr.exec:\rlllflr.exe63⤵
- Executes dropped EXE
PID:4728 -
\??\c:\hhnhhb.exec:\hhnhhb.exe64⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jdpjp.exec:\jdpjp.exe65⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ffxlrlf.exec:\ffxlrlf.exe66⤵PID:2744
-
\??\c:\bnhbtt.exec:\bnhbtt.exe67⤵PID:4664
-
\??\c:\ddvpp.exec:\ddvpp.exe68⤵PID:1604
-
\??\c:\5hnnbb.exec:\5hnnbb.exe69⤵PID:1520
-
\??\c:\5rfllrr.exec:\5rfllrr.exe70⤵PID:1572
-
\??\c:\nhnnhh.exec:\nhnnhh.exe71⤵PID:2168
-
\??\c:\vdpjv.exec:\vdpjv.exe72⤵PID:1884
-
\??\c:\5fflfll.exec:\5fflfll.exe73⤵PID:4436
-
\??\c:\nbbtnn.exec:\nbbtnn.exe74⤵PID:4008
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe75⤵PID:3024
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe76⤵PID:1232
-
\??\c:\7vjdd.exec:\7vjdd.exe77⤵PID:4104
-
\??\c:\lrfxxrr.exec:\lrfxxrr.exe78⤵PID:4000
-
\??\c:\hbbtnn.exec:\hbbtnn.exe79⤵PID:8
-
\??\c:\bhbbnh.exec:\bhbbnh.exe80⤵PID:4732
-
\??\c:\vpvjp.exec:\vpvjp.exe81⤵PID:3052
-
\??\c:\hnbnnb.exec:\hnbnnb.exe82⤵PID:3524
-
\??\c:\dddvp.exec:\dddvp.exe83⤵PID:3968
-
\??\c:\rlxfrlr.exec:\rlxfrlr.exe84⤵PID:4416
-
\??\c:\nhhbnn.exec:\nhhbnn.exe85⤵PID:4180
-
\??\c:\jvvdv.exec:\jvvdv.exe86⤵PID:2908
-
\??\c:\xrrlllf.exec:\xrrlllf.exe87⤵PID:2272
-
\??\c:\xrlffxr.exec:\xrlffxr.exe88⤵
- System Location Discovery: System Language Discovery
PID:3552 -
\??\c:\7bhhhh.exec:\7bhhhh.exe89⤵PID:1060
-
\??\c:\jdvvv.exec:\jdvvv.exe90⤵PID:4440
-
\??\c:\xxfrrff.exec:\xxfrrff.exe91⤵PID:4544
-
\??\c:\xffxlfx.exec:\xffxlfx.exe92⤵PID:2460
-
\??\c:\bnhbth.exec:\bnhbth.exe93⤵PID:2972
-
\??\c:\pvdvj.exec:\pvdvj.exe94⤵PID:4800
-
\??\c:\fxxxrlr.exec:\fxxxrlr.exe95⤵PID:1736
-
\??\c:\pdjjj.exec:\pdjjj.exe96⤵PID:3096
-
\??\c:\fffxxrr.exec:\fffxxrr.exe97⤵PID:5092
-
\??\c:\pvjjp.exec:\pvjjp.exe98⤵PID:2780
-
\??\c:\lflfxxr.exec:\lflfxxr.exe99⤵PID:2916
-
\??\c:\btbttt.exec:\btbttt.exe100⤵PID:4716
-
\??\c:\xllfxxr.exec:\xllfxxr.exe101⤵PID:4528
-
\??\c:\htbtbt.exec:\htbtbt.exe102⤵PID:760
-
\??\c:\ntbthb.exec:\ntbthb.exe103⤵PID:1160
-
\??\c:\djjjd.exec:\djjjd.exe104⤵PID:4488
-
\??\c:\3llxlfx.exec:\3llxlfx.exe105⤵PID:4644
-
\??\c:\3btthh.exec:\3btthh.exe106⤵PID:652
-
\??\c:\vvjvv.exec:\vvjvv.exe107⤵PID:4224
-
\??\c:\5ffrllf.exec:\5ffrllf.exe108⤵PID:3152
-
\??\c:\tbhhhh.exec:\tbhhhh.exe109⤵PID:3508
-
\??\c:\jvvpd.exec:\jvvpd.exe110⤵PID:2332
-
\??\c:\5flfrrl.exec:\5flfrrl.exe111⤵PID:2576
-
\??\c:\lxffxxx.exec:\lxffxxx.exe112⤵PID:1700
-
\??\c:\ttbtbb.exec:\ttbtbb.exe113⤵PID:3740
-
\??\c:\7vvjp.exec:\7vvjp.exe114⤵PID:1500
-
\??\c:\rxxxlfr.exec:\rxxxlfr.exe115⤵PID:3108
-
\??\c:\htthbb.exec:\htthbb.exe116⤵PID:2652
-
\??\c:\7hhhhn.exec:\7hhhhn.exe117⤵PID:3368
-
\??\c:\jdvpp.exec:\jdvpp.exe118⤵PID:3208
-
\??\c:\5rxlrxf.exec:\5rxlrxf.exe119⤵
- System Location Discovery: System Language Discovery
PID:1452 -
\??\c:\hnthbh.exec:\hnthbh.exe120⤵PID:2268
-
\??\c:\dppjd.exec:\dppjd.exe121⤵PID:836
-
\??\c:\dpddj.exec:\dpddj.exe122⤵PID:4556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-