Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 00:22
Static task
static1
Behavioral task
behavioral1
Sample
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe
Resource
win7-20240903-en
General
-
Target
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe
-
Size
454KB
-
MD5
e3d80e0e9b9b181821b6c6ca021ccdea
-
SHA1
6a317088de51e884965588c39c2b6d5e5e1d338f
-
SHA256
9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3
-
SHA512
028600357e82ba458a4c4be6bea3ce5ec671f18399253176d03194aa2ea5387af3bf35e25f022a936fbb8716d9793d6671d5b09c0633c440b612df871a41d568
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT4:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/872-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1412-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4784-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/984-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5056-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/344-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-752-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2676-963-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-988-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-1055-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1012 vpvvv.exe 3624 pvppp.exe 4064 frfrlxx.exe 2928 btnnbb.exe 3216 nthtbt.exe 2464 fllrflf.exe 2428 vvddd.exe 1412 fxrlrrx.exe 4040 xfllrrr.exe 3992 ttbtht.exe 4976 xlxxrrx.exe 3008 ttttht.exe 2836 pdppj.exe 2468 xxxxxfx.exe 2452 tbhnnn.exe 4784 dvpjj.exe 1676 nhbhhh.exe 2024 1dvdv.exe 2800 jjvvp.exe 1844 ntbbhh.exe 332 9nbtnt.exe 2636 jdppp.exe 3020 ffrrxff.exe 3136 bntnhb.exe 2504 lfflllr.exe 1288 ttnthn.exe 860 djdjv.exe 5116 jvvpd.exe 3604 fllffrr.exe 4728 1nhbbt.exe 4072 nnthhn.exe 4812 vpvvp.exe 4828 btttnh.exe 3276 pvjjj.exe 5068 xrfrrxf.exe 5104 jdvvp.exe 4680 xrlllll.exe 2584 tnttbh.exe 4684 bbbttt.exe 1772 7dppv.exe 984 hhnhht.exe 3032 pvvpd.exe 3108 rrfxxff.exe 4768 jvpvj.exe 3584 djppp.exe 3548 hbhbbh.exe 4344 ddpjp.exe 1716 llxxllx.exe 4396 bbnhbb.exe 4400 pvjjd.exe 4404 xxrrrrl.exe 4464 tntttt.exe 3680 flxxrxx.exe 3532 lfrxlrr.exe 1504 thhhtb.exe 4064 lxrrfll.exe 2540 hhtnnn.exe 3260 vpppj.exe 3132 lfxrlll.exe 1704 flxxrff.exe 208 hbbbbh.exe 4144 pdjjj.exe 4160 xrfxxxx.exe 4844 nttnnn.exe -
resource yara_rule behavioral2/memory/872-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1412-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4784-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2636-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/984-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5056-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/344-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2676-963-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrffxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrffxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 872 wrote to memory of 1012 872 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 82 PID 872 wrote to memory of 1012 872 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 82 PID 872 wrote to memory of 1012 872 9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe 82 PID 1012 wrote to memory of 3624 1012 vpvvv.exe 83 PID 1012 wrote to memory of 3624 1012 vpvvv.exe 83 PID 1012 wrote to memory of 3624 1012 vpvvv.exe 83 PID 3624 wrote to memory of 4064 3624 pvppp.exe 84 PID 3624 wrote to memory of 4064 3624 pvppp.exe 84 PID 3624 wrote to memory of 4064 3624 pvppp.exe 84 PID 4064 wrote to memory of 2928 4064 frfrlxx.exe 85 PID 4064 wrote to memory of 2928 4064 frfrlxx.exe 85 PID 4064 wrote to memory of 2928 4064 frfrlxx.exe 85 PID 2928 wrote to memory of 3216 2928 btnnbb.exe 86 PID 2928 wrote to memory of 3216 2928 btnnbb.exe 86 PID 2928 wrote to memory of 3216 2928 btnnbb.exe 86 PID 3216 wrote to memory of 2464 3216 nthtbt.exe 87 PID 3216 wrote to memory of 2464 3216 nthtbt.exe 87 PID 3216 wrote to memory of 2464 3216 nthtbt.exe 87 PID 2464 wrote to memory of 2428 2464 fllrflf.exe 88 PID 2464 wrote to memory of 2428 2464 fllrflf.exe 88 PID 2464 wrote to memory of 2428 2464 fllrflf.exe 88 PID 2428 wrote to memory of 1412 2428 vvddd.exe 89 PID 2428 wrote to memory of 1412 2428 vvddd.exe 89 PID 2428 wrote to memory of 1412 2428 vvddd.exe 89 PID 1412 wrote to memory of 4040 1412 fxrlrrx.exe 90 PID 1412 wrote to memory of 4040 1412 fxrlrrx.exe 90 PID 1412 wrote to memory of 4040 1412 fxrlrrx.exe 90 PID 4040 wrote to memory of 3992 4040 xfllrrr.exe 91 PID 4040 wrote to memory of 3992 4040 xfllrrr.exe 91 PID 4040 wrote to memory of 3992 4040 xfllrrr.exe 91 PID 3992 wrote to memory of 4976 3992 ttbtht.exe 92 PID 3992 wrote to memory of 4976 3992 ttbtht.exe 92 PID 3992 wrote to memory of 4976 3992 ttbtht.exe 92 PID 4976 wrote to memory of 3008 4976 xlxxrrx.exe 93 PID 4976 wrote to memory of 3008 4976 xlxxrrx.exe 93 PID 4976 wrote to memory of 3008 4976 xlxxrrx.exe 93 PID 3008 wrote to memory of 2836 3008 ttttht.exe 94 PID 3008 wrote to memory of 2836 3008 ttttht.exe 94 PID 3008 wrote to memory of 2836 3008 ttttht.exe 94 PID 2836 wrote to memory of 2468 2836 pdppj.exe 95 PID 2836 wrote to memory of 2468 2836 pdppj.exe 95 PID 2836 wrote to memory of 2468 2836 pdppj.exe 95 PID 2468 wrote to memory of 2452 2468 xxxxxfx.exe 96 PID 2468 wrote to memory of 2452 2468 xxxxxfx.exe 96 PID 2468 wrote to memory of 2452 2468 xxxxxfx.exe 96 PID 2452 wrote to memory of 4784 2452 tbhnnn.exe 97 PID 2452 wrote to memory of 4784 2452 tbhnnn.exe 97 PID 2452 wrote to memory of 4784 2452 tbhnnn.exe 97 PID 4784 wrote to memory of 1676 4784 dvpjj.exe 98 PID 4784 wrote to memory of 1676 4784 dvpjj.exe 98 PID 4784 wrote to memory of 1676 4784 dvpjj.exe 98 PID 1676 wrote to memory of 2024 1676 nhbhhh.exe 99 PID 1676 wrote to memory of 2024 1676 nhbhhh.exe 99 PID 1676 wrote to memory of 2024 1676 nhbhhh.exe 99 PID 2024 wrote to memory of 2800 2024 1dvdv.exe 100 PID 2024 wrote to memory of 2800 2024 1dvdv.exe 100 PID 2024 wrote to memory of 2800 2024 1dvdv.exe 100 PID 2800 wrote to memory of 1844 2800 jjvvp.exe 101 PID 2800 wrote to memory of 1844 2800 jjvvp.exe 101 PID 2800 wrote to memory of 1844 2800 jjvvp.exe 101 PID 1844 wrote to memory of 332 1844 ntbbhh.exe 102 PID 1844 wrote to memory of 332 1844 ntbbhh.exe 102 PID 1844 wrote to memory of 332 1844 ntbbhh.exe 102 PID 332 wrote to memory of 2636 332 9nbtnt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe"C:\Users\Admin\AppData\Local\Temp\9569a36ca56acfaf5cce3b19d69f02d801bb898dfe6081cf93b8dcf47c4913e3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\vpvvv.exec:\vpvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\pvppp.exec:\pvppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\frfrlxx.exec:\frfrlxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\btnnbb.exec:\btnnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\nthtbt.exec:\nthtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\fllrflf.exec:\fllrflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vvddd.exec:\vvddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\xfllrrr.exec:\xfllrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\ttbtht.exec:\ttbtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\xlxxrrx.exec:\xlxxrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\ttttht.exec:\ttttht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pdppj.exec:\pdppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xxxxxfx.exec:\xxxxxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tbhnnn.exec:\tbhnnn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\dvpjj.exec:\dvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\nhbhhh.exec:\nhbhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\1dvdv.exec:\1dvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jjvvp.exec:\jjvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ntbbhh.exec:\ntbbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\9nbtnt.exec:\9nbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\jdppp.exec:\jdppp.exe23⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ffrrxff.exec:\ffrrxff.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bntnhb.exec:\bntnhb.exe25⤵
- Executes dropped EXE
PID:3136 -
\??\c:\lfflllr.exec:\lfflllr.exe26⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ttnthn.exec:\ttnthn.exe27⤵
- Executes dropped EXE
PID:1288 -
\??\c:\djdjv.exec:\djdjv.exe28⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvvpd.exec:\jvvpd.exe29⤵
- Executes dropped EXE
PID:5116 -
\??\c:\fllffrr.exec:\fllffrr.exe30⤵
- Executes dropped EXE
PID:3604 -
\??\c:\1nhbbt.exec:\1nhbbt.exe31⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nnthhn.exec:\nnthhn.exe32⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vpvvp.exec:\vpvvp.exe33⤵
- Executes dropped EXE
PID:4812 -
\??\c:\btttnh.exec:\btttnh.exe34⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pvjjj.exec:\pvjjj.exe35⤵
- Executes dropped EXE
PID:3276 -
\??\c:\xrfrrxf.exec:\xrfrrxf.exe36⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jdvvp.exec:\jdvvp.exe37⤵
- Executes dropped EXE
PID:5104 -
\??\c:\xrlllll.exec:\xrlllll.exe38⤵
- Executes dropped EXE
PID:4680 -
\??\c:\tnttbh.exec:\tnttbh.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbbttt.exec:\bbbttt.exe40⤵
- Executes dropped EXE
PID:4684 -
\??\c:\7dppv.exec:\7dppv.exe41⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hhnhht.exec:\hhnhht.exe42⤵
- Executes dropped EXE
PID:984 -
\??\c:\pvvpd.exec:\pvvpd.exe43⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rrfxxff.exec:\rrfxxff.exe44⤵
- Executes dropped EXE
PID:3108 -
\??\c:\jvpvj.exec:\jvpvj.exe45⤵
- Executes dropped EXE
PID:4768 -
\??\c:\djppp.exec:\djppp.exe46⤵
- Executes dropped EXE
PID:3584 -
\??\c:\hbhbbh.exec:\hbhbbh.exe47⤵
- Executes dropped EXE
PID:3548 -
\??\c:\ddpjp.exec:\ddpjp.exe48⤵
- Executes dropped EXE
PID:4344 -
\??\c:\llxxllx.exec:\llxxllx.exe49⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bbnhbb.exec:\bbnhbb.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\pvjjd.exec:\pvjjd.exe51⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xxrrrrl.exec:\xxrrrrl.exe52⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tntttt.exec:\tntttt.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\flxxrxx.exec:\flxxrxx.exe54⤵
- Executes dropped EXE
PID:3680 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe55⤵
- Executes dropped EXE
PID:3532 -
\??\c:\thhhtb.exec:\thhhtb.exe56⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lxrrfll.exec:\lxrrfll.exe57⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hhtnnn.exec:\hhtnnn.exe58⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpppj.exec:\vpppj.exe59⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lfxrlll.exec:\lfxrlll.exe60⤵
- Executes dropped EXE
PID:3132 -
\??\c:\flxxrff.exec:\flxxrff.exe61⤵
- Executes dropped EXE
PID:1704 -
\??\c:\hbbbbh.exec:\hbbbbh.exe62⤵
- Executes dropped EXE
PID:208 -
\??\c:\pdjjj.exec:\pdjjj.exe63⤵
- Executes dropped EXE
PID:4144 -
\??\c:\xrfxxxx.exec:\xrfxxxx.exe64⤵
- Executes dropped EXE
PID:4160 -
\??\c:\nttnnn.exec:\nttnnn.exe65⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pjjdv.exec:\pjjdv.exe66⤵PID:2436
-
\??\c:\lflllrr.exec:\lflllrr.exe67⤵PID:3968
-
\??\c:\btnttt.exec:\btnttt.exe68⤵PID:4744
-
\??\c:\nhnnnn.exec:\nhnnnn.exe69⤵PID:3008
-
\??\c:\vjvvv.exec:\vjvvv.exe70⤵PID:4108
-
\??\c:\xxfflll.exec:\xxfflll.exe71⤵PID:2484
-
\??\c:\3llfxrf.exec:\3llfxrf.exe72⤵PID:4960
-
\??\c:\vvjjd.exec:\vvjjd.exe73⤵PID:5056
-
\??\c:\rxlflxf.exec:\rxlflxf.exe74⤵PID:660
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe75⤵PID:756
-
\??\c:\tttbbt.exec:\tttbbt.exe76⤵PID:3696
-
\??\c:\pjdjj.exec:\pjdjj.exe77⤵PID:4600
-
\??\c:\rfffflr.exec:\rfffflr.exe78⤵PID:2784
-
\??\c:\hbhbtb.exec:\hbhbtb.exe79⤵PID:3784
-
\??\c:\vpvpp.exec:\vpvpp.exe80⤵PID:4808
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe81⤵PID:2132
-
\??\c:\bhhtht.exec:\bhhtht.exe82⤵PID:1408
-
\??\c:\vjpvd.exec:\vjpvd.exe83⤵PID:3756
-
\??\c:\xrxfffl.exec:\xrxfffl.exe84⤵PID:344
-
\??\c:\fxfxxll.exec:\fxfxxll.exe85⤵PID:3644
-
\??\c:\hbbnnt.exec:\hbbnnt.exe86⤵PID:1572
-
\??\c:\vjjdv.exec:\vjjdv.exe87⤵PID:760
-
\??\c:\5ffllfl.exec:\5ffllfl.exe88⤵PID:716
-
\??\c:\nnbbth.exec:\nnbbth.exe89⤵PID:4788
-
\??\c:\ppjjd.exec:\ppjjd.exe90⤵PID:4968
-
\??\c:\jjpjp.exec:\jjpjp.exe91⤵PID:4528
-
\??\c:\flxxrrr.exec:\flxxrrr.exe92⤵PID:1980
-
\??\c:\tnbnnn.exec:\tnbnnn.exe93⤵PID:2488
-
\??\c:\pdjjj.exec:\pdjjj.exe94⤵PID:936
-
\??\c:\frxxffl.exec:\frxxffl.exe95⤵PID:2384
-
\??\c:\nhnhnh.exec:\nhnhnh.exe96⤵PID:4556
-
\??\c:\jddvp.exec:\jddvp.exe97⤵PID:1432
-
\??\c:\rlffxxr.exec:\rlffxxr.exe98⤵PID:4828
-
\??\c:\nbnnnn.exec:\nbnnnn.exe99⤵PID:3824
-
\??\c:\dpppp.exec:\dpppp.exe100⤵PID:4804
-
\??\c:\llrlflf.exec:\llrlflf.exe101⤵PID:5104
-
\??\c:\nhttnt.exec:\nhttnt.exe102⤵PID:4060
-
\??\c:\nhnnhh.exec:\nhnnhh.exe103⤵PID:4204
-
\??\c:\vdjjd.exec:\vdjjd.exe104⤵PID:728
-
\??\c:\5rfllrr.exec:\5rfllrr.exe105⤵PID:1728
-
\??\c:\tttnhh.exec:\tttnhh.exe106⤵PID:2264
-
\??\c:\ppddj.exec:\ppddj.exe107⤵PID:2892
-
\??\c:\rrlllll.exec:\rrlllll.exe108⤵PID:3320
-
\??\c:\hbbttn.exec:\hbbttn.exe109⤵PID:4748
-
\??\c:\jjddd.exec:\jjddd.exe110⤵PID:1436
-
\??\c:\jjdpp.exec:\jjdpp.exe111⤵PID:2476
-
\??\c:\rflrlll.exec:\rflrlll.exe112⤵PID:1284
-
\??\c:\ntbbbb.exec:\ntbbbb.exe113⤵PID:4408
-
\??\c:\pjddp.exec:\pjddp.exe114⤵PID:2344
-
\??\c:\frxxrff.exec:\frxxrff.exe115⤵PID:2248
-
\??\c:\tnhbbt.exec:\tnhbbt.exe116⤵PID:3224
-
\??\c:\nntnnb.exec:\nntnnb.exe117⤵PID:3592
-
\??\c:\vpddd.exec:\vpddd.exe118⤵PID:3504
-
\??\c:\llrxxff.exec:\llrxxff.exe119⤵PID:444
-
\??\c:\ntbnhb.exec:\ntbnhb.exe120⤵PID:5072
-
\??\c:\jdvdp.exec:\jdvdp.exe121⤵PID:2280
-
\??\c:\lrllflf.exec:\lrllflf.exe122⤵PID:5096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-