Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 02:46
Static task
static1
Behavioral task
behavioral1
Sample
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
Resource
win7-20240903-en
General
-
Target
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
-
Size
454KB
-
MD5
4b57c9766eecfcef559a26ba4b838d26
-
SHA1
5beac97aa545e79ce68ff3a5be2ed09edea83bf3
-
SHA256
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e
-
SHA512
7378de75809f458fbe5676ea3a0d9ee689b18cc3c58fb50a55e99cb44d96a5cb80e0be003708b6db35985b9db6725e4cea79500a22ab12f93da2e186831318ef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeToA:q7Tc2NYHUrAwfMp3CDcA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4568-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2976-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4704-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2932-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-757-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-1820-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4732 pppjj.exe 2244 3rrrlrl.exe 1788 lrrfrlx.exe 1308 g6666.exe 1968 thhbnn.exe 4940 frrfxxf.exe 3092 xlxlflf.exe 1760 vpdvp.exe 1144 028826.exe 1408 04048.exe 3424 02044.exe 704 26800.exe 112 5bbtnn.exe 4704 02006.exe 2572 jdppj.exe 2552 24000.exe 3184 48000.exe 2976 246688.exe 1596 hbhhbb.exe 4132 4862666.exe 3292 2808226.exe 2840 lxrfflx.exe 4676 xfrrxff.exe 4232 tnnhhh.exe 2232 5djvd.exe 2540 2886608.exe 2328 tttbnh.exe 3128 lxfflfx.exe 3436 vppjd.exe 4412 8242666.exe 3460 rfrlffx.exe 4264 6844882.exe 4140 9pppp.exe 3692 pvdvp.exe 4064 tbbthn.exe 4776 pjpjp.exe 4108 hbhnhh.exe 2280 dvdvv.exe 3628 s6822.exe 760 dvvjd.exe 5076 464642.exe 1312 djddp.exe 2008 lrfxllx.exe 4740 8040666.exe 1080 djpjp.exe 4872 6066660.exe 4660 q24822.exe 4076 2866660.exe 488 jdppj.exe 2100 8002004.exe 4540 dpdjd.exe 3240 22488.exe 4568 620004.exe 4460 dvvjp.exe 2916 8208222.exe 520 48260.exe 2188 8464882.exe 772 480022.exe 3600 0008642.exe 3480 9pvjd.exe 4308 rllfxxr.exe 1144 htbtnn.exe 3440 c800444.exe 4180 ntttht.exe -
resource yara_rule behavioral2/memory/4568-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4704-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2932-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-757-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-827-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 280460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 286600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64682.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language q08222.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2284.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 4732 4568 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 82 PID 4568 wrote to memory of 4732 4568 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 82 PID 4568 wrote to memory of 4732 4568 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 82 PID 4732 wrote to memory of 2244 4732 pppjj.exe 83 PID 4732 wrote to memory of 2244 4732 pppjj.exe 83 PID 4732 wrote to memory of 2244 4732 pppjj.exe 83 PID 2244 wrote to memory of 1788 2244 3rrrlrl.exe 84 PID 2244 wrote to memory of 1788 2244 3rrrlrl.exe 84 PID 2244 wrote to memory of 1788 2244 3rrrlrl.exe 84 PID 1788 wrote to memory of 1308 1788 lrrfrlx.exe 85 PID 1788 wrote to memory of 1308 1788 lrrfrlx.exe 85 PID 1788 wrote to memory of 1308 1788 lrrfrlx.exe 85 PID 1308 wrote to memory of 1968 1308 g6666.exe 86 PID 1308 wrote to memory of 1968 1308 g6666.exe 86 PID 1308 wrote to memory of 1968 1308 g6666.exe 86 PID 1968 wrote to memory of 4940 1968 thhbnn.exe 87 PID 1968 wrote to memory of 4940 1968 thhbnn.exe 87 PID 1968 wrote to memory of 4940 1968 thhbnn.exe 87 PID 4940 wrote to memory of 3092 4940 frrfxxf.exe 88 PID 4940 wrote to memory of 3092 4940 frrfxxf.exe 88 PID 4940 wrote to memory of 3092 4940 frrfxxf.exe 88 PID 3092 wrote to memory of 1760 3092 xlxlflf.exe 89 PID 3092 wrote to memory of 1760 3092 xlxlflf.exe 89 PID 3092 wrote to memory of 1760 3092 xlxlflf.exe 89 PID 1760 wrote to memory of 1144 1760 vpdvp.exe 90 PID 1760 wrote to memory of 1144 1760 vpdvp.exe 90 PID 1760 wrote to memory of 1144 1760 vpdvp.exe 90 PID 1144 wrote to memory of 1408 1144 028826.exe 91 PID 1144 wrote to memory of 1408 1144 028826.exe 91 PID 1144 wrote to memory of 1408 1144 028826.exe 91 PID 1408 wrote to memory of 3424 1408 04048.exe 92 PID 1408 wrote to memory of 3424 1408 04048.exe 92 PID 1408 wrote to memory of 3424 1408 04048.exe 92 PID 3424 wrote to memory of 704 3424 02044.exe 93 PID 3424 wrote to memory of 704 3424 02044.exe 93 PID 3424 wrote to memory of 704 3424 02044.exe 93 PID 704 wrote to memory of 112 704 26800.exe 94 PID 704 wrote to memory of 112 704 26800.exe 94 PID 704 wrote to memory of 112 704 26800.exe 94 PID 112 wrote to memory of 4704 112 5bbtnn.exe 95 PID 112 wrote to memory of 4704 112 5bbtnn.exe 95 PID 112 wrote to memory of 4704 112 5bbtnn.exe 95 PID 4704 wrote to memory of 2572 4704 02006.exe 96 PID 4704 wrote to memory of 2572 4704 02006.exe 96 PID 4704 wrote to memory of 2572 4704 02006.exe 96 PID 2572 wrote to memory of 2552 2572 jdppj.exe 97 PID 2572 wrote to memory of 2552 2572 jdppj.exe 97 PID 2572 wrote to memory of 2552 2572 jdppj.exe 97 PID 2552 wrote to memory of 3184 2552 24000.exe 98 PID 2552 wrote to memory of 3184 2552 24000.exe 98 PID 2552 wrote to memory of 3184 2552 24000.exe 98 PID 3184 wrote to memory of 2976 3184 48000.exe 99 PID 3184 wrote to memory of 2976 3184 48000.exe 99 PID 3184 wrote to memory of 2976 3184 48000.exe 99 PID 2976 wrote to memory of 1596 2976 246688.exe 100 PID 2976 wrote to memory of 1596 2976 246688.exe 100 PID 2976 wrote to memory of 1596 2976 246688.exe 100 PID 1596 wrote to memory of 4132 1596 hbhhbb.exe 101 PID 1596 wrote to memory of 4132 1596 hbhhbb.exe 101 PID 1596 wrote to memory of 4132 1596 hbhhbb.exe 101 PID 4132 wrote to memory of 3292 4132 4862666.exe 102 PID 4132 wrote to memory of 3292 4132 4862666.exe 102 PID 4132 wrote to memory of 3292 4132 4862666.exe 102 PID 3292 wrote to memory of 2840 3292 2808226.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\pppjj.exec:\pppjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\3rrrlrl.exec:\3rrrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\g6666.exec:\g6666.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\thhbnn.exec:\thhbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\frrfxxf.exec:\frrfxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\xlxlflf.exec:\xlxlflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\vpdvp.exec:\vpdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\028826.exec:\028826.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\04048.exec:\04048.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\02044.exec:\02044.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\26800.exec:\26800.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\5bbtnn.exec:\5bbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\02006.exec:\02006.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\jdppj.exec:\jdppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\24000.exec:\24000.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\48000.exec:\48000.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\246688.exec:\246688.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hbhhbb.exec:\hbhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\4862666.exec:\4862666.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\2808226.exec:\2808226.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\lxrfflx.exec:\lxrfflx.exe23⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xfrrxff.exec:\xfrrxff.exe24⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnnhhh.exec:\tnnhhh.exe25⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5djvd.exec:\5djvd.exe26⤵
- Executes dropped EXE
PID:2232 -
\??\c:\2886608.exec:\2886608.exe27⤵
- Executes dropped EXE
PID:2540 -
\??\c:\tttbnh.exec:\tttbnh.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lxfflfx.exec:\lxfflfx.exe29⤵
- Executes dropped EXE
PID:3128 -
\??\c:\vppjd.exec:\vppjd.exe30⤵
- Executes dropped EXE
PID:3436 -
\??\c:\8242666.exec:\8242666.exe31⤵
- Executes dropped EXE
PID:4412 -
\??\c:\rfrlffx.exec:\rfrlffx.exe32⤵
- Executes dropped EXE
PID:3460 -
\??\c:\6844882.exec:\6844882.exe33⤵
- Executes dropped EXE
PID:4264 -
\??\c:\9pppp.exec:\9pppp.exe34⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pvdvp.exec:\pvdvp.exe35⤵
- Executes dropped EXE
PID:3692 -
\??\c:\tbbthn.exec:\tbbthn.exe36⤵
- Executes dropped EXE
PID:4064 -
\??\c:\pjpjp.exec:\pjpjp.exe37⤵
- Executes dropped EXE
PID:4776 -
\??\c:\hbhnhh.exec:\hbhnhh.exe38⤵
- Executes dropped EXE
PID:4108 -
\??\c:\dvdvv.exec:\dvdvv.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\s6822.exec:\s6822.exe40⤵
- Executes dropped EXE
PID:3628 -
\??\c:\dvvjd.exec:\dvvjd.exe41⤵
- Executes dropped EXE
PID:760 -
\??\c:\464642.exec:\464642.exe42⤵
- Executes dropped EXE
PID:5076 -
\??\c:\djddp.exec:\djddp.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lrfxllx.exec:\lrfxllx.exe44⤵
- Executes dropped EXE
PID:2008 -
\??\c:\8040666.exec:\8040666.exe45⤵
- Executes dropped EXE
PID:4740 -
\??\c:\djpjp.exec:\djpjp.exe46⤵
- Executes dropped EXE
PID:1080 -
\??\c:\6066660.exec:\6066660.exe47⤵
- Executes dropped EXE
PID:4872 -
\??\c:\q24822.exec:\q24822.exe48⤵
- Executes dropped EXE
PID:4660 -
\??\c:\2866660.exec:\2866660.exe49⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jdppj.exec:\jdppj.exe50⤵
- Executes dropped EXE
PID:488 -
\??\c:\8002004.exec:\8002004.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpdjd.exec:\dpdjd.exe52⤵
- Executes dropped EXE
PID:4540 -
\??\c:\22488.exec:\22488.exe53⤵
- Executes dropped EXE
PID:3240 -
\??\c:\620004.exec:\620004.exe54⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dvvjp.exec:\dvvjp.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\8208222.exec:\8208222.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\48260.exec:\48260.exe57⤵
- Executes dropped EXE
PID:520 -
\??\c:\8464882.exec:\8464882.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\480022.exec:\480022.exe59⤵
- Executes dropped EXE
PID:772 -
\??\c:\0008642.exec:\0008642.exe60⤵
- Executes dropped EXE
PID:3600 -
\??\c:\9pvjd.exec:\9pvjd.exe61⤵
- Executes dropped EXE
PID:3480 -
\??\c:\rllfxxr.exec:\rllfxxr.exe62⤵
- Executes dropped EXE
PID:4308 -
\??\c:\htbtnn.exec:\htbtnn.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\c800444.exec:\c800444.exe64⤵
- Executes dropped EXE
PID:3440 -
\??\c:\ntttht.exec:\ntttht.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\9lxrllf.exec:\9lxrllf.exe66⤵PID:2780
-
\??\c:\nntbbh.exec:\nntbbh.exe67⤵PID:3204
-
\??\c:\jvjdd.exec:\jvjdd.exe68⤵PID:2772
-
\??\c:\424826.exec:\424826.exe69⤵PID:3544
-
\??\c:\e08800.exec:\e08800.exe70⤵PID:2012
-
\??\c:\djvpv.exec:\djvpv.exe71⤵PID:2976
-
\??\c:\k44888.exec:\k44888.exe72⤵PID:2340
-
\??\c:\vdpjd.exec:\vdpjd.exe73⤵PID:2308
-
\??\c:\044488.exec:\044488.exe74⤵PID:3400
-
\??\c:\86048.exec:\86048.exe75⤵PID:1736
-
\??\c:\262884.exec:\262884.exe76⤵PID:1624
-
\??\c:\httnhb.exec:\httnhb.exe77⤵PID:3648
-
\??\c:\pvvpj.exec:\pvvpj.exe78⤵PID:2764
-
\??\c:\frxllrx.exec:\frxllrx.exe79⤵PID:860
-
\??\c:\5lxrrlf.exec:\5lxrrlf.exe80⤵PID:2928
-
\??\c:\0444806.exec:\0444806.exe81⤵PID:1496
-
\??\c:\bhttht.exec:\bhttht.exe82⤵PID:2316
-
\??\c:\7rrlffx.exec:\7rrlffx.exe83⤵PID:4412
-
\??\c:\vpdvv.exec:\vpdvv.exe84⤵PID:808
-
\??\c:\bnhhhh.exec:\bnhhhh.exe85⤵PID:2184
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe86⤵PID:912
-
\??\c:\djpjp.exec:\djpjp.exe87⤵PID:2508
-
\??\c:\q64046.exec:\q64046.exe88⤵PID:4776
-
\??\c:\hhhnnn.exec:\hhhnnn.exe89⤵PID:2872
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe90⤵PID:1456
-
\??\c:\22882.exec:\22882.exe91⤵PID:4764
-
\??\c:\g0644.exec:\g0644.exe92⤵PID:760
-
\??\c:\8804844.exec:\8804844.exe93⤵PID:1312
-
\??\c:\0642266.exec:\0642266.exe94⤵PID:1236
-
\??\c:\flxflrx.exec:\flxflrx.exe95⤵PID:536
-
\??\c:\0660066.exec:\0660066.exe96⤵PID:1608
-
\??\c:\6646446.exec:\6646446.exe97⤵PID:4068
-
\??\c:\808222.exec:\808222.exe98⤵PID:4688
-
\??\c:\4264062.exec:\4264062.exe99⤵PID:4812
-
\??\c:\60862.exec:\60862.exe100⤵PID:1300
-
\??\c:\1nbtbh.exec:\1nbtbh.exe101⤵PID:3396
-
\??\c:\402844.exec:\402844.exe102⤵PID:2152
-
\??\c:\fxxrlff.exec:\fxxrlff.exe103⤵PID:1324
-
\??\c:\hhtntt.exec:\hhtntt.exe104⤵PID:2208
-
\??\c:\9xfrxxr.exec:\9xfrxxr.exe105⤵PID:1388
-
\??\c:\c686882.exec:\c686882.exe106⤵PID:4876
-
\??\c:\a2448.exec:\a2448.exe107⤵PID:3260
-
\??\c:\6466066.exec:\6466066.exe108⤵PID:996
-
\??\c:\ttnbbh.exec:\ttnbbh.exe109⤵PID:476
-
\??\c:\pjjdj.exec:\pjjdj.exe110⤵PID:2964
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe111⤵PID:2040
-
\??\c:\vddvv.exec:\vddvv.exe112⤵PID:3424
-
\??\c:\bnbthh.exec:\bnbthh.exe113⤵PID:4392
-
\??\c:\48600.exec:\48600.exe114⤵PID:3020
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe115⤵PID:1880
-
\??\c:\e06000.exec:\e06000.exe116⤵PID:2780
-
\??\c:\o864860.exec:\o864860.exe117⤵PID:4160
-
\??\c:\jvjvj.exec:\jvjvj.exe118⤵PID:3664
-
\??\c:\80040.exec:\80040.exe119⤵PID:4968
-
\??\c:\0022228.exec:\0022228.exe120⤵PID:3544
-
\??\c:\ddppv.exec:\ddppv.exe121⤵PID:4000
-
\??\c:\402666.exec:\402666.exe122⤵PID:2284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-