Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe
Resource
win7-20241010-en
General
-
Target
73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe
-
Size
454KB
-
MD5
353d3c1170ee6c5ee5cf0972a414cc91
-
SHA1
91a90cff4960757f85e460bbc593dc6980ab0033
-
SHA256
73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7
-
SHA512
6c69ca11d86995751308a28f2b2a74c875f0e1db6ae067d317de3a5f0bdcae8826e95209f292c47f37a4e0c9cc07cfdfa350bd99cc8e8e119c57f88931c30c23
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2332-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4084-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4184-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-815-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-1039-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4080-1345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2716 bbhbth.exe 4700 pdjjv.exe 320 rrxxfff.exe 3968 3nhhnt.exe 4044 djddd.exe 4180 xrlxrfl.exe 3044 hhhnnt.exe 4372 pdjpj.exe 2396 ffxflfr.exe 2988 3tbhhh.exe 764 htbthb.exe 2700 rlrxrxx.exe 2648 nhnnnh.exe 2368 lxflflf.exe 388 dvvdv.exe 1924 tbbbbb.exe 5004 thnnnt.exe 1260 xxllrxx.exe 3456 tbhhnt.exe 3292 ppvdj.exe 1192 frlxflf.exe 5052 tbbhhn.exe 3216 jjdjv.exe 1464 xxxrffx.exe 4084 frrxlfr.exe 2532 vjjvp.exe 2576 7xrllxf.exe 2972 hbbbtb.exe 1784 dvvjd.exe 2196 xrrrrrr.exe 760 ppvdj.exe 216 xrxxlfx.exe 2192 llxfxfr.exe 1532 xxlxlfx.exe 964 ttttbh.exe 980 bhbhth.exe 2360 vdjpv.exe 1912 rrxxxfl.exe 4564 1xffflr.exe 3152 tthnnt.exe 940 jdvvd.exe 2064 xfxflfl.exe 2964 tthntb.exe 3476 ppvdp.exe 2924 xrxlrfl.exe 1860 3nntbn.exe 4340 pjppv.exe 2556 lrllflf.exe 3932 ntnntt.exe 528 9lxrlfl.exe 3760 jpjjd.exe 1792 flxffrx.exe 464 vjvvj.exe 1568 rrfffrr.exe 708 rrxxrff.exe 324 ntnthn.exe 1780 ttnbbn.exe 2716 jjvjj.exe 3268 llffxfr.exe 4580 bbhntb.exe 3408 1dpvd.exe 2876 xfxfxfx.exe 1516 thnnhn.exe 3144 dvvvv.exe -
resource yara_rule behavioral2/memory/2332-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2576-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/528-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4084-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-815-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2716 2332 73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe 82 PID 2332 wrote to memory of 2716 2332 73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe 82 PID 2332 wrote to memory of 2716 2332 73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe 82 PID 2716 wrote to memory of 4700 2716 bbhbth.exe 83 PID 2716 wrote to memory of 4700 2716 bbhbth.exe 83 PID 2716 wrote to memory of 4700 2716 bbhbth.exe 83 PID 4700 wrote to memory of 320 4700 pdjjv.exe 84 PID 4700 wrote to memory of 320 4700 pdjjv.exe 84 PID 4700 wrote to memory of 320 4700 pdjjv.exe 84 PID 320 wrote to memory of 3968 320 rrxxfff.exe 85 PID 320 wrote to memory of 3968 320 rrxxfff.exe 85 PID 320 wrote to memory of 3968 320 rrxxfff.exe 85 PID 3968 wrote to memory of 4044 3968 3nhhnt.exe 86 PID 3968 wrote to memory of 4044 3968 3nhhnt.exe 86 PID 3968 wrote to memory of 4044 3968 3nhhnt.exe 86 PID 4044 wrote to memory of 4180 4044 djddd.exe 87 PID 4044 wrote to memory of 4180 4044 djddd.exe 87 PID 4044 wrote to memory of 4180 4044 djddd.exe 87 PID 4180 wrote to memory of 3044 4180 xrlxrfl.exe 88 PID 4180 wrote to memory of 3044 4180 xrlxrfl.exe 88 PID 4180 wrote to memory of 3044 4180 xrlxrfl.exe 88 PID 3044 wrote to memory of 4372 3044 hhhnnt.exe 89 PID 3044 wrote to memory of 4372 3044 hhhnnt.exe 89 PID 3044 wrote to memory of 4372 3044 hhhnnt.exe 89 PID 4372 wrote to memory of 2396 4372 pdjpj.exe 90 PID 4372 wrote to memory of 2396 4372 pdjpj.exe 90 PID 4372 wrote to memory of 2396 4372 pdjpj.exe 90 PID 2396 wrote to memory of 2988 2396 ffxflfr.exe 91 PID 2396 wrote to memory of 2988 2396 ffxflfr.exe 91 PID 2396 wrote to memory of 2988 2396 ffxflfr.exe 91 PID 2988 wrote to memory of 764 2988 3tbhhh.exe 92 PID 2988 wrote to memory of 764 2988 3tbhhh.exe 92 PID 2988 wrote to memory of 764 2988 3tbhhh.exe 92 PID 764 wrote to memory of 2700 764 htbthb.exe 93 PID 764 wrote to memory of 2700 764 htbthb.exe 93 PID 764 wrote to memory of 2700 764 htbthb.exe 93 PID 2700 wrote to memory of 2648 2700 rlrxrxx.exe 94 PID 2700 wrote to memory of 2648 2700 rlrxrxx.exe 94 PID 2700 wrote to memory of 2648 2700 rlrxrxx.exe 94 PID 2648 wrote to memory of 2368 2648 nhnnnh.exe 95 PID 2648 wrote to memory of 2368 2648 nhnnnh.exe 95 PID 2648 wrote to memory of 2368 2648 nhnnnh.exe 95 PID 2368 wrote to memory of 388 2368 lxflflf.exe 96 PID 2368 wrote to memory of 388 2368 lxflflf.exe 96 PID 2368 wrote to memory of 388 2368 lxflflf.exe 96 PID 388 wrote to memory of 1924 388 dvvdv.exe 97 PID 388 wrote to memory of 1924 388 dvvdv.exe 97 PID 388 wrote to memory of 1924 388 dvvdv.exe 97 PID 1924 wrote to memory of 5004 1924 tbbbbb.exe 98 PID 1924 wrote to memory of 5004 1924 tbbbbb.exe 98 PID 1924 wrote to memory of 5004 1924 tbbbbb.exe 98 PID 5004 wrote to memory of 1260 5004 thnnnt.exe 99 PID 5004 wrote to memory of 1260 5004 thnnnt.exe 99 PID 5004 wrote to memory of 1260 5004 thnnnt.exe 99 PID 1260 wrote to memory of 3456 1260 xxllrxx.exe 100 PID 1260 wrote to memory of 3456 1260 xxllrxx.exe 100 PID 1260 wrote to memory of 3456 1260 xxllrxx.exe 100 PID 3456 wrote to memory of 3292 3456 tbhhnt.exe 101 PID 3456 wrote to memory of 3292 3456 tbhhnt.exe 101 PID 3456 wrote to memory of 3292 3456 tbhhnt.exe 101 PID 3292 wrote to memory of 1192 3292 ppvdj.exe 102 PID 3292 wrote to memory of 1192 3292 ppvdj.exe 102 PID 3292 wrote to memory of 1192 3292 ppvdj.exe 102 PID 1192 wrote to memory of 5052 1192 frlxflf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe"C:\Users\Admin\AppData\Local\Temp\73aaf61e78dd18a4984b2315770ce403ab95defa37049d79de21871ec7b97ef7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\bbhbth.exec:\bbhbth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\pdjjv.exec:\pdjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rrxxfff.exec:\rrxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3nhhnt.exec:\3nhhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\djddd.exec:\djddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xrlxrfl.exec:\xrlxrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\hhhnnt.exec:\hhhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pdjpj.exec:\pdjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\ffxflfr.exec:\ffxflfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\3tbhhh.exec:\3tbhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\htbthb.exec:\htbthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rlrxrxx.exec:\rlrxrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nhnnnh.exec:\nhnnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\lxflflf.exec:\lxflflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\dvvdv.exec:\dvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\tbbbbb.exec:\tbbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\thnnnt.exec:\thnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\xxllrxx.exec:\xxllrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\tbhhnt.exec:\tbhhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\ppvdj.exec:\ppvdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\frlxflf.exec:\frlxflf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\tbbhhn.exec:\tbbhhn.exe23⤵
- Executes dropped EXE
PID:5052 -
\??\c:\jjdjv.exec:\jjdjv.exe24⤵
- Executes dropped EXE
PID:3216 -
\??\c:\xxxrffx.exec:\xxxrffx.exe25⤵
- Executes dropped EXE
PID:1464 -
\??\c:\frrxlfr.exec:\frrxlfr.exe26⤵
- Executes dropped EXE
PID:4084 -
\??\c:\vjjvp.exec:\vjjvp.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7xrllxf.exec:\7xrllxf.exe28⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbbbtb.exec:\hbbbtb.exe29⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dvvjd.exec:\dvvjd.exe30⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe31⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ppvdj.exec:\ppvdj.exe32⤵
- Executes dropped EXE
PID:760 -
\??\c:\xrxxlfx.exec:\xrxxlfx.exe33⤵
- Executes dropped EXE
PID:216 -
\??\c:\llxfxfr.exec:\llxfxfr.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe35⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ttttbh.exec:\ttttbh.exe36⤵
- Executes dropped EXE
PID:964 -
\??\c:\bhbhth.exec:\bhbhth.exe37⤵
- Executes dropped EXE
PID:980 -
\??\c:\vdjpv.exec:\vdjpv.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe39⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1xffflr.exec:\1xffflr.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\tthnnt.exec:\tthnnt.exe41⤵
- Executes dropped EXE
PID:3152 -
\??\c:\jdvvd.exec:\jdvvd.exe42⤵
- Executes dropped EXE
PID:940 -
\??\c:\xfxflfl.exec:\xfxflfl.exe43⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tthntb.exec:\tthntb.exe44⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ppvdp.exec:\ppvdp.exe45⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xrxlrfl.exec:\xrxlrfl.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\3nntbn.exec:\3nntbn.exe47⤵
- Executes dropped EXE
PID:1860 -
\??\c:\pjppv.exec:\pjppv.exe48⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lrllflf.exec:\lrllflf.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ntnntt.exec:\ntnntt.exe50⤵
- Executes dropped EXE
PID:3932 -
\??\c:\9lxrlfl.exec:\9lxrlfl.exe51⤵
- Executes dropped EXE
PID:528 -
\??\c:\jpjjd.exec:\jpjjd.exe52⤵
- Executes dropped EXE
PID:3760 -
\??\c:\flxffrx.exec:\flxffrx.exe53⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vjvvj.exec:\vjvvj.exe54⤵
- Executes dropped EXE
PID:464 -
\??\c:\rrfffrr.exec:\rrfffrr.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rrxxrff.exec:\rrxxrff.exe56⤵
- Executes dropped EXE
PID:708 -
\??\c:\ntnthn.exec:\ntnthn.exe57⤵
- Executes dropped EXE
PID:324 -
\??\c:\lfxllrl.exec:\lfxllrl.exe58⤵PID:2560
-
\??\c:\ttnbbn.exec:\ttnbbn.exe59⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjvjj.exec:\jjvjj.exe60⤵
- Executes dropped EXE
PID:2716 -
\??\c:\llffxfr.exec:\llffxfr.exe61⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bbhntb.exec:\bbhntb.exe62⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1dpvd.exec:\1dpvd.exe63⤵
- Executes dropped EXE
PID:3408 -
\??\c:\xfxfxfx.exec:\xfxfxfx.exe64⤵
- Executes dropped EXE
PID:2876 -
\??\c:\thnnhn.exec:\thnnhn.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvvvv.exec:\dvvvv.exe66⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe67⤵PID:1804
-
\??\c:\bttntn.exec:\bttntn.exe68⤵PID:3060
-
\??\c:\dppjd.exec:\dppjd.exe69⤵PID:1928
-
\??\c:\tttnhh.exec:\tttnhh.exe70⤵PID:3784
-
\??\c:\pjvdd.exec:\pjvdd.exe71⤵PID:2348
-
\??\c:\ppvvv.exec:\ppvvv.exe72⤵PID:4268
-
\??\c:\fxllrxx.exec:\fxllrxx.exe73⤵PID:1684
-
\??\c:\9tnnbt.exec:\9tnnbt.exe74⤵PID:1704
-
\??\c:\pvddd.exec:\pvddd.exe75⤵PID:3556
-
\??\c:\xfxllxf.exec:\xfxllxf.exe76⤵PID:2600
-
\??\c:\nttttb.exec:\nttttb.exe77⤵PID:1196
-
\??\c:\vvdvj.exec:\vvdvj.exe78⤵PID:2860
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe79⤵PID:1640
-
\??\c:\nbhbnt.exec:\nbhbnt.exe80⤵PID:1240
-
\??\c:\llrffrr.exec:\llrffrr.exe81⤵PID:1924
-
\??\c:\tbhntb.exec:\tbhntb.exe82⤵PID:4076
-
\??\c:\pvjpv.exec:\pvjpv.exe83⤵PID:4492
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe84⤵PID:1360
-
\??\c:\bbbnbb.exec:\bbbnbb.exe85⤵PID:4948
-
\??\c:\1ttbbh.exec:\1ttbbh.exe86⤵PID:1660
-
\??\c:\vpdpv.exec:\vpdpv.exe87⤵PID:3016
-
\??\c:\nnhnnb.exec:\nnhnnb.exe88⤵PID:5052
-
\??\c:\djvjj.exec:\djvjj.exe89⤵PID:2976
-
\??\c:\djvvd.exec:\djvvd.exe90⤵PID:3216
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe91⤵PID:3744
-
\??\c:\bhnttb.exec:\bhnttb.exe92⤵PID:4084
-
\??\c:\vdppd.exec:\vdppd.exe93⤵PID:3008
-
\??\c:\rxrxfrf.exec:\rxrxfrf.exe94⤵PID:1008
-
\??\c:\bhnbtb.exec:\bhnbtb.exe95⤵PID:3692
-
\??\c:\vjvvd.exec:\vjvvd.exe96⤵PID:4524
-
\??\c:\frrrrxx.exec:\frrrrxx.exe97⤵PID:1820
-
\??\c:\hnttbh.exec:\hnttbh.exe98⤵PID:3120
-
\??\c:\bbhttb.exec:\bbhttb.exe99⤵PID:3680
-
\??\c:\pvdjj.exec:\pvdjj.exe100⤵PID:212
-
\??\c:\rxflrxx.exec:\rxflrxx.exe101⤵PID:4224
-
\??\c:\1tbhbh.exec:\1tbhbh.exe102⤵PID:1788
-
\??\c:\bthnnt.exec:\bthnnt.exe103⤵PID:3156
-
\??\c:\vvddv.exec:\vvddv.exe104⤵PID:2356
-
\??\c:\lrllxfr.exec:\lrllxfr.exe105⤵PID:4304
-
\??\c:\ntthbh.exec:\ntthbh.exe106⤵PID:620
-
\??\c:\dvjjj.exec:\dvjjj.exe107⤵PID:3984
-
\??\c:\5rxffxr.exec:\5rxffxr.exe108⤵PID:4184
-
\??\c:\rrlffll.exec:\rrlffll.exe109⤵PID:1272
-
\??\c:\tbntnt.exec:\tbntnt.exe110⤵PID:940
-
\??\c:\ppppv.exec:\ppppv.exe111⤵PID:1328
-
\??\c:\lrlrrff.exec:\lrlrrff.exe112⤵PID:3936
-
\??\c:\5bbnbh.exec:\5bbnbh.exe113⤵PID:3476
-
\??\c:\dpddj.exec:\dpddj.exe114⤵PID:2308
-
\??\c:\lrrrrrx.exec:\lrrrrrx.exe115⤵PID:5020
-
\??\c:\hhtnbb.exec:\hhtnbb.exe116⤵PID:3472
-
\??\c:\5ddvp.exec:\5ddvp.exe117⤵PID:2556
-
\??\c:\rlxxxff.exec:\rlxxxff.exe118⤵PID:4380
-
\??\c:\btbnhn.exec:\btbnhn.exe119⤵PID:528
-
\??\c:\pddvp.exec:\pddvp.exe120⤵PID:2344
-
\??\c:\9xrrrrx.exec:\9xrrrrx.exe121⤵PID:4488
-
\??\c:\bhtbtb.exec:\bhtbtb.exe122⤵PID:692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-