Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 05:14
Static task
static1
Behavioral task
behavioral1
Sample
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe
Resource
win7-20240903-en
General
-
Target
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe
-
Size
456KB
-
MD5
b09bdea933a38c902713063913c8ac65
-
SHA1
e348867186116fb2b0aa38a2bc07670b662cf7cd
-
SHA256
dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7
-
SHA512
5a051f3cb8973885999eab3ebf6a09ff49f3d0d39cabb446e3fe4bea441a6094c0fbc6a8e3e6bbb8f5b1ac5d95dcf3089d691090a1e36aedf39d79181678100c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRJ:q7Tc2NYHUrAwfMp3CDRJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2884-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3396-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4860-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4808-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/820-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1640-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-894-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-999-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-1006-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-1240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 rlrrffx.exe 1740 tnnhhn.exe 3832 3vvpj.exe 3472 ntntbn.exe 3396 tnnthb.exe 1592 tbbbht.exe 4860 hnbnnn.exe 2136 7llrrxr.exe 3840 hntbbn.exe 2120 djddv.exe 2152 bhbtbn.exe 4872 fxxfffx.exe 4352 nhtnhh.exe 4120 xlflrrl.exe 2692 7hthnh.exe 3172 vvpvv.exe 3508 thhnbt.exe 5104 tbnnbb.exe 1560 ppvpp.exe 5040 jjvvv.exe 2744 thttth.exe 648 ntnnbh.exe 4644 vddjp.exe 3540 lrxxffl.exe 3520 fffflll.exe 4364 pjdjj.exe 3868 vjjpv.exe 728 nbhhhn.exe 3148 hhbhnn.exe 3632 bnbbbh.exe 3988 tbttbb.exe 3816 tnbbtt.exe 2684 llrxxlr.exe 4568 ntttnt.exe 980 jpddd.exe 3656 9hbbhn.exe 1968 htnthn.exe 4440 djvvj.exe 4940 rrrfrxf.exe 4276 httttn.exe 5092 jvpvj.exe 3456 rxfflrr.exe 2316 hhnbnb.exe 1188 rfxrllx.exe 1740 bnnhbn.exe 4080 ddpjp.exe 3268 fllxrrl.exe 2652 bthbth.exe 4880 1rrrlff.exe 400 tnttbh.exe 4804 vdjpp.exe 4808 rxrxfrf.exe 1112 nhtttb.exe 1144 9nnthn.exe 1308 pjvdd.exe 3708 ntnntt.exe 2960 jvdjj.exe 4788 jdvvp.exe 324 xxxxffl.exe 4352 thhhhn.exe 3672 ddppp.exe 3172 xxxxlrf.exe 2244 pvjpp.exe 2208 fflllrx.exe -
resource yara_rule behavioral2/memory/2884-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3396-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4860-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4808-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1640-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-894-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-910-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 3424 2884 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 83 PID 2884 wrote to memory of 3424 2884 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 83 PID 2884 wrote to memory of 3424 2884 dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe 83 PID 3424 wrote to memory of 1740 3424 rlrrffx.exe 84 PID 3424 wrote to memory of 1740 3424 rlrrffx.exe 84 PID 3424 wrote to memory of 1740 3424 rlrrffx.exe 84 PID 1740 wrote to memory of 3832 1740 tnnhhn.exe 85 PID 1740 wrote to memory of 3832 1740 tnnhhn.exe 85 PID 1740 wrote to memory of 3832 1740 tnnhhn.exe 85 PID 3832 wrote to memory of 3472 3832 3vvpj.exe 86 PID 3832 wrote to memory of 3472 3832 3vvpj.exe 86 PID 3832 wrote to memory of 3472 3832 3vvpj.exe 86 PID 3472 wrote to memory of 3396 3472 ntntbn.exe 87 PID 3472 wrote to memory of 3396 3472 ntntbn.exe 87 PID 3472 wrote to memory of 3396 3472 ntntbn.exe 87 PID 3396 wrote to memory of 1592 3396 tnnthb.exe 88 PID 3396 wrote to memory of 1592 3396 tnnthb.exe 88 PID 3396 wrote to memory of 1592 3396 tnnthb.exe 88 PID 1592 wrote to memory of 4860 1592 tbbbht.exe 89 PID 1592 wrote to memory of 4860 1592 tbbbht.exe 89 PID 1592 wrote to memory of 4860 1592 tbbbht.exe 89 PID 4860 wrote to memory of 2136 4860 hnbnnn.exe 90 PID 4860 wrote to memory of 2136 4860 hnbnnn.exe 90 PID 4860 wrote to memory of 2136 4860 hnbnnn.exe 90 PID 2136 wrote to memory of 3840 2136 7llrrxr.exe 91 PID 2136 wrote to memory of 3840 2136 7llrrxr.exe 91 PID 2136 wrote to memory of 3840 2136 7llrrxr.exe 91 PID 3840 wrote to memory of 2120 3840 hntbbn.exe 92 PID 3840 wrote to memory of 2120 3840 hntbbn.exe 92 PID 3840 wrote to memory of 2120 3840 hntbbn.exe 92 PID 2120 wrote to memory of 2152 2120 djddv.exe 93 PID 2120 wrote to memory of 2152 2120 djddv.exe 93 PID 2120 wrote to memory of 2152 2120 djddv.exe 93 PID 2152 wrote to memory of 4872 2152 bhbtbn.exe 94 PID 2152 wrote to memory of 4872 2152 bhbtbn.exe 94 PID 2152 wrote to memory of 4872 2152 bhbtbn.exe 94 PID 4872 wrote to memory of 4352 4872 fxxfffx.exe 95 PID 4872 wrote to memory of 4352 4872 fxxfffx.exe 95 PID 4872 wrote to memory of 4352 4872 fxxfffx.exe 95 PID 4352 wrote to memory of 4120 4352 nhtnhh.exe 96 PID 4352 wrote to memory of 4120 4352 nhtnhh.exe 96 PID 4352 wrote to memory of 4120 4352 nhtnhh.exe 96 PID 4120 wrote to memory of 2692 4120 xlflrrl.exe 97 PID 4120 wrote to memory of 2692 4120 xlflrrl.exe 97 PID 4120 wrote to memory of 2692 4120 xlflrrl.exe 97 PID 2692 wrote to memory of 3172 2692 7hthnh.exe 98 PID 2692 wrote to memory of 3172 2692 7hthnh.exe 98 PID 2692 wrote to memory of 3172 2692 7hthnh.exe 98 PID 3172 wrote to memory of 3508 3172 vvpvv.exe 99 PID 3172 wrote to memory of 3508 3172 vvpvv.exe 99 PID 3172 wrote to memory of 3508 3172 vvpvv.exe 99 PID 3508 wrote to memory of 5104 3508 thhnbt.exe 100 PID 3508 wrote to memory of 5104 3508 thhnbt.exe 100 PID 3508 wrote to memory of 5104 3508 thhnbt.exe 100 PID 5104 wrote to memory of 1560 5104 tbnnbb.exe 101 PID 5104 wrote to memory of 1560 5104 tbnnbb.exe 101 PID 5104 wrote to memory of 1560 5104 tbnnbb.exe 101 PID 1560 wrote to memory of 5040 1560 ppvpp.exe 102 PID 1560 wrote to memory of 5040 1560 ppvpp.exe 102 PID 1560 wrote to memory of 5040 1560 ppvpp.exe 102 PID 5040 wrote to memory of 2744 5040 jjvvv.exe 103 PID 5040 wrote to memory of 2744 5040 jjvvv.exe 103 PID 5040 wrote to memory of 2744 5040 jjvvv.exe 103 PID 2744 wrote to memory of 648 2744 thttth.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe"C:\Users\Admin\AppData\Local\Temp\dc01656a2360bb96913fe8611c96960b561b00d8ced3aaec3f458c65133e4aa7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rlrrffx.exec:\rlrrffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\tnnhhn.exec:\tnnhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\3vvpj.exec:\3vvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\ntntbn.exec:\ntntbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\tnnthb.exec:\tnnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\tbbbht.exec:\tbbbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hnbnnn.exec:\hnbnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\7llrrxr.exec:\7llrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hntbbn.exec:\hntbbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\djddv.exec:\djddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bhbtbn.exec:\bhbtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\fxxfffx.exec:\fxxfffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\nhtnhh.exec:\nhtnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\xlflrrl.exec:\xlflrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\7hthnh.exec:\7hthnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vvpvv.exec:\vvpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\thhnbt.exec:\thhnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\tbnnbb.exec:\tbnnbb.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\ppvpp.exec:\ppvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\jjvvv.exec:\jjvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\thttth.exec:\thttth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ntnnbh.exec:\ntnnbh.exe23⤵
- Executes dropped EXE
PID:648 -
\??\c:\vddjp.exec:\vddjp.exe24⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lrxxffl.exec:\lrxxffl.exe25⤵
- Executes dropped EXE
PID:3540 -
\??\c:\fffflll.exec:\fffflll.exe26⤵
- Executes dropped EXE
PID:3520 -
\??\c:\pjdjj.exec:\pjdjj.exe27⤵
- Executes dropped EXE
PID:4364 -
\??\c:\vjjpv.exec:\vjjpv.exe28⤵
- Executes dropped EXE
PID:3868 -
\??\c:\nbhhhn.exec:\nbhhhn.exe29⤵
- Executes dropped EXE
PID:728 -
\??\c:\hhbhnn.exec:\hhbhnn.exe30⤵
- Executes dropped EXE
PID:3148 -
\??\c:\bnbbbh.exec:\bnbbbh.exe31⤵
- Executes dropped EXE
PID:3632 -
\??\c:\tbttbb.exec:\tbttbb.exe32⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tnbbtt.exec:\tnbbtt.exe33⤵
- Executes dropped EXE
PID:3816 -
\??\c:\llrxxlr.exec:\llrxxlr.exe34⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ntttnt.exec:\ntttnt.exe35⤵
- Executes dropped EXE
PID:4568 -
\??\c:\jpddd.exec:\jpddd.exe36⤵
- Executes dropped EXE
PID:980 -
\??\c:\9hbbhn.exec:\9hbbhn.exe37⤵
- Executes dropped EXE
PID:3656 -
\??\c:\htnthn.exec:\htnthn.exe38⤵
- Executes dropped EXE
PID:1968 -
\??\c:\djvvj.exec:\djvvj.exe39⤵
- Executes dropped EXE
PID:4440 -
\??\c:\rrrfrxf.exec:\rrrfrxf.exe40⤵
- Executes dropped EXE
PID:4940 -
\??\c:\httttn.exec:\httttn.exe41⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jvpvj.exec:\jvpvj.exe42⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rxfflrr.exec:\rxfflrr.exe43⤵
- Executes dropped EXE
PID:3456 -
\??\c:\hhnbnb.exec:\hhnbnb.exe44⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfxrllx.exec:\rfxrllx.exe45⤵
- Executes dropped EXE
PID:1188 -
\??\c:\bnnhbn.exec:\bnnhbn.exe46⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddpjp.exec:\ddpjp.exe47⤵
- Executes dropped EXE
PID:4080 -
\??\c:\fllxrrl.exec:\fllxrrl.exe48⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bthbth.exec:\bthbth.exe49⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1rrrlff.exec:\1rrrlff.exe50⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tnttbh.exec:\tnttbh.exe51⤵
- Executes dropped EXE
PID:400 -
\??\c:\vdjpp.exec:\vdjpp.exe52⤵
- Executes dropped EXE
PID:4804 -
\??\c:\rxrxfrf.exec:\rxrxfrf.exe53⤵
- Executes dropped EXE
PID:4808 -
\??\c:\nhtttb.exec:\nhtttb.exe54⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9nnthn.exec:\9nnthn.exe55⤵
- Executes dropped EXE
PID:1144 -
\??\c:\pjvdd.exec:\pjvdd.exe56⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ntnntt.exec:\ntnntt.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\jvdjj.exec:\jvdjj.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jdvvp.exec:\jdvvp.exe59⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xxxxffl.exec:\xxxxffl.exe60⤵
- Executes dropped EXE
PID:324 -
\??\c:\thhhhn.exec:\thhhhn.exe61⤵
- Executes dropped EXE
PID:4352 -
\??\c:\ddppp.exec:\ddppp.exe62⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe63⤵
- Executes dropped EXE
PID:3172 -
\??\c:\pvjpp.exec:\pvjpp.exe64⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fflllrx.exec:\fflllrx.exe65⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hhbbbt.exec:\hhbbbt.exe66⤵PID:3860
-
\??\c:\tbhhbb.exec:\tbhhbb.exe67⤵PID:4300
-
\??\c:\7lrxxfl.exec:\7lrxxfl.exe68⤵PID:440
-
\??\c:\fxflxff.exec:\fxflxff.exe69⤵PID:4296
-
\??\c:\vddvp.exec:\vddvp.exe70⤵PID:3904
-
\??\c:\pdjpd.exec:\pdjpd.exe71⤵PID:2288
-
\??\c:\rrfllrr.exec:\rrfllrr.exe72⤵PID:2912
-
\??\c:\htbnht.exec:\htbnht.exe73⤵PID:2548
-
\??\c:\jjvvd.exec:\jjvvd.exe74⤵PID:5000
-
\??\c:\fllrlll.exec:\fllrlll.exe75⤵PID:2956
-
\??\c:\bhntnt.exec:\bhntnt.exe76⤵PID:2772
-
\??\c:\dddjp.exec:\dddjp.exe77⤵PID:1580
-
\??\c:\lfxxxff.exec:\lfxxxff.exe78⤵PID:4632
-
\??\c:\jdvdj.exec:\jdvdj.exe79⤵PID:1092
-
\??\c:\3xrlfxx.exec:\3xrlfxx.exe80⤵PID:456
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe81⤵PID:4448
-
\??\c:\3thbtt.exec:\3thbtt.exe82⤵PID:4452
-
\??\c:\vjdjv.exec:\vjdjv.exe83⤵PID:4988
-
\??\c:\lffxfll.exec:\lffxfll.exe84⤵PID:4916
-
\??\c:\nbbhht.exec:\nbbhht.exe85⤵PID:1168
-
\??\c:\llfllxf.exec:\llfllxf.exe86⤵PID:1056
-
\??\c:\bnthnb.exec:\bnthnb.exe87⤵PID:3864
-
\??\c:\jdpvp.exec:\jdpvp.exe88⤵PID:4668
-
\??\c:\jjddd.exec:\jjddd.exe89⤵PID:3936
-
\??\c:\rrxfflr.exec:\rrxfflr.exe90⤵PID:1648
-
\??\c:\7hbbtb.exec:\7hbbtb.exe91⤵PID:4504
-
\??\c:\ppdvv.exec:\ppdvv.exe92⤵PID:3664
-
\??\c:\flrxlrx.exec:\flrxlrx.exe93⤵PID:2064
-
\??\c:\hntnnh.exec:\hntnnh.exe94⤵PID:3976
-
\??\c:\lffxffx.exec:\lffxffx.exe95⤵PID:3292
-
\??\c:\ntnhbb.exec:\ntnhbb.exe96⤵PID:1328
-
\??\c:\pjdjd.exec:\pjdjd.exe97⤵PID:4224
-
\??\c:\lffxfff.exec:\lffxfff.exe98⤵PID:220
-
\??\c:\nnhtbh.exec:\nnhtbh.exe99⤵PID:4940
-
\??\c:\jjjdv.exec:\jjjdv.exe100⤵PID:4052
-
\??\c:\ffxxfrf.exec:\ffxxfrf.exe101⤵PID:4856
-
\??\c:\bbhhhn.exec:\bbhhhn.exe102⤵PID:1084
-
\??\c:\dvppj.exec:\dvppj.exe103⤵PID:4712
-
\??\c:\rfxxrxf.exec:\rfxxrxf.exe104⤵PID:1188
-
\??\c:\tnttbh.exec:\tnttbh.exe105⤵PID:3516
-
\??\c:\vdjpd.exec:\vdjpd.exe106⤵PID:4776
-
\??\c:\bnbbbh.exec:\bnbbbh.exe107⤵PID:1424
-
\??\c:\djdvd.exec:\djdvd.exe108⤵PID:3500
-
\??\c:\djdpv.exec:\djdpv.exe109⤵PID:4232
-
\??\c:\rrllxxl.exec:\rrllxxl.exe110⤵PID:4288
-
\??\c:\jjvdd.exec:\jjvdd.exe111⤵PID:820
-
\??\c:\lrxffrr.exec:\lrxffrr.exe112⤵PID:400
-
\??\c:\nnntbn.exec:\nnntbn.exe113⤵PID:4800
-
\??\c:\vpjpv.exec:\vpjpv.exe114⤵PID:1296
-
\??\c:\rxlllxl.exec:\rxlllxl.exe115⤵PID:1112
-
\??\c:\tbtnbt.exec:\tbtnbt.exe116⤵PID:380
-
\??\c:\vjpvd.exec:\vjpvd.exe117⤵PID:3208
-
\??\c:\flxflxr.exec:\flxflxr.exe118⤵PID:3880
-
\??\c:\htnhtb.exec:\htnhtb.exe119⤵PID:2120
-
\??\c:\ppjjp.exec:\ppjjp.exe120⤵PID:1096
-
\??\c:\llxflrr.exec:\llxflrr.exe121⤵PID:4336
-
\??\c:\ntnbnt.exec:\ntnbnt.exe122⤵PID:1640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-