Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 06:19
Static task
static1
Behavioral task
behavioral1
Sample
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
Resource
win7-20241010-en
General
-
Target
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe
-
Size
455KB
-
MD5
57c35dd5c7d4d634fca2a36d462aeae7
-
SHA1
e7c53a3840dd49a90f3e63ff8fcdbc43f7877c11
-
SHA256
ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410
-
SHA512
f5d7e2ed266661665200e02a6ffe6ad9c96c75ffb5c17974f12c78644ee8e3fc846bfab0f18fdcc63627bcd3fae8a469dceb55310fade1dae66233b39afc6271
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2216-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3472-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3640-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2628-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1720-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-622-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-661-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-951-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 468 xlfrlfx.exe 3472 ddjjd.exe 3228 ffrxxff.exe 4916 rllfllr.exe 4412 3xxrrxl.exe 464 jvpjd.exe 2204 3bhbbb.exe 2544 vvvvv.exe 3400 1fffxxx.exe 4464 9xlfffx.exe 1720 pppjj.exe 2144 frlxlxl.exe 2008 nhbhht.exe 3116 ttbhhh.exe 3212 jvjdv.exe 3948 lxrlllr.exe 2488 vpvdd.exe 4116 ffxfrxl.exe 2424 nnhhnt.exe 1828 fffffff.exe 2992 btbbbh.exe 752 hhbthn.exe 3356 dvddv.exe 1844 hthbbt.exe 3640 pjvpp.exe 2924 djpjp.exe 4868 lllllll.exe 4064 jvjdd.exe 992 9nbbhh.exe 4292 vvvpj.exe 4676 vpjjd.exe 4924 fxxxxrr.exe 2944 3ttttt.exe 4620 hhnnhh.exe 4908 lffxxrr.exe 3984 5tbttt.exe 740 ffrrxxl.exe 2716 htbtnn.exe 4168 vdpjd.exe 2868 xxxxxxr.exe 3004 3tbthh.exe 1004 pdvpj.exe 3716 vpvpj.exe 3412 hhbttn.exe 3104 htbtnb.exe 3408 3dppd.exe 1212 lrffxxx.exe 716 tnntnb.exe 1556 dvddd.exe 4276 rrlrrxl.exe 468 vpjjp.exe 3476 jjvdj.exe 4740 fflfrrf.exe 3728 1thhht.exe 3228 pdjjd.exe 3484 flrfxff.exe 224 xlxxrrr.exe 3364 hnhnbb.exe 3932 dpvpp.exe 1948 xrfflll.exe 4300 nbnntt.exe 2832 ppjdp.exe 2544 xrrlffr.exe 3528 7bbbbb.exe -
resource yara_rule behavioral2/memory/2216-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3472-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3640-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2628-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1720-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-622-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-642-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 468 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 82 PID 2216 wrote to memory of 468 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 82 PID 2216 wrote to memory of 468 2216 ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe 82 PID 468 wrote to memory of 3472 468 xlfrlfx.exe 83 PID 468 wrote to memory of 3472 468 xlfrlfx.exe 83 PID 468 wrote to memory of 3472 468 xlfrlfx.exe 83 PID 3472 wrote to memory of 3228 3472 ddjjd.exe 84 PID 3472 wrote to memory of 3228 3472 ddjjd.exe 84 PID 3472 wrote to memory of 3228 3472 ddjjd.exe 84 PID 3228 wrote to memory of 4916 3228 ffrxxff.exe 85 PID 3228 wrote to memory of 4916 3228 ffrxxff.exe 85 PID 3228 wrote to memory of 4916 3228 ffrxxff.exe 85 PID 4916 wrote to memory of 4412 4916 rllfllr.exe 86 PID 4916 wrote to memory of 4412 4916 rllfllr.exe 86 PID 4916 wrote to memory of 4412 4916 rllfllr.exe 86 PID 4412 wrote to memory of 464 4412 3xxrrxl.exe 87 PID 4412 wrote to memory of 464 4412 3xxrrxl.exe 87 PID 4412 wrote to memory of 464 4412 3xxrrxl.exe 87 PID 464 wrote to memory of 2204 464 jvpjd.exe 88 PID 464 wrote to memory of 2204 464 jvpjd.exe 88 PID 464 wrote to memory of 2204 464 jvpjd.exe 88 PID 2204 wrote to memory of 2544 2204 3bhbbb.exe 89 PID 2204 wrote to memory of 2544 2204 3bhbbb.exe 89 PID 2204 wrote to memory of 2544 2204 3bhbbb.exe 89 PID 2544 wrote to memory of 3400 2544 vvvvv.exe 90 PID 2544 wrote to memory of 3400 2544 vvvvv.exe 90 PID 2544 wrote to memory of 3400 2544 vvvvv.exe 90 PID 3400 wrote to memory of 4464 3400 1fffxxx.exe 91 PID 3400 wrote to memory of 4464 3400 1fffxxx.exe 91 PID 3400 wrote to memory of 4464 3400 1fffxxx.exe 91 PID 4464 wrote to memory of 1720 4464 9xlfffx.exe 92 PID 4464 wrote to memory of 1720 4464 9xlfffx.exe 92 PID 4464 wrote to memory of 1720 4464 9xlfffx.exe 92 PID 1720 wrote to memory of 2144 1720 pppjj.exe 93 PID 1720 wrote to memory of 2144 1720 pppjj.exe 93 PID 1720 wrote to memory of 2144 1720 pppjj.exe 93 PID 2144 wrote to memory of 2008 2144 frlxlxl.exe 94 PID 2144 wrote to memory of 2008 2144 frlxlxl.exe 94 PID 2144 wrote to memory of 2008 2144 frlxlxl.exe 94 PID 2008 wrote to memory of 3116 2008 nhbhht.exe 95 PID 2008 wrote to memory of 3116 2008 nhbhht.exe 95 PID 2008 wrote to memory of 3116 2008 nhbhht.exe 95 PID 3116 wrote to memory of 3212 3116 ttbhhh.exe 96 PID 3116 wrote to memory of 3212 3116 ttbhhh.exe 96 PID 3116 wrote to memory of 3212 3116 ttbhhh.exe 96 PID 3212 wrote to memory of 3948 3212 jvjdv.exe 97 PID 3212 wrote to memory of 3948 3212 jvjdv.exe 97 PID 3212 wrote to memory of 3948 3212 jvjdv.exe 97 PID 3948 wrote to memory of 2488 3948 lxrlllr.exe 98 PID 3948 wrote to memory of 2488 3948 lxrlllr.exe 98 PID 3948 wrote to memory of 2488 3948 lxrlllr.exe 98 PID 2488 wrote to memory of 4116 2488 vpvdd.exe 99 PID 2488 wrote to memory of 4116 2488 vpvdd.exe 99 PID 2488 wrote to memory of 4116 2488 vpvdd.exe 99 PID 4116 wrote to memory of 2424 4116 ffxfrxl.exe 100 PID 4116 wrote to memory of 2424 4116 ffxfrxl.exe 100 PID 4116 wrote to memory of 2424 4116 ffxfrxl.exe 100 PID 2424 wrote to memory of 1828 2424 nnhhnt.exe 101 PID 2424 wrote to memory of 1828 2424 nnhhnt.exe 101 PID 2424 wrote to memory of 1828 2424 nnhhnt.exe 101 PID 1828 wrote to memory of 2992 1828 fffffff.exe 102 PID 1828 wrote to memory of 2992 1828 fffffff.exe 102 PID 1828 wrote to memory of 2992 1828 fffffff.exe 102 PID 2992 wrote to memory of 752 2992 btbbbh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"C:\Users\Admin\AppData\Local\Temp\ec9b6f553aca84beeebc26c6b54c4472299f7363367dd77e45bad9a07cf17410.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\ddjjd.exec:\ddjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ffrxxff.exec:\ffrxxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\rllfllr.exec:\rllfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\3xxrrxl.exec:\3xxrrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\jvpjd.exec:\jvpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\3bhbbb.exec:\3bhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vvvvv.exec:\vvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1fffxxx.exec:\1fffxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\9xlfffx.exec:\9xlfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\pppjj.exec:\pppjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\frlxlxl.exec:\frlxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\nhbhht.exec:\nhbhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\ttbhhh.exec:\ttbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\jvjdv.exec:\jvjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\lxrlllr.exec:\lxrlllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\vpvdd.exec:\vpvdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\nnhhnt.exec:\nnhhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\fffffff.exec:\fffffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\btbbbh.exec:\btbbbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hhbthn.exec:\hhbthn.exe23⤵
- Executes dropped EXE
PID:752 -
\??\c:\dvddv.exec:\dvddv.exe24⤵
- Executes dropped EXE
PID:3356 -
\??\c:\hthbbt.exec:\hthbbt.exe25⤵
- Executes dropped EXE
PID:1844 -
\??\c:\pjvpp.exec:\pjvpp.exe26⤵
- Executes dropped EXE
PID:3640 -
\??\c:\djpjp.exec:\djpjp.exe27⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lllllll.exec:\lllllll.exe28⤵
- Executes dropped EXE
PID:4868 -
\??\c:\jvjdd.exec:\jvjdd.exe29⤵
- Executes dropped EXE
PID:4064 -
\??\c:\9nbbhh.exec:\9nbbhh.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\vvvpj.exec:\vvvpj.exe31⤵
- Executes dropped EXE
PID:4292 -
\??\c:\vpjjd.exec:\vpjjd.exe32⤵
- Executes dropped EXE
PID:4676 -
\??\c:\fxxxxrr.exec:\fxxxxrr.exe33⤵
- Executes dropped EXE
PID:4924 -
\??\c:\3ttttt.exec:\3ttttt.exe34⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hhnnhh.exec:\hhnnhh.exe35⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lffxxrr.exec:\lffxxrr.exe36⤵
- Executes dropped EXE
PID:4908 -
\??\c:\5tbttt.exec:\5tbttt.exe37⤵
- Executes dropped EXE
PID:3984 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe38⤵
- Executes dropped EXE
PID:740 -
\??\c:\htbtnn.exec:\htbtnn.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vdpjd.exec:\vdpjd.exe40⤵
- Executes dropped EXE
PID:4168 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\3tbthh.exec:\3tbthh.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdvpj.exec:\pdvpj.exe43⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vpvpj.exec:\vpvpj.exe44⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hhbttn.exec:\hhbttn.exe45⤵
- Executes dropped EXE
PID:3412 -
\??\c:\htbtnb.exec:\htbtnb.exe46⤵
- Executes dropped EXE
PID:3104 -
\??\c:\3dppd.exec:\3dppd.exe47⤵
- Executes dropped EXE
PID:3408 -
\??\c:\lrffxxx.exec:\lrffxxx.exe48⤵
- Executes dropped EXE
PID:1212 -
\??\c:\tnntnb.exec:\tnntnb.exe49⤵
- Executes dropped EXE
PID:716 -
\??\c:\dvddd.exec:\dvddd.exe50⤵
- Executes dropped EXE
PID:1556 -
\??\c:\jjppj.exec:\jjppj.exe51⤵PID:4536
-
\??\c:\rrlrrxl.exec:\rrlrrxl.exe52⤵
- Executes dropped EXE
PID:4276 -
\??\c:\vpjjp.exec:\vpjjp.exe53⤵
- Executes dropped EXE
PID:468 -
\??\c:\jjvdj.exec:\jjvdj.exe54⤵
- Executes dropped EXE
PID:3476 -
\??\c:\fflfrrf.exec:\fflfrrf.exe55⤵
- Executes dropped EXE
PID:4740 -
\??\c:\1thhht.exec:\1thhht.exe56⤵
- Executes dropped EXE
PID:3728 -
\??\c:\pdjjd.exec:\pdjjd.exe57⤵
- Executes dropped EXE
PID:3228 -
\??\c:\flrfxff.exec:\flrfxff.exe58⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe59⤵
- Executes dropped EXE
PID:224 -
\??\c:\hnhnbb.exec:\hnhnbb.exe60⤵
- Executes dropped EXE
PID:3364 -
\??\c:\dpvpp.exec:\dpvpp.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3932 -
\??\c:\xrfflll.exec:\xrfflll.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nbnntt.exec:\nbnntt.exe63⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ppjdp.exec:\ppjdp.exe64⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xrrlffr.exec:\xrrlffr.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\7bbbbb.exec:\7bbbbb.exe66⤵
- Executes dropped EXE
PID:3528 -
\??\c:\ppjdj.exec:\ppjdj.exe67⤵PID:3400
-
\??\c:\vjjdd.exec:\vjjdd.exe68⤵PID:2192
-
\??\c:\fffxrrl.exec:\fffxrrl.exe69⤵PID:212
-
\??\c:\hhbbbh.exec:\hhbbbh.exe70⤵PID:2036
-
\??\c:\1jpjj.exec:\1jpjj.exe71⤵PID:5088
-
\??\c:\ffrxxll.exec:\ffrxxll.exe72⤵
- System Location Discovery: System Language Discovery
PID:2628 -
\??\c:\tntbnn.exec:\tntbnn.exe73⤵PID:3672
-
\??\c:\dvjpp.exec:\dvjpp.exe74⤵PID:4900
-
\??\c:\fxlllll.exec:\fxlllll.exe75⤵PID:216
-
\??\c:\bhbbhh.exec:\bhbbhh.exe76⤵PID:4664
-
\??\c:\dvppd.exec:\dvppd.exe77⤵PID:4116
-
\??\c:\pdjpj.exec:\pdjpj.exe78⤵PID:2508
-
\??\c:\xfxfxll.exec:\xfxfxll.exe79⤵PID:2400
-
\??\c:\hbnnhn.exec:\hbnnhn.exe80⤵PID:4480
-
\??\c:\pvdvv.exec:\pvdvv.exe81⤵PID:2164
-
\??\c:\fxfllxf.exec:\fxfllxf.exe82⤵PID:4128
-
\??\c:\tnhhhh.exec:\tnhhhh.exe83⤵PID:752
-
\??\c:\jjddj.exec:\jjddj.exe84⤵PID:2732
-
\??\c:\fxlllll.exec:\fxlllll.exe85⤵PID:4356
-
\??\c:\tttbbh.exec:\tttbbh.exe86⤵PID:540
-
\??\c:\vjjvv.exec:\vjjvv.exe87⤵PID:4576
-
\??\c:\llxxxll.exec:\llxxxll.exe88⤵PID:4352
-
\??\c:\nbhbhn.exec:\nbhbhn.exe89⤵PID:404
-
\??\c:\dpppp.exec:\dpppp.exe90⤵PID:1552
-
\??\c:\xlfxxxx.exec:\xlfxxxx.exe91⤵PID:4064
-
\??\c:\hhhhhb.exec:\hhhhhb.exe92⤵PID:4280
-
\??\c:\vvddv.exec:\vvddv.exe93⤵PID:1776
-
\??\c:\9xrfxxr.exec:\9xrfxxr.exe94⤵PID:676
-
\??\c:\hhhhhn.exec:\hhhhhn.exe95⤵PID:1228
-
\??\c:\3jppp.exec:\3jppp.exe96⤵PID:4528
-
\??\c:\xxrxxrr.exec:\xxrxxrr.exe97⤵PID:1980
-
\??\c:\thhhbh.exec:\thhhbh.exe98⤵PID:1192
-
\??\c:\fxlfxrl.exec:\fxlfxrl.exe99⤵PID:4368
-
\??\c:\hbbbhh.exec:\hbbbhh.exe100⤵PID:4216
-
\??\c:\9nhbhn.exec:\9nhbhn.exe101⤵PID:4448
-
\??\c:\pjppp.exec:\pjppp.exe102⤵PID:4652
-
\??\c:\frrxrrr.exec:\frrxrrr.exe103⤵PID:636
-
\??\c:\1bbhht.exec:\1bbhht.exe104⤵PID:3632
-
\??\c:\jvvvv.exec:\jvvvv.exe105⤵PID:4152
-
\??\c:\llffxxx.exec:\llffxxx.exe106⤵PID:2564
-
\??\c:\hnttth.exec:\hnttth.exe107⤵PID:2816
-
\??\c:\pjpjj.exec:\pjpjj.exe108⤵PID:5080
-
\??\c:\dpjdd.exec:\dpjdd.exe109⤵PID:3160
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe110⤵PID:1540
-
\??\c:\hhhttt.exec:\hhhttt.exe111⤵PID:4716
-
\??\c:\9dpjj.exec:\9dpjj.exe112⤵PID:4376
-
\??\c:\rxxrlxf.exec:\rxxrlxf.exe113⤵PID:2700
-
\??\c:\bbhhnh.exec:\bbhhnh.exe114⤵PID:3136
-
\??\c:\1lrlxxx.exec:\1lrlxxx.exe115⤵PID:4756
-
\??\c:\hnhhhh.exec:\hnhhhh.exe116⤵PID:2420
-
\??\c:\dpvvv.exec:\dpvvv.exe117⤵
- System Location Discovery: System Language Discovery
PID:3980 -
\??\c:\fflfllf.exec:\fflfllf.exe118⤵PID:3612
-
\??\c:\fxlffff.exec:\fxlffff.exe119⤵PID:3252
-
\??\c:\nhttnt.exec:\nhttnt.exe120⤵PID:1832
-
\??\c:\vpppj.exec:\vpppj.exe121⤵PID:2156
-
\??\c:\lfffffl.exec:\lfffffl.exe122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-