Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe
Resource
win7-20241010-en
General
-
Target
eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe
-
Size
453KB
-
MD5
224254c1241c3dc4d29fbc533387d8a1
-
SHA1
419bb46a8bf377a71b35421c3d186949a1f3dc73
-
SHA256
eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07
-
SHA512
77e85ae129be0b22d4a7779bd7fa80fc9a75b1b063a5e5ec08eb10ad9976f440b81026526dbf33f0b989e7abfe078f446bdaa8b647cb97533318b70992c6d6be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4872-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1212-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1628-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2176-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4436-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3900-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-887-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-1780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2096 llfrrxf.exe 3316 lrxrlfx.exe 3532 hthbnt.exe 1932 ppddj.exe 2040 nbbnnh.exe 2840 xrrlrxx.exe 4400 dpddv.exe 4148 llfrxff.exe 3888 ddddj.exe 3320 vvddj.exe 1960 ddvdv.exe 2356 tttthn.exe 4924 ntbbbn.exe 3324 htnnbh.exe 4904 bbtbhb.exe 3604 djddd.exe 1232 vpvvd.exe 1376 tbhnbn.exe 2100 rfrfxlx.exe 1212 3tttth.exe 4760 bhtttb.exe 5048 vvdvj.exe 4644 ppppp.exe 1016 djdpp.exe 3868 dvvjd.exe 2700 lrxlrxl.exe 3912 pvjjd.exe 4556 jjjvv.exe 4932 xxfxflr.exe 1956 hhnnnt.exe 2368 bnhhhn.exe 2212 ddvvv.exe 400 bnnbbb.exe 560 ddvpp.exe 3128 lrxlffx.exe 396 xflfrxx.exe 4676 hhhbtb.exe 4084 djdjj.exe 3652 5tntnh.exe 4024 xfxfrxl.exe 1192 htnnnn.exe 4008 pjvdv.exe 5076 5nhbbb.exe 3296 bhhbtt.exe 4456 xfxrrrx.exe 4740 bhbtnn.exe 2896 vdjdp.exe 4872 nbnhht.exe 1628 lrlrfxr.exe 2176 rlrlrrx.exe 1436 dpppd.exe 3560 flfrrlf.exe 2268 xfrxlrl.exe 3676 hnbnnt.exe 3336 pdppj.exe 4804 xxxrxxf.exe 4892 ntthbh.exe 4756 vdddj.exe 1260 xfxxxxx.exe 804 bnthtn.exe 4876 jpppp.exe 2580 xlxxlrl.exe 4688 7bttth.exe 312 tthhnn.exe -
resource yara_rule behavioral2/memory/4872-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1212-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1192-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1628-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2176-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2684-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3900-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 2096 4872 eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe 83 PID 4872 wrote to memory of 2096 4872 eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe 83 PID 4872 wrote to memory of 2096 4872 eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe 83 PID 2096 wrote to memory of 3316 2096 llfrrxf.exe 84 PID 2096 wrote to memory of 3316 2096 llfrrxf.exe 84 PID 2096 wrote to memory of 3316 2096 llfrrxf.exe 84 PID 3316 wrote to memory of 3532 3316 lrxrlfx.exe 85 PID 3316 wrote to memory of 3532 3316 lrxrlfx.exe 85 PID 3316 wrote to memory of 3532 3316 lrxrlfx.exe 85 PID 3532 wrote to memory of 1932 3532 hthbnt.exe 86 PID 3532 wrote to memory of 1932 3532 hthbnt.exe 86 PID 3532 wrote to memory of 1932 3532 hthbnt.exe 86 PID 1932 wrote to memory of 2040 1932 ppddj.exe 87 PID 1932 wrote to memory of 2040 1932 ppddj.exe 87 PID 1932 wrote to memory of 2040 1932 ppddj.exe 87 PID 2040 wrote to memory of 2840 2040 nbbnnh.exe 88 PID 2040 wrote to memory of 2840 2040 nbbnnh.exe 88 PID 2040 wrote to memory of 2840 2040 nbbnnh.exe 88 PID 2840 wrote to memory of 4400 2840 xrrlrxx.exe 89 PID 2840 wrote to memory of 4400 2840 xrrlrxx.exe 89 PID 2840 wrote to memory of 4400 2840 xrrlrxx.exe 89 PID 4400 wrote to memory of 4148 4400 dpddv.exe 90 PID 4400 wrote to memory of 4148 4400 dpddv.exe 90 PID 4400 wrote to memory of 4148 4400 dpddv.exe 90 PID 4148 wrote to memory of 3888 4148 llfrxff.exe 91 PID 4148 wrote to memory of 3888 4148 llfrxff.exe 91 PID 4148 wrote to memory of 3888 4148 llfrxff.exe 91 PID 3888 wrote to memory of 3320 3888 ddddj.exe 92 PID 3888 wrote to memory of 3320 3888 ddddj.exe 92 PID 3888 wrote to memory of 3320 3888 ddddj.exe 92 PID 3320 wrote to memory of 1960 3320 vvddj.exe 93 PID 3320 wrote to memory of 1960 3320 vvddj.exe 93 PID 3320 wrote to memory of 1960 3320 vvddj.exe 93 PID 1960 wrote to memory of 2356 1960 ddvdv.exe 94 PID 1960 wrote to memory of 2356 1960 ddvdv.exe 94 PID 1960 wrote to memory of 2356 1960 ddvdv.exe 94 PID 2356 wrote to memory of 4924 2356 tttthn.exe 95 PID 2356 wrote to memory of 4924 2356 tttthn.exe 95 PID 2356 wrote to memory of 4924 2356 tttthn.exe 95 PID 4924 wrote to memory of 3324 4924 ntbbbn.exe 96 PID 4924 wrote to memory of 3324 4924 ntbbbn.exe 96 PID 4924 wrote to memory of 3324 4924 ntbbbn.exe 96 PID 3324 wrote to memory of 4904 3324 htnnbh.exe 97 PID 3324 wrote to memory of 4904 3324 htnnbh.exe 97 PID 3324 wrote to memory of 4904 3324 htnnbh.exe 97 PID 4904 wrote to memory of 3604 4904 bbtbhb.exe 98 PID 4904 wrote to memory of 3604 4904 bbtbhb.exe 98 PID 4904 wrote to memory of 3604 4904 bbtbhb.exe 98 PID 3604 wrote to memory of 1232 3604 djddd.exe 99 PID 3604 wrote to memory of 1232 3604 djddd.exe 99 PID 3604 wrote to memory of 1232 3604 djddd.exe 99 PID 1232 wrote to memory of 1376 1232 vpvvd.exe 100 PID 1232 wrote to memory of 1376 1232 vpvvd.exe 100 PID 1232 wrote to memory of 1376 1232 vpvvd.exe 100 PID 1376 wrote to memory of 2100 1376 tbhnbn.exe 101 PID 1376 wrote to memory of 2100 1376 tbhnbn.exe 101 PID 1376 wrote to memory of 2100 1376 tbhnbn.exe 101 PID 2100 wrote to memory of 1212 2100 rfrfxlx.exe 102 PID 2100 wrote to memory of 1212 2100 rfrfxlx.exe 102 PID 2100 wrote to memory of 1212 2100 rfrfxlx.exe 102 PID 1212 wrote to memory of 4760 1212 3tttth.exe 103 PID 1212 wrote to memory of 4760 1212 3tttth.exe 103 PID 1212 wrote to memory of 4760 1212 3tttth.exe 103 PID 4760 wrote to memory of 5048 4760 bhtttb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe"C:\Users\Admin\AppData\Local\Temp\eebd4f62226099e38ea29bfdaf68a0f35d61bad496e184355dd323c62f69de07.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\llfrrxf.exec:\llfrrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\hthbnt.exec:\hthbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\ppddj.exec:\ppddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\nbbnnh.exec:\nbbnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xrrlrxx.exec:\xrrlrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\dpddv.exec:\dpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\llfrxff.exec:\llfrxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ddddj.exec:\ddddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\vvddj.exec:\vvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\ddvdv.exec:\ddvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\tttthn.exec:\tttthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ntbbbn.exec:\ntbbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\htnnbh.exec:\htnnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\bbtbhb.exec:\bbtbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\djddd.exec:\djddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\vpvvd.exec:\vpvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\tbhnbn.exec:\tbhnbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\rfrfxlx.exec:\rfrfxlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\3tttth.exec:\3tttth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\bhtttb.exec:\bhtttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\vvdvj.exec:\vvdvj.exe23⤵
- Executes dropped EXE
PID:5048 -
\??\c:\ppppp.exec:\ppppp.exe24⤵
- Executes dropped EXE
PID:4644 -
\??\c:\djdpp.exec:\djdpp.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\dvvjd.exec:\dvvjd.exe26⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lrxlrxl.exec:\lrxlrxl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2700 -
\??\c:\pvjjd.exec:\pvjjd.exe28⤵
- Executes dropped EXE
PID:3912 -
\??\c:\jjjvv.exec:\jjjvv.exe29⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xxfxflr.exec:\xxfxflr.exe30⤵
- Executes dropped EXE
PID:4932 -
\??\c:\hhnnnt.exec:\hhnnnt.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bnhhhn.exec:\bnhhhn.exe32⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddvvv.exec:\ddvvv.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bnnbbb.exec:\bnnbbb.exe34⤵
- Executes dropped EXE
PID:400 -
\??\c:\ddvpp.exec:\ddvpp.exe35⤵
- Executes dropped EXE
PID:560 -
\??\c:\lrxlffx.exec:\lrxlffx.exe36⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xflfrxx.exec:\xflfrxx.exe37⤵
- Executes dropped EXE
PID:396 -
\??\c:\hhhbtb.exec:\hhhbtb.exe38⤵
- Executes dropped EXE
PID:4676 -
\??\c:\djdjj.exec:\djdjj.exe39⤵
- Executes dropped EXE
PID:4084 -
\??\c:\5tntnh.exec:\5tntnh.exe40⤵
- Executes dropped EXE
PID:3652 -
\??\c:\xfxfrxl.exec:\xfxfrxl.exe41⤵
- Executes dropped EXE
PID:4024 -
\??\c:\htnnnn.exec:\htnnnn.exe42⤵
- Executes dropped EXE
PID:1192 -
\??\c:\pjvdv.exec:\pjvdv.exe43⤵
- Executes dropped EXE
PID:4008 -
\??\c:\5nhbbb.exec:\5nhbbb.exe44⤵
- Executes dropped EXE
PID:5076 -
\??\c:\bhhbtt.exec:\bhhbtt.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3296 -
\??\c:\xfxrrrx.exec:\xfxrrrx.exe46⤵
- Executes dropped EXE
PID:4456 -
\??\c:\bhbtnn.exec:\bhbtnn.exe47⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vdjdp.exec:\vdjdp.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rxfxxxl.exec:\rxfxxxl.exe49⤵PID:4352
-
\??\c:\nbnhht.exec:\nbnhht.exe50⤵
- Executes dropped EXE
PID:4872 -
\??\c:\lrlrfxr.exec:\lrlrfxr.exe51⤵
- Executes dropped EXE
PID:1628 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe52⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dpppd.exec:\dpppd.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\flfrrlf.exec:\flfrrlf.exe54⤵
- Executes dropped EXE
PID:3560 -
\??\c:\xfrxlrl.exec:\xfrxlrl.exe55⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hnbnnt.exec:\hnbnnt.exe56⤵
- Executes dropped EXE
PID:3676 -
\??\c:\pdppj.exec:\pdppj.exe57⤵
- Executes dropped EXE
PID:3336 -
\??\c:\xxxrxxf.exec:\xxxrxxf.exe58⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ntthbh.exec:\ntthbh.exe59⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vdddj.exec:\vdddj.exe60⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xfxxxxx.exec:\xfxxxxx.exe61⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bnthtn.exec:\bnthtn.exe62⤵
- Executes dropped EXE
PID:804 -
\??\c:\jpppp.exec:\jpppp.exe63⤵
- Executes dropped EXE
PID:4876 -
\??\c:\xlxxlrl.exec:\xlxxlrl.exe64⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7bttth.exec:\7bttth.exe65⤵
- Executes dropped EXE
PID:4688 -
\??\c:\tthhnn.exec:\tthhnn.exe66⤵
- Executes dropped EXE
PID:312 -
\??\c:\vvjjj.exec:\vvjjj.exe67⤵PID:4860
-
\??\c:\rxrrlff.exec:\rxrrlff.exe68⤵PID:3964
-
\??\c:\nnnnnn.exec:\nnnnnn.exe69⤵PID:2280
-
\??\c:\3vddj.exec:\3vddj.exe70⤵PID:3708
-
\??\c:\xlxxflf.exec:\xlxxflf.exe71⤵PID:2684
-
\??\c:\hhnbhn.exec:\hhnbhn.exe72⤵PID:3636
-
\??\c:\vvddj.exec:\vvddj.exe73⤵PID:1532
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe74⤵PID:1244
-
\??\c:\tbhhhb.exec:\tbhhhb.exe75⤵PID:2600
-
\??\c:\jvjjj.exec:\jvjjj.exe76⤵PID:2384
-
\??\c:\frrxxff.exec:\frrxxff.exe77⤵PID:1612
-
\??\c:\fxrlffx.exec:\fxrlffx.exe78⤵PID:5056
-
\??\c:\9vppp.exec:\9vppp.exe79⤵PID:4004
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe80⤵PID:3400
-
\??\c:\tbhhhn.exec:\tbhhhn.exe81⤵PID:1148
-
\??\c:\bnhnbn.exec:\bnhnbn.exe82⤵PID:604
-
\??\c:\jvvvj.exec:\jvvvj.exe83⤵PID:3508
-
\??\c:\lrrxxff.exec:\lrrxxff.exe84⤵PID:2236
-
\??\c:\7bthhn.exec:\7bthhn.exe85⤵PID:4368
-
\??\c:\dvdpp.exec:\dvdpp.exe86⤵PID:1160
-
\??\c:\7rxxxfl.exec:\7rxxxfl.exe87⤵PID:4556
-
\??\c:\tnbthn.exec:\tnbthn.exe88⤵PID:4660
-
\??\c:\pvdjj.exec:\pvdjj.exe89⤵PID:3168
-
\??\c:\3rflrxl.exec:\3rflrxl.exe90⤵PID:2860
-
\??\c:\nhbhhh.exec:\nhbhhh.exe91⤵PID:1556
-
\??\c:\jvpdd.exec:\jvpdd.exe92⤵PID:2284
-
\??\c:\xxlrllx.exec:\xxlrllx.exe93⤵PID:2220
-
\??\c:\llfrfrl.exec:\llfrfrl.exe94⤵PID:4256
-
\??\c:\htnthn.exec:\htnthn.exe95⤵PID:2880
-
\??\c:\vdpjv.exec:\vdpjv.exe96⤵PID:1792
-
\??\c:\rxlxlfl.exec:\rxlxlfl.exe97⤵PID:2660
-
\??\c:\bbbhhn.exec:\bbbhhn.exe98⤵PID:1716
-
\??\c:\djjpp.exec:\djjpp.exe99⤵PID:2180
-
\??\c:\rrffllx.exec:\rrffllx.exe100⤵PID:2888
-
\??\c:\thbhnb.exec:\thbhnb.exe101⤵PID:3372
-
\??\c:\nthhtb.exec:\nthhtb.exe102⤵PID:2760
-
\??\c:\djvdv.exec:\djvdv.exe103⤵PID:1192
-
\??\c:\xxffxff.exec:\xxffxff.exe104⤵PID:2540
-
\??\c:\nthbbn.exec:\nthbbn.exe105⤵PID:4496
-
\??\c:\dpvdd.exec:\dpvdd.exe106⤵PID:4092
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe107⤵PID:3876
-
\??\c:\nbhhhn.exec:\nbhhhn.exe108⤵PID:4356
-
\??\c:\ddddd.exec:\ddddd.exe109⤵PID:2896
-
\??\c:\ddjjj.exec:\ddjjj.exe110⤵PID:4848
-
\??\c:\bhhnnn.exec:\bhhnnn.exe111⤵PID:3672
-
\??\c:\vddjd.exec:\vddjd.exe112⤵PID:1644
-
\??\c:\3fxrxxf.exec:\3fxrxxf.exe113⤵PID:404
-
\??\c:\7llxrfr.exec:\7llxrfr.exe114⤵PID:468
-
\??\c:\hbnttn.exec:\hbnttn.exe115⤵
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\ddpjp.exec:\ddpjp.exe116⤵PID:844
-
\??\c:\fflxxfr.exec:\fflxxfr.exe117⤵PID:3644
-
\??\c:\bntnth.exec:\bntnth.exe118⤵PID:2040
-
\??\c:\bnhntn.exec:\bnhntn.exe119⤵PID:4380
-
\??\c:\pdjdv.exec:\pdjdv.exe120⤵PID:4504
-
\??\c:\xlfxfxx.exec:\xlfxfxx.exe121⤵PID:216
-
\??\c:\nnbttb.exec:\nnbttb.exe122⤵PID:3740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-