Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe
Resource
win7-20240903-en
General
-
Target
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe
-
Size
453KB
-
MD5
c7de20458ec2302bc9ff3342155be17e
-
SHA1
6622ce91feaca16de49c29a0e034eaa86cbc1979
-
SHA256
36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be
-
SHA512
0d13aecc2d19520d805a8d3bc962ca03622de87b12ce2029ef5c8241b283651cf1b21aca734293199169b59ecb514108c511db71352e6d0d12a8b5ed6f55497e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1756-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3764-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1556-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2616-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5044-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/908-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-825-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-922-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-1334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 348 vjjvp.exe 3764 vvvpj.exe 2600 jpvpp.exe 3652 vdpvp.exe 2952 lrxlffr.exe 1632 bbntnb.exe 3604 jpddv.exe 3580 ppvpj.exe 1556 bnhnnb.exe 1776 ppvjv.exe 2436 fxllfll.exe 4136 djdjj.exe 4432 5xxxxfx.exe 368 pjpjj.exe 4836 hnnnbh.exe 4160 5pvdj.exe 2772 ttnnbn.exe 4988 ppjjj.exe 4384 lxffflf.exe 4156 vjjjv.exe 404 llfxxfx.exe 4040 jvdvp.exe 2348 bbttnn.exe 1084 dpvvv.exe 3364 rrrfxlr.exe 2440 9nnnht.exe 4324 pdjdv.exe 3984 flrrrrr.exe 908 jdpdv.exe 4464 nhhhnn.exe 4984 vdpdj.exe 4176 vjdvv.exe 1020 hbnnnt.exe 1400 hhtbhn.exe 4572 vdddv.exe 4788 frxlxxl.exe 2616 5bhhbt.exe 1996 vdjpv.exe 4980 djvvj.exe 636 7thnnh.exe 4704 jjpvp.exe 4896 nbhtnt.exe 3624 ppjjp.exe 4044 7xfrrrl.exe 1228 nbbbbb.exe 208 ppdpp.exe 2028 xrrlxff.exe 3192 bnthbh.exe 2340 jvjvv.exe 4392 pjddd.exe 2904 rlfffll.exe 896 nnbhhn.exe 348 dpjpv.exe 1572 xxlllrx.exe 4528 tnhnhn.exe 624 djpdj.exe 3536 lrflxfl.exe 2628 bhnttb.exe 3672 vjppv.exe 548 xflffll.exe 2736 htntnt.exe 4692 1dppp.exe 2296 vjpvv.exe 4520 xxfrrlx.exe -
resource yara_rule behavioral2/memory/348-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1756-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3764-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1556-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4136-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2616-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5044-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/908-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-922-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1756 wrote to memory of 348 1756 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 82 PID 1756 wrote to memory of 348 1756 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 82 PID 1756 wrote to memory of 348 1756 36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe 82 PID 348 wrote to memory of 3764 348 vjjvp.exe 83 PID 348 wrote to memory of 3764 348 vjjvp.exe 83 PID 348 wrote to memory of 3764 348 vjjvp.exe 83 PID 3764 wrote to memory of 2600 3764 vvvpj.exe 84 PID 3764 wrote to memory of 2600 3764 vvvpj.exe 84 PID 3764 wrote to memory of 2600 3764 vvvpj.exe 84 PID 2600 wrote to memory of 3652 2600 jpvpp.exe 85 PID 2600 wrote to memory of 3652 2600 jpvpp.exe 85 PID 2600 wrote to memory of 3652 2600 jpvpp.exe 85 PID 3652 wrote to memory of 2952 3652 vdpvp.exe 86 PID 3652 wrote to memory of 2952 3652 vdpvp.exe 86 PID 3652 wrote to memory of 2952 3652 vdpvp.exe 86 PID 2952 wrote to memory of 1632 2952 lrxlffr.exe 87 PID 2952 wrote to memory of 1632 2952 lrxlffr.exe 87 PID 2952 wrote to memory of 1632 2952 lrxlffr.exe 87 PID 1632 wrote to memory of 3604 1632 bbntnb.exe 88 PID 1632 wrote to memory of 3604 1632 bbntnb.exe 88 PID 1632 wrote to memory of 3604 1632 bbntnb.exe 88 PID 3604 wrote to memory of 3580 3604 jpddv.exe 89 PID 3604 wrote to memory of 3580 3604 jpddv.exe 89 PID 3604 wrote to memory of 3580 3604 jpddv.exe 89 PID 3580 wrote to memory of 1556 3580 ppvpj.exe 90 PID 3580 wrote to memory of 1556 3580 ppvpj.exe 90 PID 3580 wrote to memory of 1556 3580 ppvpj.exe 90 PID 1556 wrote to memory of 1776 1556 bnhnnb.exe 91 PID 1556 wrote to memory of 1776 1556 bnhnnb.exe 91 PID 1556 wrote to memory of 1776 1556 bnhnnb.exe 91 PID 1776 wrote to memory of 2436 1776 ppvjv.exe 92 PID 1776 wrote to memory of 2436 1776 ppvjv.exe 92 PID 1776 wrote to memory of 2436 1776 ppvjv.exe 92 PID 2436 wrote to memory of 4136 2436 fxllfll.exe 93 PID 2436 wrote to memory of 4136 2436 fxllfll.exe 93 PID 2436 wrote to memory of 4136 2436 fxllfll.exe 93 PID 4136 wrote to memory of 4432 4136 djdjj.exe 94 PID 4136 wrote to memory of 4432 4136 djdjj.exe 94 PID 4136 wrote to memory of 4432 4136 djdjj.exe 94 PID 4432 wrote to memory of 368 4432 5xxxxfx.exe 95 PID 4432 wrote to memory of 368 4432 5xxxxfx.exe 95 PID 4432 wrote to memory of 368 4432 5xxxxfx.exe 95 PID 368 wrote to memory of 4836 368 pjpjj.exe 96 PID 368 wrote to memory of 4836 368 pjpjj.exe 96 PID 368 wrote to memory of 4836 368 pjpjj.exe 96 PID 4836 wrote to memory of 4160 4836 hnnnbh.exe 97 PID 4836 wrote to memory of 4160 4836 hnnnbh.exe 97 PID 4836 wrote to memory of 4160 4836 hnnnbh.exe 97 PID 4160 wrote to memory of 2772 4160 5pvdj.exe 98 PID 4160 wrote to memory of 2772 4160 5pvdj.exe 98 PID 4160 wrote to memory of 2772 4160 5pvdj.exe 98 PID 2772 wrote to memory of 4988 2772 ttnnbn.exe 99 PID 2772 wrote to memory of 4988 2772 ttnnbn.exe 99 PID 2772 wrote to memory of 4988 2772 ttnnbn.exe 99 PID 4988 wrote to memory of 4384 4988 ppjjj.exe 100 PID 4988 wrote to memory of 4384 4988 ppjjj.exe 100 PID 4988 wrote to memory of 4384 4988 ppjjj.exe 100 PID 4384 wrote to memory of 4156 4384 lxffflf.exe 101 PID 4384 wrote to memory of 4156 4384 lxffflf.exe 101 PID 4384 wrote to memory of 4156 4384 lxffflf.exe 101 PID 4156 wrote to memory of 404 4156 vjjjv.exe 102 PID 4156 wrote to memory of 404 4156 vjjjv.exe 102 PID 4156 wrote to memory of 404 4156 vjjjv.exe 102 PID 404 wrote to memory of 4040 404 llfxxfx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe"C:\Users\Admin\AppData\Local\Temp\36ea78b5773a42b80c056a2df2ba8115e3bca17bea7e7b766d8ae02faf6c95be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\vjjvp.exec:\vjjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\vvvpj.exec:\vvvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\jpvpp.exec:\jpvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vdpvp.exec:\vdpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\lrxlffr.exec:\lrxlffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\bbntnb.exec:\bbntnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\jpddv.exec:\jpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ppvpj.exec:\ppvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\bnhnnb.exec:\bnhnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ppvjv.exec:\ppvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\fxllfll.exec:\fxllfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\djdjj.exec:\djdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\5xxxxfx.exec:\5xxxxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\pjpjj.exec:\pjpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\hnnnbh.exec:\hnnnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\5pvdj.exec:\5pvdj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\ttnnbn.exec:\ttnnbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\ppjjj.exec:\ppjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\lxffflf.exec:\lxffflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\vjjjv.exec:\vjjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\llfxxfx.exec:\llfxxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jvdvp.exec:\jvdvp.exe23⤵
- Executes dropped EXE
PID:4040 -
\??\c:\bbttnn.exec:\bbttnn.exe24⤵
- Executes dropped EXE
PID:2348 -
\??\c:\dpvvv.exec:\dpvvv.exe25⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rrrfxlr.exec:\rrrfxlr.exe26⤵
- Executes dropped EXE
PID:3364 -
\??\c:\9nnnht.exec:\9nnnht.exe27⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pdjdv.exec:\pdjdv.exe28⤵
- Executes dropped EXE
PID:4324 -
\??\c:\flrrrrr.exec:\flrrrrr.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jdpdv.exec:\jdpdv.exe30⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhhhnn.exec:\nhhhnn.exe31⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vdpdj.exec:\vdpdj.exe32⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vjdvv.exec:\vjdvv.exe33⤵
- Executes dropped EXE
PID:4176 -
\??\c:\hbnnnt.exec:\hbnnnt.exe34⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hhtbhn.exec:\hhtbhn.exe35⤵
- Executes dropped EXE
PID:1400 -
\??\c:\vdddv.exec:\vdddv.exe36⤵
- Executes dropped EXE
PID:4572 -
\??\c:\frxlxxl.exec:\frxlxxl.exe37⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5bhhbt.exec:\5bhhbt.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vdjpv.exec:\vdjpv.exe39⤵
- Executes dropped EXE
PID:1996 -
\??\c:\djvvj.exec:\djvvj.exe40⤵
- Executes dropped EXE
PID:4980 -
\??\c:\7thnnh.exec:\7thnnh.exe41⤵
- Executes dropped EXE
PID:636 -
\??\c:\jjpvp.exec:\jjpvp.exe42⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nbhtnt.exec:\nbhtnt.exe43⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ppjjp.exec:\ppjjp.exe44⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7xfrrrl.exec:\7xfrrrl.exe45⤵
- Executes dropped EXE
PID:4044 -
\??\c:\nbbbbb.exec:\nbbbbb.exe46⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ppdpp.exec:\ppdpp.exe47⤵
- Executes dropped EXE
PID:208 -
\??\c:\xrrlxff.exec:\xrrlxff.exe48⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bnthbh.exec:\bnthbh.exe49⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jvjvv.exec:\jvjvv.exe50⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pjddd.exec:\pjddd.exe51⤵
- Executes dropped EXE
PID:4392 -
\??\c:\rlfffll.exec:\rlfffll.exe52⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnbhhn.exec:\nnbhhn.exe53⤵
- Executes dropped EXE
PID:896 -
\??\c:\dpjpv.exec:\dpjpv.exe54⤵
- Executes dropped EXE
PID:348 -
\??\c:\xxlllrx.exec:\xxlllrx.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tnhnhn.exec:\tnhnhn.exe56⤵
- Executes dropped EXE
PID:4528 -
\??\c:\djpdj.exec:\djpdj.exe57⤵
- Executes dropped EXE
PID:624 -
\??\c:\lrflxfl.exec:\lrflxfl.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\bhnttb.exec:\bhnttb.exe59⤵
- Executes dropped EXE
PID:2628 -
\??\c:\vjppv.exec:\vjppv.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672 -
\??\c:\xflffll.exec:\xflffll.exe61⤵
- Executes dropped EXE
PID:548 -
\??\c:\htntnt.exec:\htntnt.exe62⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1dppp.exec:\1dppp.exe63⤵
- Executes dropped EXE
PID:4692 -
\??\c:\vjpvv.exec:\vjpvv.exe64⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xxfrrlx.exec:\xxfrrlx.exe65⤵
- Executes dropped EXE
PID:4520 -
\??\c:\bthntb.exec:\bthntb.exe66⤵PID:1556
-
\??\c:\xxfffll.exec:\xxfffll.exe67⤵PID:3028
-
\??\c:\frlrfrf.exec:\frlrfrf.exe68⤵PID:3372
-
\??\c:\bnhhnt.exec:\bnhhnt.exe69⤵PID:2436
-
\??\c:\9dvdd.exec:\9dvdd.exe70⤵PID:2404
-
\??\c:\rflxxxr.exec:\rflxxxr.exe71⤵PID:2200
-
\??\c:\flxxflr.exec:\flxxflr.exe72⤵PID:100
-
\??\c:\htbbnt.exec:\htbbnt.exe73⤵PID:4288
-
\??\c:\dppdp.exec:\dppdp.exe74⤵PID:3972
-
\??\c:\ffxlrfx.exec:\ffxlrfx.exe75⤵PID:4820
-
\??\c:\1tbbbh.exec:\1tbbbh.exe76⤵PID:3060
-
\??\c:\5jppp.exec:\5jppp.exe77⤵PID:968
-
\??\c:\llxfllf.exec:\llxfllf.exe78⤵PID:3200
-
\??\c:\bthhhb.exec:\bthhhb.exe79⤵PID:4384
-
\??\c:\vvdjj.exec:\vvdjj.exe80⤵PID:4048
-
\??\c:\jjvdj.exec:\jjvdj.exe81⤵PID:4676
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe82⤵PID:3444
-
\??\c:\3tnthh.exec:\3tnthh.exe83⤵PID:2940
-
\??\c:\vpppv.exec:\vpppv.exe84⤵
- System Location Discovery: System Language Discovery
PID:3940 -
\??\c:\lfxrrff.exec:\lfxrrff.exe85⤵PID:4832
-
\??\c:\hhbtbh.exec:\hhbtbh.exe86⤵PID:5044
-
\??\c:\pvppv.exec:\pvppv.exe87⤵PID:456
-
\??\c:\llrxfrx.exec:\llrxfrx.exe88⤵PID:4052
-
\??\c:\hnttnt.exec:\hnttnt.exe89⤵PID:3384
-
\??\c:\pvdpj.exec:\pvdpj.exe90⤵PID:3128
-
\??\c:\ffrlffx.exec:\ffrlffx.exe91⤵PID:4752
-
\??\c:\vpjjv.exec:\vpjjv.exe92⤵PID:2148
-
\??\c:\5rfffxl.exec:\5rfffxl.exe93⤵PID:4992
-
\??\c:\htnhbt.exec:\htnhbt.exe94⤵PID:908
-
\??\c:\pvjjp.exec:\pvjjp.exe95⤵PID:5056
-
\??\c:\5xlfflf.exec:\5xlfflf.exe96⤵PID:2000
-
\??\c:\nhhhnt.exec:\nhhhnt.exe97⤵PID:5004
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe98⤵PID:3156
-
\??\c:\1xxffrr.exec:\1xxffrr.exe99⤵PID:4540
-
\??\c:\nhhnnn.exec:\nhhnnn.exe100⤵PID:4420
-
\??\c:\djjpj.exec:\djjpj.exe101⤵PID:1964
-
\??\c:\ffxflrl.exec:\ffxflrl.exe102⤵PID:4788
-
\??\c:\nnbbhn.exec:\nnbbhn.exe103⤵PID:2616
-
\??\c:\djvdj.exec:\djvdj.exe104⤵PID:3836
-
\??\c:\xflrxfl.exec:\xflrxfl.exe105⤵PID:1036
-
\??\c:\3tnnht.exec:\3tnnht.exe106⤵PID:636
-
\??\c:\pvpdj.exec:\pvpdj.exe107⤵PID:3000
-
\??\c:\xfxfxfr.exec:\xfxfxfr.exe108⤵PID:3064
-
\??\c:\nttbtb.exec:\nttbtb.exe109⤵PID:3564
-
\??\c:\vdpjd.exec:\vdpjd.exe110⤵PID:3632
-
\??\c:\llfflxx.exec:\llfflxx.exe111⤵PID:1312
-
\??\c:\nnntnb.exec:\nnntnb.exe112⤵PID:1728
-
\??\c:\3vddj.exec:\3vddj.exe113⤵PID:3608
-
\??\c:\rxrffrx.exec:\rxrffrx.exe114⤵PID:3180
-
\??\c:\rrfxrff.exec:\rrfxrff.exe115⤵PID:1384
-
\??\c:\jppjd.exec:\jppjd.exe116⤵PID:4396
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe117⤵PID:4392
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe118⤵PID:4892
-
\??\c:\7ppvd.exec:\7ppvd.exe119⤵PID:896
-
\??\c:\fllffff.exec:\fllffff.exe120⤵PID:4400
-
\??\c:\tbnbhn.exec:\tbnbhn.exe121⤵PID:4100
-
\??\c:\dvdpv.exec:\dvdpv.exe122⤵PID:4428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-