Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
Resource
win7-20240708-en
General
-
Target
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe
-
Size
454KB
-
MD5
5bf3f682fd3484161bbe2f106cc7e3e2
-
SHA1
81aa8c7cc5771050123dbaf006396a35997d7e51
-
SHA256
f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367
-
SHA512
301797a6faed0b1ca1b9db2935e1d0d49b257759a622d83b8e59992966d28921eead42bf0ab92dbea0b71ff29367f653ef8aaa09585ad8a1f45cc05d27190890
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4920-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2864-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2212-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4156-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2076-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1808-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1060-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3608-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-983-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-1030-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-1143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3008 lrxrlll.exe 3108 hhtthh.exe 2864 1rrrllf.exe 4904 btbbhh.exe 2136 pvvvp.exe 2660 3nhbhn.exe 4664 lxrfrfr.exe 2212 nhbnhh.exe 116 dpdpd.exe 4156 3hbnhn.exe 1836 dpdpj.exe 2132 xlrfrfr.exe 3736 1ttnnb.exe 2704 flxlllf.exe 4124 9jpdv.exe 64 rfxrlxr.exe 4044 ddjdv.exe 2224 bhbtnn.exe 4556 1jjjj.exe 1932 xrxrlrl.exe 4932 hntnhb.exe 3936 dppjd.exe 2788 1flfffx.exe 3268 thnbbb.exe 3576 1vpvv.exe 2076 hnntth.exe 804 thtnhb.exe 1688 pdvdv.exe 3740 3flfllr.exe 3384 rllfxrl.exe 4224 pvvpj.exe 3692 btnhbb.exe 3244 rxffrxf.exe 1128 hhhbtn.exe 2172 pdjdp.exe 3400 rxfxllr.exe 1808 bttbhh.exe 4180 jpvvp.exe 1512 fflfffx.exe 4428 bnhbbh.exe 2652 5bhbtt.exe 4836 pvdvj.exe 4300 fxxfffl.exe 4908 nttttt.exe 3256 pjpdd.exe 3996 1xxrlrr.exe 8 lxrlrrl.exe 2244 bttnbb.exe 3160 ddddp.exe 1576 rflfxxr.exe 888 hhhbtt.exe 1828 jppjj.exe 4532 vpjdv.exe 3156 9xxrfrx.exe 216 tntnhh.exe 228 vvdvd.exe 2004 1xfxrrl.exe 2856 nnhttn.exe 2796 dvdpv.exe 1700 jvvjd.exe 3324 rrxrllx.exe 5000 ttttnn.exe 3216 pvvpd.exe 3112 fxrrlll.exe -
resource yara_rule behavioral2/memory/4920-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2864-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2212-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4156-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1836-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2076-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3692-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1808-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1060-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4244-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3608-746-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llllfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3008 4920 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 82 PID 4920 wrote to memory of 3008 4920 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 82 PID 4920 wrote to memory of 3008 4920 f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe 82 PID 3008 wrote to memory of 3108 3008 lrxrlll.exe 83 PID 3008 wrote to memory of 3108 3008 lrxrlll.exe 83 PID 3008 wrote to memory of 3108 3008 lrxrlll.exe 83 PID 3108 wrote to memory of 2864 3108 hhtthh.exe 84 PID 3108 wrote to memory of 2864 3108 hhtthh.exe 84 PID 3108 wrote to memory of 2864 3108 hhtthh.exe 84 PID 2864 wrote to memory of 4904 2864 1rrrllf.exe 85 PID 2864 wrote to memory of 4904 2864 1rrrllf.exe 85 PID 2864 wrote to memory of 4904 2864 1rrrllf.exe 85 PID 4904 wrote to memory of 2136 4904 btbbhh.exe 86 PID 4904 wrote to memory of 2136 4904 btbbhh.exe 86 PID 4904 wrote to memory of 2136 4904 btbbhh.exe 86 PID 2136 wrote to memory of 2660 2136 pvvvp.exe 87 PID 2136 wrote to memory of 2660 2136 pvvvp.exe 87 PID 2136 wrote to memory of 2660 2136 pvvvp.exe 87 PID 2660 wrote to memory of 4664 2660 3nhbhn.exe 88 PID 2660 wrote to memory of 4664 2660 3nhbhn.exe 88 PID 2660 wrote to memory of 4664 2660 3nhbhn.exe 88 PID 4664 wrote to memory of 2212 4664 lxrfrfr.exe 89 PID 4664 wrote to memory of 2212 4664 lxrfrfr.exe 89 PID 4664 wrote to memory of 2212 4664 lxrfrfr.exe 89 PID 2212 wrote to memory of 116 2212 nhbnhh.exe 90 PID 2212 wrote to memory of 116 2212 nhbnhh.exe 90 PID 2212 wrote to memory of 116 2212 nhbnhh.exe 90 PID 116 wrote to memory of 4156 116 dpdpd.exe 91 PID 116 wrote to memory of 4156 116 dpdpd.exe 91 PID 116 wrote to memory of 4156 116 dpdpd.exe 91 PID 4156 wrote to memory of 1836 4156 3hbnhn.exe 92 PID 4156 wrote to memory of 1836 4156 3hbnhn.exe 92 PID 4156 wrote to memory of 1836 4156 3hbnhn.exe 92 PID 1836 wrote to memory of 2132 1836 dpdpj.exe 93 PID 1836 wrote to memory of 2132 1836 dpdpj.exe 93 PID 1836 wrote to memory of 2132 1836 dpdpj.exe 93 PID 2132 wrote to memory of 3736 2132 xlrfrfr.exe 94 PID 2132 wrote to memory of 3736 2132 xlrfrfr.exe 94 PID 2132 wrote to memory of 3736 2132 xlrfrfr.exe 94 PID 3736 wrote to memory of 2704 3736 1ttnnb.exe 95 PID 3736 wrote to memory of 2704 3736 1ttnnb.exe 95 PID 3736 wrote to memory of 2704 3736 1ttnnb.exe 95 PID 2704 wrote to memory of 4124 2704 flxlllf.exe 96 PID 2704 wrote to memory of 4124 2704 flxlllf.exe 96 PID 2704 wrote to memory of 4124 2704 flxlllf.exe 96 PID 4124 wrote to memory of 64 4124 9jpdv.exe 97 PID 4124 wrote to memory of 64 4124 9jpdv.exe 97 PID 4124 wrote to memory of 64 4124 9jpdv.exe 97 PID 64 wrote to memory of 4044 64 rfxrlxr.exe 98 PID 64 wrote to memory of 4044 64 rfxrlxr.exe 98 PID 64 wrote to memory of 4044 64 rfxrlxr.exe 98 PID 4044 wrote to memory of 2224 4044 ddjdv.exe 99 PID 4044 wrote to memory of 2224 4044 ddjdv.exe 99 PID 4044 wrote to memory of 2224 4044 ddjdv.exe 99 PID 2224 wrote to memory of 4556 2224 bhbtnn.exe 100 PID 2224 wrote to memory of 4556 2224 bhbtnn.exe 100 PID 2224 wrote to memory of 4556 2224 bhbtnn.exe 100 PID 4556 wrote to memory of 1932 4556 1jjjj.exe 101 PID 4556 wrote to memory of 1932 4556 1jjjj.exe 101 PID 4556 wrote to memory of 1932 4556 1jjjj.exe 101 PID 1932 wrote to memory of 4932 1932 xrxrlrl.exe 102 PID 1932 wrote to memory of 4932 1932 xrxrlrl.exe 102 PID 1932 wrote to memory of 4932 1932 xrxrlrl.exe 102 PID 4932 wrote to memory of 3936 4932 hntnhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"C:\Users\Admin\AppData\Local\Temp\f52507f7a75eeb075b26e2258dfc653d54b185ef0658c2fedd4ab8f73317b367.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\lrxrlll.exec:\lrxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hhtthh.exec:\hhtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\1rrrllf.exec:\1rrrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\btbbhh.exec:\btbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\pvvvp.exec:\pvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3nhbhn.exec:\3nhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\nhbnhh.exec:\nhbnhh.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dpdpd.exec:\dpdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\3hbnhn.exec:\3hbnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\dpdpj.exec:\dpdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\xlrfrfr.exec:\xlrfrfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\1ttnnb.exec:\1ttnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\flxlllf.exec:\flxlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9jpdv.exec:\9jpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\rfxrlxr.exec:\rfxrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\ddjdv.exec:\ddjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\bhbtnn.exec:\bhbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\1jjjj.exec:\1jjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\xrxrlrl.exec:\xrxrlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\hntnhb.exec:\hntnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\dppjd.exec:\dppjd.exe23⤵
- Executes dropped EXE
PID:3936 -
\??\c:\1flfffx.exec:\1flfffx.exe24⤵
- Executes dropped EXE
PID:2788 -
\??\c:\thnbbb.exec:\thnbbb.exe25⤵
- Executes dropped EXE
PID:3268 -
\??\c:\1vpvv.exec:\1vpvv.exe26⤵
- Executes dropped EXE
PID:3576 -
\??\c:\hnntth.exec:\hnntth.exe27⤵
- Executes dropped EXE
PID:2076 -
\??\c:\thtnhb.exec:\thtnhb.exe28⤵
- Executes dropped EXE
PID:804 -
\??\c:\pdvdv.exec:\pdvdv.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\3flfllr.exec:\3flfllr.exe30⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rllfxrl.exec:\rllfxrl.exe31⤵
- Executes dropped EXE
PID:3384 -
\??\c:\pvvpj.exec:\pvvpj.exe32⤵
- Executes dropped EXE
PID:4224 -
\??\c:\btnhbb.exec:\btnhbb.exe33⤵
- Executes dropped EXE
PID:3692 -
\??\c:\rxffrxf.exec:\rxffrxf.exe34⤵
- Executes dropped EXE
PID:3244 -
\??\c:\hhhbtn.exec:\hhhbtn.exe35⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pdjdp.exec:\pdjdp.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rxfxllr.exec:\rxfxllr.exe37⤵
- Executes dropped EXE
PID:3400 -
\??\c:\bttbhh.exec:\bttbhh.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jpvvp.exec:\jpvvp.exe39⤵
- Executes dropped EXE
PID:4180 -
\??\c:\fflfffx.exec:\fflfffx.exe40⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnhbbh.exec:\bnhbbh.exe41⤵
- Executes dropped EXE
PID:4428 -
\??\c:\5bhbtt.exec:\5bhbtt.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pvdvj.exec:\pvdvj.exe43⤵
- Executes dropped EXE
PID:4836 -
\??\c:\fxxfffl.exec:\fxxfffl.exe44⤵
- Executes dropped EXE
PID:4300 -
\??\c:\nttttt.exec:\nttttt.exe45⤵
- Executes dropped EXE
PID:4908 -
\??\c:\pjpdd.exec:\pjpdd.exe46⤵
- Executes dropped EXE
PID:3256 -
\??\c:\1xxrlrr.exec:\1xxrlrr.exe47⤵
- Executes dropped EXE
PID:3996 -
\??\c:\lxrlrrl.exec:\lxrlrrl.exe48⤵
- Executes dropped EXE
PID:8 -
\??\c:\bttnbb.exec:\bttnbb.exe49⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddddp.exec:\ddddp.exe50⤵
- Executes dropped EXE
PID:3160 -
\??\c:\rflfxxr.exec:\rflfxxr.exe51⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hhhbtt.exec:\hhhbtt.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\jppjj.exec:\jppjj.exe53⤵
- Executes dropped EXE
PID:1828 -
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9xxrfrx.exec:\9xxrfrx.exe55⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tntnhh.exec:\tntnhh.exe56⤵
- Executes dropped EXE
PID:216 -
\??\c:\vvdvd.exec:\vvdvd.exe57⤵
- Executes dropped EXE
PID:228 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nnhttn.exec:\nnhttn.exe59⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dvdpv.exec:\dvdpv.exe60⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jvvjd.exec:\jvvjd.exe61⤵
- Executes dropped EXE
PID:1700 -
\??\c:\rrxrllx.exec:\rrxrllx.exe62⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ttttnn.exec:\ttttnn.exe63⤵
- Executes dropped EXE
PID:5000 -
\??\c:\pvvpd.exec:\pvvpd.exe64⤵
- Executes dropped EXE
PID:3216 -
\??\c:\fxrrlll.exec:\fxrrlll.exe65⤵
- Executes dropped EXE
PID:3112 -
\??\c:\hbhbhb.exec:\hbhbhb.exe66⤵PID:4824
-
\??\c:\vpppd.exec:\vpppd.exe67⤵PID:2220
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe68⤵PID:1772
-
\??\c:\bbhtnt.exec:\bbhtnt.exe69⤵PID:2380
-
\??\c:\dvpdp.exec:\dvpdp.exe70⤵PID:4100
-
\??\c:\rlxllxl.exec:\rlxllxl.exe71⤵PID:1000
-
\??\c:\7bnhnt.exec:\7bnhnt.exe72⤵PID:2132
-
\??\c:\pdpjd.exec:\pdpjd.exe73⤵PID:2408
-
\??\c:\vdpvv.exec:\vdpvv.exe74⤵PID:3896
-
\??\c:\5lxrxxl.exec:\5lxrxxl.exe75⤵PID:3560
-
\??\c:\ppvpd.exec:\ppvpd.exe76⤵PID:212
-
\??\c:\vvvpj.exec:\vvvpj.exe77⤵PID:1060
-
\??\c:\xrfxrll.exec:\xrfxrll.exe78⤵PID:336
-
\??\c:\btbttb.exec:\btbttb.exe79⤵PID:2860
-
\??\c:\jjddd.exec:\jjddd.exe80⤵PID:1380
-
\??\c:\5lxrrxr.exec:\5lxrrxr.exe81⤵PID:2760
-
\??\c:\htnnnb.exec:\htnnnb.exe82⤵PID:4104
-
\??\c:\nhhbtn.exec:\nhhbtn.exe83⤵
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\pvdvj.exec:\pvdvj.exe84⤵PID:3612
-
\??\c:\xrlrfxf.exec:\xrlrfxf.exe85⤵PID:3240
-
\??\c:\hhhtnh.exec:\hhhtnh.exe86⤵PID:1376
-
\??\c:\hbhtnb.exec:\hbhtnb.exe87⤵PID:2788
-
\??\c:\5pvpj.exec:\5pvpj.exe88⤵PID:4364
-
\??\c:\lfrllrf.exec:\lfrllrf.exe89⤵PID:3268
-
\??\c:\bttntt.exec:\bttntt.exe90⤵PID:3220
-
\??\c:\1jdvv.exec:\1jdvv.exe91⤵PID:3788
-
\??\c:\xlxlrff.exec:\xlxlrff.exe92⤵PID:4892
-
\??\c:\bnnbtb.exec:\bnnbtb.exe93⤵PID:1260
-
\??\c:\bbtnhb.exec:\bbtnhb.exe94⤵PID:456
-
\??\c:\lfxlfrf.exec:\lfxlfrf.exe95⤵PID:4440
-
\??\c:\5flfxxx.exec:\5flfxxx.exe96⤵PID:3796
-
\??\c:\btbttt.exec:\btbttt.exe97⤵PID:1964
-
\??\c:\vppjd.exec:\vppjd.exe98⤵PID:2120
-
\??\c:\frffflr.exec:\frffflr.exe99⤵PID:3556
-
\??\c:\btbtnt.exec:\btbtnt.exe100⤵PID:884
-
\??\c:\jvddj.exec:\jvddj.exe101⤵PID:1284
-
\??\c:\1dvpp.exec:\1dvpp.exe102⤵PID:4376
-
\??\c:\lfrfffx.exec:\lfrfffx.exe103⤵PID:2584
-
\??\c:\nnhhbb.exec:\nnhhbb.exe104⤵PID:3400
-
\??\c:\ddjjj.exec:\ddjjj.exe105⤵PID:1448
-
\??\c:\1lxrffl.exec:\1lxrffl.exe106⤵PID:2464
-
\??\c:\htbtnn.exec:\htbtnn.exe107⤵PID:1512
-
\??\c:\hhhhbn.exec:\hhhhbn.exe108⤵PID:2356
-
\??\c:\jjvpp.exec:\jjvpp.exe109⤵PID:1868
-
\??\c:\9rlllrl.exec:\9rlllrl.exe110⤵PID:2880
-
\??\c:\bbhbhb.exec:\bbhbhb.exe111⤵PID:4300
-
\??\c:\5vjvv.exec:\5vjvv.exe112⤵PID:968
-
\??\c:\jdpjp.exec:\jdpjp.exe113⤵PID:4808
-
\??\c:\9xllfll.exec:\9xllfll.exe114⤵PID:4120
-
\??\c:\nthnnn.exec:\nthnnn.exe115⤵PID:3952
-
\??\c:\3jddd.exec:\3jddd.exe116⤵PID:4040
-
\??\c:\lxrxxrr.exec:\lxrxxrr.exe117⤵PID:2304
-
\??\c:\hthtth.exec:\hthtth.exe118⤵PID:4480
-
\??\c:\vdvpv.exec:\vdvpv.exe119⤵PID:888
-
\??\c:\xrlffxx.exec:\xrlffxx.exe120⤵PID:1828
-
\??\c:\bbthhn.exec:\bbthhn.exe121⤵
- System Location Discovery: System Language Discovery
PID:5068 -
\??\c:\djvvj.exec:\djvvj.exe122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-