Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 09:35
Behavioral task
behavioral1
Sample
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe
-
Size
345KB
-
MD5
87a2b4f821111d88d54c35236913829c
-
SHA1
a4aff11fa7a3bc446b682cb8eafeb4e68fa62f42
-
SHA256
e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c
-
SHA512
1578e2e2b3faf87c77b0b31b89f675aef8a05368b9d661f6087c2e6090290bbd2bf2ac53ecec49ae0f83e2df55d28f206b50556f664bd1d3145000d63fcd421d
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA8:R4wFHoS3WXZshJX2VGd8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1460-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2256-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2732-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2320-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/712-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4868-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1048-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4228-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4592-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-949-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-1065-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3652 fxffxxr.exe 212 7jdvv.exe 4976 xrxrffr.exe 1160 ddvpj.exe 3532 xlrllfl.exe 1900 hbnhbt.exe 4076 pdvdv.exe 4324 lfxrxrx.exe 3768 xxfxfrx.exe 3600 lfxrrll.exe 2188 pddvp.exe 2400 9rlfrxr.exe 1016 jvvjd.exe 3656 rllfrlf.exe 3236 lfxrxxr.exe 4336 vpddd.exe 4764 rlflffx.exe 3688 nhnnnn.exe 3636 5vdvp.exe 4820 fflxrlf.exe 2776 5fxrxxr.exe 2328 9nttnh.exe 4504 djjdv.exe 5104 rffxllf.exe 2144 flfrffx.exe 4320 hbbbhh.exe 3868 jjpdv.exe 1504 frlfrlx.exe 2256 xrxxrfx.exe 872 dvvvv.exe 388 dvdvv.exe 1528 lllfxxx.exe 4544 1dvjd.exe 4388 lxxrrrr.exe 2732 pppjd.exe 2820 xxxxxxr.exe 3888 bttttb.exe 1748 1vdvp.exe 2320 fxxxrrr.exe 2432 jjjjd.exe 4444 lflffrl.exe 2944 hnbbbb.exe 5112 djjdd.exe 4944 frfrllf.exe 1620 hntthb.exe 1376 djvvp.exe 3892 rlflxfx.exe 3952 tthhtt.exe 3984 hbnhtt.exe 3848 rllfxlf.exe 1532 hntnnh.exe 3104 jdjjv.exe 432 vjjdp.exe 2308 tttnht.exe 4428 hbtnhb.exe 3628 1ppvp.exe 1464 jdvpj.exe 3652 httnnh.exe 712 jddvv.exe 1964 vvdvv.exe 1496 5lllfxr.exe 3524 ntnhbh.exe 3860 djjjp.exe 3532 1xfxxxx.exe -
resource yara_rule behavioral2/memory/1460-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1460-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b74-3.dat upx behavioral2/files/0x0007000000023c65-9.dat upx behavioral2/memory/3652-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c66-11.dat upx behavioral2/memory/212-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c67-18.dat upx behavioral2/memory/4976-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c68-24.dat upx behavioral2/memory/1160-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3532-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c69-29.dat upx behavioral2/memory/1900-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6a-35.dat upx behavioral2/memory/4324-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6b-41.dat upx behavioral2/memory/1900-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4076-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6c-45.dat upx behavioral2/files/0x0007000000023c6d-49.dat upx behavioral2/memory/3768-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3600-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2188-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c6e-55.dat upx behavioral2/files/0x0007000000023c6f-60.dat upx behavioral2/files/0x0007000000023c70-65.dat upx behavioral2/memory/2400-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1016-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3656-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c73-75.dat upx behavioral2/files/0x0007000000023c71-70.dat upx behavioral2/memory/3236-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c74-80.dat upx behavioral2/files/0x0009000000023c5a-84.dat upx behavioral2/files/0x0007000000023c75-88.dat upx behavioral2/memory/3688-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c76-93.dat upx behavioral2/memory/3636-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c77-98.dat upx behavioral2/memory/2776-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c79-109.dat upx behavioral2/files/0x0007000000023c7a-113.dat upx behavioral2/memory/4504-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c7b-118.dat upx behavioral2/memory/5104-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c7c-124.dat upx behavioral2/files/0x0007000000023c7d-128.dat upx behavioral2/files/0x0007000000023c7e-132.dat upx behavioral2/memory/4320-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c7f-136.dat upx behavioral2/memory/3868-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2328-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c78-104.dat upx behavioral2/memory/4820-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c80-142.dat upx behavioral2/memory/1504-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c81-147.dat upx behavioral2/memory/2256-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/872-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c82-152.dat upx behavioral2/files/0x0007000000023c83-156.dat upx behavioral2/memory/4544-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2732-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 3652 1460 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 83 PID 1460 wrote to memory of 3652 1460 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 83 PID 1460 wrote to memory of 3652 1460 e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe 83 PID 3652 wrote to memory of 212 3652 fxffxxr.exe 84 PID 3652 wrote to memory of 212 3652 fxffxxr.exe 84 PID 3652 wrote to memory of 212 3652 fxffxxr.exe 84 PID 212 wrote to memory of 4976 212 7jdvv.exe 85 PID 212 wrote to memory of 4976 212 7jdvv.exe 85 PID 212 wrote to memory of 4976 212 7jdvv.exe 85 PID 4976 wrote to memory of 1160 4976 xrxrffr.exe 86 PID 4976 wrote to memory of 1160 4976 xrxrffr.exe 86 PID 4976 wrote to memory of 1160 4976 xrxrffr.exe 86 PID 1160 wrote to memory of 3532 1160 ddvpj.exe 87 PID 1160 wrote to memory of 3532 1160 ddvpj.exe 87 PID 1160 wrote to memory of 3532 1160 ddvpj.exe 87 PID 3532 wrote to memory of 1900 3532 xlrllfl.exe 88 PID 3532 wrote to memory of 1900 3532 xlrllfl.exe 88 PID 3532 wrote to memory of 1900 3532 xlrllfl.exe 88 PID 1900 wrote to memory of 4076 1900 hbnhbt.exe 89 PID 1900 wrote to memory of 4076 1900 hbnhbt.exe 89 PID 1900 wrote to memory of 4076 1900 hbnhbt.exe 89 PID 4076 wrote to memory of 4324 4076 pdvdv.exe 90 PID 4076 wrote to memory of 4324 4076 pdvdv.exe 90 PID 4076 wrote to memory of 4324 4076 pdvdv.exe 90 PID 4324 wrote to memory of 3768 4324 lfxrxrx.exe 91 PID 4324 wrote to memory of 3768 4324 lfxrxrx.exe 91 PID 4324 wrote to memory of 3768 4324 lfxrxrx.exe 91 PID 3768 wrote to memory of 3600 3768 xxfxfrx.exe 92 PID 3768 wrote to memory of 3600 3768 xxfxfrx.exe 92 PID 3768 wrote to memory of 3600 3768 xxfxfrx.exe 92 PID 3600 wrote to memory of 2188 3600 lfxrrll.exe 93 PID 3600 wrote to memory of 2188 3600 lfxrrll.exe 93 PID 3600 wrote to memory of 2188 3600 lfxrrll.exe 93 PID 2188 wrote to memory of 2400 2188 pddvp.exe 94 PID 2188 wrote to memory of 2400 2188 pddvp.exe 94 PID 2188 wrote to memory of 2400 2188 pddvp.exe 94 PID 2400 wrote to memory of 1016 2400 9rlfrxr.exe 95 PID 2400 wrote to memory of 1016 2400 9rlfrxr.exe 95 PID 2400 wrote to memory of 1016 2400 9rlfrxr.exe 95 PID 1016 wrote to memory of 3656 1016 jvvjd.exe 96 PID 1016 wrote to memory of 3656 1016 jvvjd.exe 96 PID 1016 wrote to memory of 3656 1016 jvvjd.exe 96 PID 3656 wrote to memory of 3236 3656 rllfrlf.exe 97 PID 3656 wrote to memory of 3236 3656 rllfrlf.exe 97 PID 3656 wrote to memory of 3236 3656 rllfrlf.exe 97 PID 3236 wrote to memory of 4336 3236 lfxrxxr.exe 98 PID 3236 wrote to memory of 4336 3236 lfxrxxr.exe 98 PID 3236 wrote to memory of 4336 3236 lfxrxxr.exe 98 PID 4336 wrote to memory of 4764 4336 vpddd.exe 99 PID 4336 wrote to memory of 4764 4336 vpddd.exe 99 PID 4336 wrote to memory of 4764 4336 vpddd.exe 99 PID 4764 wrote to memory of 3688 4764 rlflffx.exe 100 PID 4764 wrote to memory of 3688 4764 rlflffx.exe 100 PID 4764 wrote to memory of 3688 4764 rlflffx.exe 100 PID 3688 wrote to memory of 3636 3688 nhnnnn.exe 101 PID 3688 wrote to memory of 3636 3688 nhnnnn.exe 101 PID 3688 wrote to memory of 3636 3688 nhnnnn.exe 101 PID 3636 wrote to memory of 4820 3636 5vdvp.exe 102 PID 3636 wrote to memory of 4820 3636 5vdvp.exe 102 PID 3636 wrote to memory of 4820 3636 5vdvp.exe 102 PID 4820 wrote to memory of 2776 4820 fflxrlf.exe 103 PID 4820 wrote to memory of 2776 4820 fflxrlf.exe 103 PID 4820 wrote to memory of 2776 4820 fflxrlf.exe 103 PID 2776 wrote to memory of 2328 2776 5fxrxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"C:\Users\Admin\AppData\Local\Temp\e4f42584224e4c2d0a0c28a7b40cbd1a96081f7fd71ffd13283965f63f27178c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\fxffxxr.exec:\fxffxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\7jdvv.exec:\7jdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\xrxrffr.exec:\xrxrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\ddvpj.exec:\ddvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\xlrllfl.exec:\xlrllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\hbnhbt.exec:\hbnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\pdvdv.exec:\pdvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\lfxrxrx.exec:\lfxrxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\xxfxfrx.exec:\xxfxfrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\lfxrrll.exec:\lfxrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9rlfrxr.exec:\9rlfrxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\jvvjd.exec:\jvvjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\rllfrlf.exec:\rllfrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\lfxrxxr.exec:\lfxrxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\vpddd.exec:\vpddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\rlflffx.exec:\rlflffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\nhnnnn.exec:\nhnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\5vdvp.exec:\5vdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\fflxrlf.exec:\fflxrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\5fxrxxr.exec:\5fxrxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9nttnh.exec:\9nttnh.exe23⤵
- Executes dropped EXE
PID:2328 -
\??\c:\djjdv.exec:\djjdv.exe24⤵
- Executes dropped EXE
PID:4504 -
\??\c:\rffxllf.exec:\rffxllf.exe25⤵
- Executes dropped EXE
PID:5104 -
\??\c:\flfrffx.exec:\flfrffx.exe26⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbbbhh.exec:\hbbbhh.exe27⤵
- Executes dropped EXE
PID:4320 -
\??\c:\jjpdv.exec:\jjpdv.exe28⤵
- Executes dropped EXE
PID:3868 -
\??\c:\frlfrlx.exec:\frlfrlx.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrxxrfx.exec:\xrxxrfx.exe30⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvvvv.exec:\dvvvv.exe31⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvdvv.exec:\dvdvv.exe32⤵
- Executes dropped EXE
PID:388 -
\??\c:\lllfxxx.exec:\lllfxxx.exe33⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1dvjd.exec:\1dvjd.exe34⤵
- Executes dropped EXE
PID:4544 -
\??\c:\lxxrrrr.exec:\lxxrrrr.exe35⤵
- Executes dropped EXE
PID:4388 -
\??\c:\pppjd.exec:\pppjd.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bttttb.exec:\bttttb.exe38⤵
- Executes dropped EXE
PID:3888 -
\??\c:\1vdvp.exec:\1vdvp.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe40⤵
- Executes dropped EXE
PID:2320 -
\??\c:\jjjjd.exec:\jjjjd.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\lflffrl.exec:\lflffrl.exe42⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hnbbbb.exec:\hnbbbb.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\djjdd.exec:\djjdd.exe44⤵
- Executes dropped EXE
PID:5112 -
\??\c:\frfrllf.exec:\frfrllf.exe45⤵
- Executes dropped EXE
PID:4944 -
\??\c:\hntthb.exec:\hntthb.exe46⤵
- Executes dropped EXE
PID:1620 -
\??\c:\djvvp.exec:\djvvp.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\rlflxfx.exec:\rlflxfx.exe48⤵
- Executes dropped EXE
PID:3892 -
\??\c:\tthhtt.exec:\tthhtt.exe49⤵
- Executes dropped EXE
PID:3952 -
\??\c:\hbnhtt.exec:\hbnhtt.exe50⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rllfxlf.exec:\rllfxlf.exe51⤵
- Executes dropped EXE
PID:3848 -
\??\c:\hntnnh.exec:\hntnnh.exe52⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdjjv.exec:\jdjjv.exe53⤵
- Executes dropped EXE
PID:3104 -
\??\c:\vjjdp.exec:\vjjdp.exe54⤵
- Executes dropped EXE
PID:432 -
\??\c:\tttnht.exec:\tttnht.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hbtnhb.exec:\hbtnhb.exe56⤵
- Executes dropped EXE
PID:4428 -
\??\c:\1ppvp.exec:\1ppvp.exe57⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jdvpj.exec:\jdvpj.exe58⤵
- Executes dropped EXE
PID:1464 -
\??\c:\httnnh.exec:\httnnh.exe59⤵
- Executes dropped EXE
PID:3652 -
\??\c:\jddvv.exec:\jddvv.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712 -
\??\c:\vvdvv.exec:\vvdvv.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\5lllfxr.exec:\5lllfxr.exe62⤵
- Executes dropped EXE
PID:1496 -
\??\c:\ntnhbh.exec:\ntnhbh.exe63⤵
- Executes dropped EXE
PID:3524 -
\??\c:\djjjp.exec:\djjjp.exe64⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1xfxxxx.exec:\1xfxxxx.exe65⤵
- Executes dropped EXE
PID:3532 -
\??\c:\rffxxxr.exec:\rffxxxr.exe66⤵PID:1364
-
\??\c:\hhbbbb.exec:\hhbbbb.exe67⤵PID:1900
-
\??\c:\djvvv.exec:\djvvv.exe68⤵PID:4748
-
\??\c:\xfllflf.exec:\xfllflf.exe69⤵PID:2332
-
\??\c:\9nhbbb.exec:\9nhbbb.exe70⤵PID:2460
-
\??\c:\bnhbtt.exec:\bnhbtt.exe71⤵PID:3096
-
\??\c:\vvvjd.exec:\vvvjd.exe72⤵PID:3768
-
\??\c:\rrxrxxx.exec:\rrxrxxx.exe73⤵PID:4624
-
\??\c:\frrxrlf.exec:\frrxrlf.exe74⤵PID:4516
-
\??\c:\tbtbtn.exec:\tbtbtn.exe75⤵PID:2288
-
\??\c:\dddvj.exec:\dddvj.exe76⤵PID:4212
-
\??\c:\jpjjv.exec:\jpjjv.exe77⤵PID:3596
-
\??\c:\flfxlll.exec:\flfxlll.exe78⤵PID:5108
-
\??\c:\bhnbtt.exec:\bhnbtt.exe79⤵PID:2388
-
\??\c:\nhbhht.exec:\nhbhht.exe80⤵
- System Location Discovery: System Language Discovery
PID:4728 -
\??\c:\vjpjv.exec:\vjpjv.exe81⤵PID:4676
-
\??\c:\1nnhhb.exec:\1nnhhb.exe82⤵PID:3828
-
\??\c:\hntnhh.exec:\hntnhh.exe83⤵PID:3308
-
\??\c:\jdpjd.exec:\jdpjd.exe84⤵PID:3804
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe85⤵PID:4868
-
\??\c:\9hnnnn.exec:\9hnnnn.exe86⤵PID:540
-
\??\c:\nbnnhb.exec:\nbnnhb.exe87⤵PID:3464
-
\??\c:\pjpjd.exec:\pjpjd.exe88⤵PID:3092
-
\??\c:\rfllfff.exec:\rfllfff.exe89⤵PID:4836
-
\??\c:\htthbt.exec:\htthbt.exe90⤵PID:2316
-
\??\c:\ntbnhb.exec:\ntbnhb.exe91⤵PID:2532
-
\??\c:\pdddv.exec:\pdddv.exe92⤵PID:3396
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe93⤵PID:2880
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe94⤵PID:3424
-
\??\c:\ntbbbb.exec:\ntbbbb.exe95⤵PID:4052
-
\??\c:\vpvvj.exec:\vpvvj.exe96⤵PID:4736
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe97⤵PID:364
-
\??\c:\xrrlfff.exec:\xrrlfff.exe98⤵PID:448
-
\??\c:\bbbbbb.exec:\bbbbbb.exe99⤵PID:5024
-
\??\c:\ddjdd.exec:\ddjdd.exe100⤵PID:2396
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe101⤵PID:4628
-
\??\c:\llrfxrf.exec:\llrfxrf.exe102⤵PID:3944
-
\??\c:\nttntt.exec:\nttntt.exe103⤵PID:2684
-
\??\c:\pdpjv.exec:\pdpjv.exe104⤵
- System Location Discovery: System Language Discovery
PID:4544 -
\??\c:\llflffx.exec:\llflffx.exe105⤵PID:4388
-
\??\c:\nnbbtb.exec:\nnbbtb.exe106⤵PID:2732
-
\??\c:\ttbtnh.exec:\ttbtnh.exe107⤵PID:2820
-
\??\c:\jvjjv.exec:\jvjjv.exe108⤵PID:1004
-
\??\c:\vddpj.exec:\vddpj.exe109⤵PID:1368
-
\??\c:\lffxrrl.exec:\lffxrrl.exe110⤵PID:1968
-
\??\c:\nhbthh.exec:\nhbthh.exe111⤵PID:2472
-
\??\c:\jdjvp.exec:\jdjvp.exe112⤵PID:2700
-
\??\c:\rffrfxr.exec:\rffrfxr.exe113⤵PID:3300
-
\??\c:\xlrrllr.exec:\xlrrllr.exe114⤵PID:1184
-
\??\c:\ttbtnt.exec:\ttbtnt.exe115⤵PID:3260
-
\??\c:\jjpjd.exec:\jjpjd.exe116⤵PID:4876
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe117⤵PID:4532
-
\??\c:\ffrlllf.exec:\ffrlllf.exe118⤵PID:1048
-
\??\c:\bnbbhh.exec:\bnbbhh.exe119⤵PID:852
-
\??\c:\bhtnhh.exec:\bhtnhh.exe120⤵PID:3908
-
\??\c:\vdppd.exec:\vdppd.exe121⤵PID:3296
-
\??\c:\rffxrrl.exec:\rffxrrl.exe122⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-