Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
Resource
win7-20240903-en
General
-
Target
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe
-
Size
455KB
-
MD5
73840ae348c002e76799d16e9cb1ec38
-
SHA1
1085bb6307d1fc9c075fabfb1b279e1009813be3
-
SHA256
11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688
-
SHA512
2f0a6ede90d4cba102fb3bac83373c0d671d014ca422559ef2081f81f4a0ee1b35c715425f543190274060787cb965e161bcebffc87a56e3bbae32c87d14018b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2228-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/560-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2136-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4728-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4356-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2996-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/604-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2528-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/884-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/64-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-723-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-1395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3584 ttbbtn.exe 1984 1vdvv.exe 4984 1xrllrr.exe 860 3bhbtt.exe 3896 dpvvp.exe 3668 bhtttb.exe 4196 pjvvv.exe 1220 rlrllll.exe 560 flrrlrr.exe 3804 bbhbbh.exe 3624 7vvvv.exe 2140 lfxxrrr.exe 2528 bbtthh.exe 3044 vvppp.exe 3024 lflllll.exe 3304 nhtnbb.exe 224 dvvvp.exe 2996 frrlfff.exe 3336 nnhhhb.exe 688 dvpvd.exe 3064 vvppj.exe 1400 3bnbnn.exe 4768 hnnbnh.exe 4516 rflflxl.exe 5068 ttnhhh.exe 3400 fllxrlx.exe 2076 nhhbtn.exe 2932 dvddv.exe 1176 rffxxrr.exe 512 tnntnn.exe 1584 vpjdv.exe 2136 1llxlfx.exe 3168 7btnbt.exe 1084 9vjjp.exe 3264 ffrfxfx.exe 1876 llrfxxr.exe 1440 nhbnnb.exe 3052 jjppd.exe 3456 1rxxrrl.exe 2336 5bbttb.exe 4988 9vpvj.exe 64 jvjdj.exe 604 5flllll.exe 5112 djjdd.exe 1860 lfrlfrl.exe 4316 btbttt.exe 4728 pvvjd.exe 4048 frxrffx.exe 3940 bnhnhh.exe 864 bntnnn.exe 4976 djjdv.exe 1652 xxfxfff.exe 516 rrxrrrr.exe 4196 tbbnbt.exe 2032 ppvvp.exe 316 7jpjp.exe 3712 fxlllll.exe 2740 nntnhb.exe 464 7hnhhh.exe 1172 dvddd.exe 952 xrllllx.exe 3092 lxrrlfr.exe 3436 7bttnh.exe 3760 ddppp.exe -
resource yara_rule behavioral2/memory/2228-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/560-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2136-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4356-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3760-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2996-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/604-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2528-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/884-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/64-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1036-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-723-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2228 wrote to memory of 3584 2228 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 82 PID 2228 wrote to memory of 3584 2228 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 82 PID 2228 wrote to memory of 3584 2228 11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe 82 PID 3584 wrote to memory of 1984 3584 ttbbtn.exe 83 PID 3584 wrote to memory of 1984 3584 ttbbtn.exe 83 PID 3584 wrote to memory of 1984 3584 ttbbtn.exe 83 PID 1984 wrote to memory of 4984 1984 1vdvv.exe 84 PID 1984 wrote to memory of 4984 1984 1vdvv.exe 84 PID 1984 wrote to memory of 4984 1984 1vdvv.exe 84 PID 4984 wrote to memory of 860 4984 1xrllrr.exe 85 PID 4984 wrote to memory of 860 4984 1xrllrr.exe 85 PID 4984 wrote to memory of 860 4984 1xrllrr.exe 85 PID 860 wrote to memory of 3896 860 3bhbtt.exe 86 PID 860 wrote to memory of 3896 860 3bhbtt.exe 86 PID 860 wrote to memory of 3896 860 3bhbtt.exe 86 PID 3896 wrote to memory of 3668 3896 dpvvp.exe 87 PID 3896 wrote to memory of 3668 3896 dpvvp.exe 87 PID 3896 wrote to memory of 3668 3896 dpvvp.exe 87 PID 3668 wrote to memory of 4196 3668 bhtttb.exe 88 PID 3668 wrote to memory of 4196 3668 bhtttb.exe 88 PID 3668 wrote to memory of 4196 3668 bhtttb.exe 88 PID 4196 wrote to memory of 1220 4196 pjvvv.exe 89 PID 4196 wrote to memory of 1220 4196 pjvvv.exe 89 PID 4196 wrote to memory of 1220 4196 pjvvv.exe 89 PID 1220 wrote to memory of 560 1220 rlrllll.exe 90 PID 1220 wrote to memory of 560 1220 rlrllll.exe 90 PID 1220 wrote to memory of 560 1220 rlrllll.exe 90 PID 560 wrote to memory of 3804 560 flrrlrr.exe 91 PID 560 wrote to memory of 3804 560 flrrlrr.exe 91 PID 560 wrote to memory of 3804 560 flrrlrr.exe 91 PID 3804 wrote to memory of 3624 3804 bbhbbh.exe 92 PID 3804 wrote to memory of 3624 3804 bbhbbh.exe 92 PID 3804 wrote to memory of 3624 3804 bbhbbh.exe 92 PID 3624 wrote to memory of 2140 3624 7vvvv.exe 93 PID 3624 wrote to memory of 2140 3624 7vvvv.exe 93 PID 3624 wrote to memory of 2140 3624 7vvvv.exe 93 PID 2140 wrote to memory of 2528 2140 lfxxrrr.exe 94 PID 2140 wrote to memory of 2528 2140 lfxxrrr.exe 94 PID 2140 wrote to memory of 2528 2140 lfxxrrr.exe 94 PID 2528 wrote to memory of 3044 2528 bbtthh.exe 95 PID 2528 wrote to memory of 3044 2528 bbtthh.exe 95 PID 2528 wrote to memory of 3044 2528 bbtthh.exe 95 PID 3044 wrote to memory of 3024 3044 vvppp.exe 96 PID 3044 wrote to memory of 3024 3044 vvppp.exe 96 PID 3044 wrote to memory of 3024 3044 vvppp.exe 96 PID 3024 wrote to memory of 3304 3024 lflllll.exe 97 PID 3024 wrote to memory of 3304 3024 lflllll.exe 97 PID 3024 wrote to memory of 3304 3024 lflllll.exe 97 PID 3304 wrote to memory of 224 3304 nhtnbb.exe 98 PID 3304 wrote to memory of 224 3304 nhtnbb.exe 98 PID 3304 wrote to memory of 224 3304 nhtnbb.exe 98 PID 224 wrote to memory of 2996 224 dvvvp.exe 99 PID 224 wrote to memory of 2996 224 dvvvp.exe 99 PID 224 wrote to memory of 2996 224 dvvvp.exe 99 PID 2996 wrote to memory of 3336 2996 frrlfff.exe 100 PID 2996 wrote to memory of 3336 2996 frrlfff.exe 100 PID 2996 wrote to memory of 3336 2996 frrlfff.exe 100 PID 3336 wrote to memory of 688 3336 nnhhhb.exe 101 PID 3336 wrote to memory of 688 3336 nnhhhb.exe 101 PID 3336 wrote to memory of 688 3336 nnhhhb.exe 101 PID 688 wrote to memory of 3064 688 dvpvd.exe 102 PID 688 wrote to memory of 3064 688 dvpvd.exe 102 PID 688 wrote to memory of 3064 688 dvpvd.exe 102 PID 3064 wrote to memory of 1400 3064 vvppj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1850296080\zmstage.exeC:\Users\Admin\AppData\Local\Temp\1850296080\zmstage.exe1⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"C:\Users\Admin\AppData\Local\Temp\11a9129695ceaa7e8416397242fd42786f8857cef71cb767976d89ad273a2688.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ttbbtn.exec:\ttbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\1vdvv.exec:\1vdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\1xrllrr.exec:\1xrllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\3bhbtt.exec:\3bhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\dpvvp.exec:\dpvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\bhtttb.exec:\bhtttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\pjvvv.exec:\pjvvv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\rlrllll.exec:\rlrllll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\flrrlrr.exec:\flrrlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\bbhbbh.exec:\bbhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\7vvvv.exec:\7vvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\bbtthh.exec:\bbtthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vvppp.exec:\vvppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\lflllll.exec:\lflllll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nhtnbb.exec:\nhtnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\dvvvp.exec:\dvvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\frrlfff.exec:\frrlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\nnhhhb.exec:\nnhhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\dvpvd.exec:\dvpvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\vvppj.exec:\vvppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\3bnbnn.exec:\3bnbnn.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1400 -
\??\c:\hnnbnh.exec:\hnnbnh.exe24⤵
- Executes dropped EXE
PID:4768 -
\??\c:\rflflxl.exec:\rflflxl.exe25⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ttnhhh.exec:\ttnhhh.exe26⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fllxrlx.exec:\fllxrlx.exe27⤵
- Executes dropped EXE
PID:3400 -
\??\c:\nhhbtn.exec:\nhhbtn.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dvddv.exec:\dvddv.exe29⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rffxxrr.exec:\rffxxrr.exe30⤵
- Executes dropped EXE
PID:1176 -
\??\c:\tnntnn.exec:\tnntnn.exe31⤵
- Executes dropped EXE
PID:512 -
\??\c:\vpjdv.exec:\vpjdv.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1llxlfx.exec:\1llxlfx.exe33⤵
- Executes dropped EXE
PID:2136 -
\??\c:\7btnbt.exec:\7btnbt.exe34⤵
- Executes dropped EXE
PID:3168 -
\??\c:\9vjjp.exec:\9vjjp.exe35⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ffrfxfx.exec:\ffrfxfx.exe36⤵
- Executes dropped EXE
PID:3264 -
\??\c:\llrfxxr.exec:\llrfxxr.exe37⤵
- Executes dropped EXE
PID:1876 -
\??\c:\nhbnnb.exec:\nhbnnb.exe38⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jjppd.exec:\jjppd.exe39⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1rxxrrl.exec:\1rxxrrl.exe40⤵
- Executes dropped EXE
PID:3456 -
\??\c:\5bbttb.exec:\5bbttb.exe41⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9vpvj.exec:\9vpvj.exe42⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jvjdj.exec:\jvjdj.exe43⤵
- Executes dropped EXE
PID:64 -
\??\c:\5flllll.exec:\5flllll.exe44⤵
- Executes dropped EXE
PID:604 -
\??\c:\djjdd.exec:\djjdd.exe45⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe46⤵
- Executes dropped EXE
PID:1860 -
\??\c:\frfrxlx.exec:\frfrxlx.exe47⤵PID:1380
-
\??\c:\btbttt.exec:\btbttt.exe48⤵
- Executes dropped EXE
PID:4316 -
\??\c:\pvvjd.exec:\pvvjd.exe49⤵
- Executes dropped EXE
PID:4728 -
\??\c:\frxrffx.exec:\frxrffx.exe50⤵
- Executes dropped EXE
PID:4048 -
\??\c:\bnhnhh.exec:\bnhnhh.exe51⤵
- Executes dropped EXE
PID:3940 -
\??\c:\bntnnn.exec:\bntnnn.exe52⤵
- Executes dropped EXE
PID:864 -
\??\c:\djjdv.exec:\djjdv.exe53⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xxfxfff.exec:\xxfxfff.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\tbbnbt.exec:\tbbnbt.exe56⤵
- Executes dropped EXE
PID:4196 -
\??\c:\ppvvp.exec:\ppvvp.exe57⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7jpjp.exec:\7jpjp.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\fxlllll.exec:\fxlllll.exe59⤵
- Executes dropped EXE
PID:3712 -
\??\c:\nntnhb.exec:\nntnhb.exe60⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7hnhhh.exec:\7hnhhh.exe61⤵
- Executes dropped EXE
PID:464 -
\??\c:\dvddd.exec:\dvddd.exe62⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xrllllx.exec:\xrllllx.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\lxrrlfr.exec:\lxrrlfr.exe64⤵
- Executes dropped EXE
PID:3092 -
\??\c:\7bttnh.exec:\7bttnh.exe65⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ddppp.exec:\ddppp.exe66⤵
- Executes dropped EXE
PID:3760 -
\??\c:\9jdjd.exec:\9jdjd.exe67⤵PID:3520
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe68⤵PID:1244
-
\??\c:\nbtbtt.exec:\nbtbtt.exe69⤵PID:4356
-
\??\c:\1nhthb.exec:\1nhthb.exe70⤵PID:2132
-
\??\c:\1pjjd.exec:\1pjjd.exe71⤵PID:1156
-
\??\c:\rflffxx.exec:\rflffxx.exe72⤵PID:2996
-
\??\c:\7ffffxx.exec:\7ffffxx.exe73⤵PID:1228
-
\??\c:\nnnbnh.exec:\nnnbnh.exe74⤵
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\5jvjv.exec:\5jvjv.exe75⤵PID:2628
-
\??\c:\dvvdp.exec:\dvvdp.exe76⤵PID:2464
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe77⤵PID:4268
-
\??\c:\3hnntt.exec:\3hnntt.exe78⤵PID:884
-
\??\c:\pdvpj.exec:\pdvpj.exe79⤵PID:2060
-
\??\c:\lxfflfl.exec:\lxfflfl.exe80⤵PID:5072
-
\??\c:\bnhbtn.exec:\bnhbtn.exe81⤵PID:5068
-
\??\c:\ppdpd.exec:\ppdpd.exe82⤵PID:3620
-
\??\c:\rfllfll.exec:\rfllfll.exe83⤵PID:544
-
\??\c:\pjvvp.exec:\pjvvp.exe84⤵PID:4072
-
\??\c:\dpvjd.exec:\dpvjd.exe85⤵PID:740
-
\??\c:\lffxllf.exec:\lffxllf.exe86⤵PID:1176
-
\??\c:\7bbbtb.exec:\7bbbtb.exe87⤵PID:2564
-
\??\c:\9pvvp.exec:\9pvvp.exe88⤵PID:3352
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:3216
-
\??\c:\xrxrfff.exec:\xrxrfff.exe90⤵PID:1976
-
\??\c:\1bnnnn.exec:\1bnnnn.exe91⤵PID:3324
-
\??\c:\5tbnnn.exec:\5tbnnn.exe92⤵PID:1664
-
\??\c:\3jvvp.exec:\3jvvp.exe93⤵PID:1072
-
\??\c:\ppvpv.exec:\ppvpv.exe94⤵PID:1876
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe95⤵PID:4760
-
\??\c:\3tnhhh.exec:\3tnhhh.exe96⤵PID:3412
-
\??\c:\bbhbhh.exec:\bbhbhh.exe97⤵PID:4408
-
\??\c:\7pjvp.exec:\7pjvp.exe98⤵PID:1556
-
\??\c:\rxlfxxx.exec:\rxlfxxx.exe99⤵PID:2688
-
\??\c:\1hhbbb.exec:\1hhbbb.exe100⤵PID:2868
-
\??\c:\flxlxlf.exec:\flxlxlf.exe101⤵PID:5040
-
\??\c:\httbnh.exec:\httbnh.exe102⤵PID:64
-
\??\c:\vdjpv.exec:\vdjpv.exe103⤵PID:1912
-
\??\c:\llfxfll.exec:\llfxfll.exe104⤵PID:1708
-
\??\c:\jvvpj.exec:\jvvpj.exe105⤵PID:3240
-
\??\c:\jddjv.exec:\jddjv.exe106⤵PID:3504
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe107⤵PID:4316
-
\??\c:\nthbtt.exec:\nthbtt.exe108⤵PID:4728
-
\??\c:\1vppp.exec:\1vppp.exe109⤵PID:860
-
\??\c:\xrrfrff.exec:\xrrfrff.exe110⤵PID:3740
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe111⤵PID:864
-
\??\c:\3hbbbb.exec:\3hbbbb.exe112⤵PID:4976
-
\??\c:\1nnnnh.exec:\1nnnnh.exe113⤵PID:4068
-
\??\c:\ffxlfrf.exec:\ffxlfrf.exe114⤵PID:4528
-
\??\c:\vdjjd.exec:\vdjjd.exe115⤵PID:4392
-
\??\c:\hthbbb.exec:\hthbbb.exe116⤵PID:1604
-
\??\c:\bhtnnn.exec:\bhtnnn.exe117⤵PID:3296
-
\??\c:\3dpjj.exec:\3dpjj.exe118⤵PID:456
-
\??\c:\rlrxrfx.exec:\rlrxrfx.exe119⤵PID:2064
-
\??\c:\bbttnt.exec:\bbttnt.exe120⤵PID:1872
-
\??\c:\ddpvj.exec:\ddpvj.exe121⤵PID:888
-
\??\c:\jpdjp.exec:\jpdjp.exe122⤵PID:1900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-