Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 11:07
Behavioral task
behavioral1
Sample
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
Resource
win7-20240903-en
General
-
Target
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
-
Size
79KB
-
MD5
db4d557f0966cb63b3f5e13b5c5b80bd
-
SHA1
4147b743c1503eafa8bfc539323d82980d568078
-
SHA256
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165
-
SHA512
1606ac94b7a0ba40a53efb35b258f6ba0fcee09fa1f0f4c8435758567283e740e73787c447c6cfeb35f217db3dadef3e45eefce99f4edcb0e7e8cbd736efe735
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2t:xhOmTsF93UYfwC6GIout03LzGFO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5092-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-574-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-739-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-797-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-864-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-940-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-1302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-1314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-1330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-1358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2068 rrfrflx.exe 2316 hhhbtn.exe 3880 ppvvv.exe 3516 fxrxrxf.exe 3396 fxlfffl.exe 3500 bbthnb.exe 2988 nbnhnt.exe 4288 pdvjj.exe 2020 vpvvv.exe 4628 rrxxrlr.exe 3636 3jjjj.exe 4260 jjpvv.exe 3484 rlllxff.exe 2168 bbbttb.exe 2244 vvppd.exe 2748 ddvdv.exe 4900 xrfxfrx.exe 3820 btnnnn.exe 440 pdjdp.exe 3904 pjjvd.exe 3264 lffffll.exe 2232 hbtnhn.exe 1176 1vjjj.exe 4172 rfrrllf.exe 4688 ffrrrfl.exe 1580 ttnttt.exe 4364 vvvdj.exe 3868 pvvvv.exe 868 7xfxrrl.exe 1168 3bbthb.exe 3608 vppdv.exe 4668 7dddj.exe 3816 lfxlfrl.exe 884 9thhbn.exe 1072 pjppp.exe 1936 jdjjd.exe 1180 rlrrlxr.exe 700 nbhhhn.exe 4140 pjppj.exe 1844 ddddv.exe 1660 xfllfff.exe 4292 flllfff.exe 1924 thtnhh.exe 3452 jpvjd.exe 2332 ffrflxl.exe 3616 5vvpd.exe 4024 rfrffrr.exe 4740 9thnnn.exe 4984 hhnnnb.exe 1592 vppjd.exe 1424 1rflflf.exe 1652 vvvvv.exe 4564 vdddv.exe 4288 lxfflrl.exe 1672 bhnnbh.exe 2020 tnhnhn.exe 3976 vvvvv.exe 3708 tbnnhh.exe 3968 dvdvp.exe 3636 lxlllrr.exe 4260 btbtnt.exe 3484 3vdjj.exe 1420 xfxlrrl.exe 1720 7ttttb.exe -
resource yara_rule behavioral2/memory/5092-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b1f-3.dat upx behavioral2/memory/5092-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2068-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b73-11.dat upx behavioral2/files/0x000a000000023b74-13.dat upx behavioral2/memory/2316-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3880-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3516-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b75-21.dat upx behavioral2/files/0x0031000000023b76-29.dat upx behavioral2/files/0x0031000000023b77-35.dat upx behavioral2/memory/3396-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3516-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-41.dat upx behavioral2/memory/3500-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-47.dat upx behavioral2/memory/2988-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-53.dat upx behavioral2/files/0x000a000000023b7b-57.dat upx behavioral2/memory/2020-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7c-63.dat upx behavioral2/memory/4628-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-69.dat upx behavioral2/memory/3636-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-75.dat upx behavioral2/memory/4260-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-81.dat upx behavioral2/memory/3484-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b80-86.dat upx behavioral2/memory/2168-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-92.dat upx behavioral2/memory/2244-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-100.dat upx behavioral2/files/0x000a000000023b83-103.dat upx behavioral2/memory/4900-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b84-109.dat upx behavioral2/files/0x000a000000023b85-114.dat upx behavioral2/memory/440-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3904-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b86-121.dat upx behavioral2/files/0x000a000000023b87-125.dat upx behavioral2/memory/3264-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b88-131.dat upx behavioral2/memory/1176-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-136.dat upx behavioral2/files/0x000a000000023b8b-144.dat upx behavioral2/memory/4172-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-150.dat upx behavioral2/files/0x000a000000023b8d-153.dat upx behavioral2/files/0x000a000000023b8e-159.dat upx behavioral2/memory/1580-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4364-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b70-166.dat upx behavioral2/memory/3868-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/868-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-173.dat upx behavioral2/memory/1168-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-186.dat upx behavioral2/files/0x000a000000023b90-181.dat upx behavioral2/memory/868-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/884-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1180-207-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 2068 5092 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 5092 wrote to memory of 2068 5092 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 5092 wrote to memory of 2068 5092 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 2068 wrote to memory of 2316 2068 rrfrflx.exe 84 PID 2068 wrote to memory of 2316 2068 rrfrflx.exe 84 PID 2068 wrote to memory of 2316 2068 rrfrflx.exe 84 PID 2316 wrote to memory of 3880 2316 hhhbtn.exe 85 PID 2316 wrote to memory of 3880 2316 hhhbtn.exe 85 PID 2316 wrote to memory of 3880 2316 hhhbtn.exe 85 PID 3880 wrote to memory of 3516 3880 ppvvv.exe 86 PID 3880 wrote to memory of 3516 3880 ppvvv.exe 86 PID 3880 wrote to memory of 3516 3880 ppvvv.exe 86 PID 3516 wrote to memory of 3396 3516 fxrxrxf.exe 87 PID 3516 wrote to memory of 3396 3516 fxrxrxf.exe 87 PID 3516 wrote to memory of 3396 3516 fxrxrxf.exe 87 PID 3396 wrote to memory of 3500 3396 fxlfffl.exe 88 PID 3396 wrote to memory of 3500 3396 fxlfffl.exe 88 PID 3396 wrote to memory of 3500 3396 fxlfffl.exe 88 PID 3500 wrote to memory of 2988 3500 bbthnb.exe 89 PID 3500 wrote to memory of 2988 3500 bbthnb.exe 89 PID 3500 wrote to memory of 2988 3500 bbthnb.exe 89 PID 2988 wrote to memory of 4288 2988 nbnhnt.exe 90 PID 2988 wrote to memory of 4288 2988 nbnhnt.exe 90 PID 2988 wrote to memory of 4288 2988 nbnhnt.exe 90 PID 4288 wrote to memory of 2020 4288 pdvjj.exe 91 PID 4288 wrote to memory of 2020 4288 pdvjj.exe 91 PID 4288 wrote to memory of 2020 4288 pdvjj.exe 91 PID 2020 wrote to memory of 4628 2020 vpvvv.exe 92 PID 2020 wrote to memory of 4628 2020 vpvvv.exe 92 PID 2020 wrote to memory of 4628 2020 vpvvv.exe 92 PID 4628 wrote to memory of 3636 4628 rrxxrlr.exe 93 PID 4628 wrote to memory of 3636 4628 rrxxrlr.exe 93 PID 4628 wrote to memory of 3636 4628 rrxxrlr.exe 93 PID 3636 wrote to memory of 4260 3636 3jjjj.exe 94 PID 3636 wrote to memory of 4260 3636 3jjjj.exe 94 PID 3636 wrote to memory of 4260 3636 3jjjj.exe 94 PID 4260 wrote to memory of 3484 4260 jjpvv.exe 95 PID 4260 wrote to memory of 3484 4260 jjpvv.exe 95 PID 4260 wrote to memory of 3484 4260 jjpvv.exe 95 PID 3484 wrote to memory of 2168 3484 rlllxff.exe 96 PID 3484 wrote to memory of 2168 3484 rlllxff.exe 96 PID 3484 wrote to memory of 2168 3484 rlllxff.exe 96 PID 2168 wrote to memory of 2244 2168 bbbttb.exe 97 PID 2168 wrote to memory of 2244 2168 bbbttb.exe 97 PID 2168 wrote to memory of 2244 2168 bbbttb.exe 97 PID 2244 wrote to memory of 2748 2244 vvppd.exe 98 PID 2244 wrote to memory of 2748 2244 vvppd.exe 98 PID 2244 wrote to memory of 2748 2244 vvppd.exe 98 PID 2748 wrote to memory of 4900 2748 ddvdv.exe 99 PID 2748 wrote to memory of 4900 2748 ddvdv.exe 99 PID 2748 wrote to memory of 4900 2748 ddvdv.exe 99 PID 4900 wrote to memory of 3820 4900 xrfxfrx.exe 100 PID 4900 wrote to memory of 3820 4900 xrfxfrx.exe 100 PID 4900 wrote to memory of 3820 4900 xrfxfrx.exe 100 PID 3820 wrote to memory of 440 3820 btnnnn.exe 101 PID 3820 wrote to memory of 440 3820 btnnnn.exe 101 PID 3820 wrote to memory of 440 3820 btnnnn.exe 101 PID 440 wrote to memory of 3904 440 pdjdp.exe 102 PID 440 wrote to memory of 3904 440 pdjdp.exe 102 PID 440 wrote to memory of 3904 440 pdjdp.exe 102 PID 3904 wrote to memory of 3264 3904 pjjvd.exe 103 PID 3904 wrote to memory of 3264 3904 pjjvd.exe 103 PID 3904 wrote to memory of 3264 3904 pjjvd.exe 103 PID 3264 wrote to memory of 2232 3264 lffffll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\rrfrflx.exec:\rrfrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\hhhbtn.exec:\hhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\ppvvv.exec:\ppvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\fxrxrxf.exec:\fxrxrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\fxlfffl.exec:\fxlfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\bbthnb.exec:\bbthnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\nbnhnt.exec:\nbnhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\pdvjj.exec:\pdvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\vpvvv.exec:\vpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\rrxxrlr.exec:\rrxxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\3jjjj.exec:\3jjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\jjpvv.exec:\jjpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\rlllxff.exec:\rlllxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\bbbttb.exec:\bbbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\vvppd.exec:\vvppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\ddvdv.exec:\ddvdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrfxfrx.exec:\xrfxfrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\btnnnn.exec:\btnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\pdjdp.exec:\pdjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\pjjvd.exec:\pjjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\lffffll.exec:\lffffll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\hbtnhn.exec:\hbtnhn.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1vjjj.exec:\1vjjj.exe24⤵
- Executes dropped EXE
PID:1176 -
\??\c:\rfrrllf.exec:\rfrrllf.exe25⤵
- Executes dropped EXE
PID:4172 -
\??\c:\ffrrrfl.exec:\ffrrrfl.exe26⤵
- Executes dropped EXE
PID:4688 -
\??\c:\ttnttt.exec:\ttnttt.exe27⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vvvdj.exec:\vvvdj.exe28⤵
- Executes dropped EXE
PID:4364 -
\??\c:\pvvvv.exec:\pvvvv.exe29⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7xfxrrl.exec:\7xfxrrl.exe30⤵
- Executes dropped EXE
PID:868 -
\??\c:\3bbthb.exec:\3bbthb.exe31⤵
- Executes dropped EXE
PID:1168 -
\??\c:\vppdv.exec:\vppdv.exe32⤵
- Executes dropped EXE
PID:3608 -
\??\c:\7dddj.exec:\7dddj.exe33⤵
- Executes dropped EXE
PID:4668 -
\??\c:\lfxlfrl.exec:\lfxlfrl.exe34⤵
- Executes dropped EXE
PID:3816 -
\??\c:\9thhbn.exec:\9thhbn.exe35⤵
- Executes dropped EXE
PID:884 -
\??\c:\pjppp.exec:\pjppp.exe36⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jdjjd.exec:\jdjjd.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rlrrlxr.exec:\rlrrlxr.exe38⤵
- Executes dropped EXE
PID:1180 -
\??\c:\nbhhhn.exec:\nbhhhn.exe39⤵
- Executes dropped EXE
PID:700 -
\??\c:\pjppj.exec:\pjppj.exe40⤵
- Executes dropped EXE
PID:4140 -
\??\c:\ddddv.exec:\ddddv.exe41⤵
- Executes dropped EXE
PID:1844 -
\??\c:\xfllfff.exec:\xfllfff.exe42⤵
- Executes dropped EXE
PID:1660 -
\??\c:\flllfff.exec:\flllfff.exe43⤵
- Executes dropped EXE
PID:4292 -
\??\c:\thtnhh.exec:\thtnhh.exe44⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jpvjd.exec:\jpvjd.exe45⤵
- Executes dropped EXE
PID:3452 -
\??\c:\ffrflxl.exec:\ffrflxl.exe46⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5vvpd.exec:\5vvpd.exe47⤵
- Executes dropped EXE
PID:3616 -
\??\c:\rfrffrr.exec:\rfrffrr.exe48⤵
- Executes dropped EXE
PID:4024 -
\??\c:\9thnnn.exec:\9thnnn.exe49⤵
- Executes dropped EXE
PID:4740 -
\??\c:\hhnnnb.exec:\hhnnnb.exe50⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vppjd.exec:\vppjd.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\1rflflf.exec:\1rflflf.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vvvvv.exec:\vvvvv.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vdddv.exec:\vdddv.exe54⤵
- Executes dropped EXE
PID:4564 -
\??\c:\lxfflrl.exec:\lxfflrl.exe55⤵
- Executes dropped EXE
PID:4288 -
\??\c:\bhnnbh.exec:\bhnnbh.exe56⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tnhnhn.exec:\tnhnhn.exe57⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvvvv.exec:\vvvvv.exe58⤵
- Executes dropped EXE
PID:3976 -
\??\c:\tbnnhh.exec:\tbnnhh.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\dvdvp.exec:\dvdvp.exe60⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lxlllrr.exec:\lxlllrr.exe61⤵
- Executes dropped EXE
PID:3636 -
\??\c:\btbtnt.exec:\btbtnt.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4260 -
\??\c:\3vdjj.exec:\3vdjj.exe63⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xfxlrrl.exec:\xfxlrrl.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1420 -
\??\c:\7ttttb.exec:\7ttttb.exe65⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjpjd.exec:\jjpjd.exe66⤵PID:2208
-
\??\c:\lrrxxxr.exec:\lrrxxxr.exe67⤵PID:4500
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe68⤵PID:2628
-
\??\c:\bbnnnt.exec:\bbnnnt.exe69⤵PID:4300
-
\??\c:\vdjjv.exec:\vdjjv.exe70⤵PID:4532
-
\??\c:\vvjjv.exec:\vvjjv.exe71⤵PID:4128
-
\??\c:\fxffrxr.exec:\fxffrxr.exe72⤵PID:4324
-
\??\c:\hhhhbb.exec:\hhhhbb.exe73⤵PID:5056
-
\??\c:\nntnnn.exec:\nntnnn.exe74⤵PID:3624
-
\??\c:\ddppj.exec:\ddppj.exe75⤵PID:1496
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe76⤵PID:4688
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe77⤵PID:1100
-
\??\c:\htnbht.exec:\htnbht.exe78⤵PID:1020
-
\??\c:\1vvvp.exec:\1vvvp.exe79⤵PID:940
-
\??\c:\vdddv.exec:\vdddv.exe80⤵PID:4448
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe81⤵PID:4908
-
\??\c:\3ntnnt.exec:\3ntnnt.exe82⤵PID:4792
-
\??\c:\dvvvj.exec:\dvvvj.exe83⤵PID:4992
-
\??\c:\frrxrxr.exec:\frrxrxr.exe84⤵PID:4656
-
\??\c:\9lfxflx.exec:\9lfxflx.exe85⤵PID:3748
-
\??\c:\hbbbtt.exec:\hbbbtt.exe86⤵PID:4668
-
\??\c:\hbbbtt.exec:\hbbbtt.exe87⤵PID:3816
-
\??\c:\1vjpp.exec:\1vjpp.exe88⤵PID:2368
-
\??\c:\lfrrfff.exec:\lfrrfff.exe89⤵PID:2864
-
\??\c:\1htttt.exec:\1htttt.exe90⤵PID:1968
-
\??\c:\ddjdd.exec:\ddjdd.exe91⤵PID:4224
-
\??\c:\vjppp.exec:\vjppp.exe92⤵PID:5096
-
\??\c:\lffxffr.exec:\lffxffr.exe93⤵PID:5088
-
\??\c:\bntbtb.exec:\bntbtb.exe94⤵PID:2600
-
\??\c:\bbbhnt.exec:\bbbhnt.exe95⤵PID:220
-
\??\c:\jjjjd.exec:\jjjjd.exe96⤵PID:652
-
\??\c:\rrffxxr.exec:\rrffxxr.exe97⤵PID:4856
-
\??\c:\lrrfrrf.exec:\lrrfrrf.exe98⤵PID:1144
-
\??\c:\hhhnth.exec:\hhhnth.exe99⤵PID:1296
-
\??\c:\9jpvp.exec:\9jpvp.exe100⤵PID:4080
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe101⤵PID:3804
-
\??\c:\bbttnt.exec:\bbttnt.exe102⤵PID:3396
-
\??\c:\7bnhhn.exec:\7bnhhn.exe103⤵PID:4740
-
\??\c:\3jjdd.exec:\3jjdd.exe104⤵PID:400
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe105⤵PID:1592
-
\??\c:\hthhhh.exec:\hthhhh.exe106⤵PID:1424
-
\??\c:\thnnhn.exec:\thnnhn.exe107⤵PID:2988
-
\??\c:\pddjj.exec:\pddjj.exe108⤵PID:3168
-
\??\c:\7vvvp.exec:\7vvvp.exe109⤵PID:4288
-
\??\c:\frxrlrr.exec:\frxrlrr.exe110⤵PID:1672
-
\??\c:\tntttb.exec:\tntttb.exe111⤵PID:2020
-
\??\c:\ppdjv.exec:\ppdjv.exe112⤵PID:4628
-
\??\c:\1djpd.exec:\1djpd.exe113⤵PID:548
-
\??\c:\rxllfff.exec:\rxllfff.exe114⤵PID:4180
-
\??\c:\tbnhbb.exec:\tbnhbb.exe115⤵PID:4040
-
\??\c:\ttbbnt.exec:\ttbbnt.exe116⤵PID:4352
-
\??\c:\vjdvp.exec:\vjdvp.exe117⤵PID:1300
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe118⤵PID:4120
-
\??\c:\hhttth.exec:\hhttth.exe119⤵PID:3508
-
\??\c:\hhtthn.exec:\hhtthn.exe120⤵PID:1696
-
\??\c:\3jpjd.exec:\3jpjd.exe121⤵PID:4540
-
\??\c:\5rxxxff.exec:\5rxxxff.exe122⤵PID:3132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-