Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe
Resource
win7-20241010-en
General
-
Target
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe
-
Size
453KB
-
MD5
4857419cbae4840067ea9949bdeee290
-
SHA1
a78a1070e6d923b451daecdc8b1558c463f1930d
-
SHA256
b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9ef
-
SHA512
4a4dc9bf7b2e77e5eff606e6c96dae02191e288409bd9613f955abe8ddbe9af5757ca71e6c79ed4c5292c9d26cd8547baa851ffcca8fd2df115368fee0d87cb4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4516-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3776-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2172-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3020-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2460-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3728-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/324-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4064-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1480-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1112-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-1076-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2092-1918-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3780 thhttt.exe 4364 bnhhhn.exe 3304 vdpdp.exe 2804 fxxxlrr.exe 5064 hhnntn.exe 244 hthbbb.exe 4952 pjpjv.exe 2232 hbnnhn.exe 1292 dvdvv.exe 1252 lflrxxf.exe 4740 fxrfxlf.exe 1692 htbbbb.exe 3572 jjpjd.exe 2688 hhbbnt.exe 4876 nttttt.exe 3776 3dvdd.exe 3752 rlffxxl.exe 4196 xxrrlff.exe 4820 3ffrxfl.exe 2172 ddvvv.exe 3292 rrxlfrl.exe 4460 vpdjv.exe 2592 fxxlrlr.exe 648 bbhnbn.exe 3020 djpvv.exe 2696 lxxxrff.exe 2052 1ntnhn.exe 2944 7djjd.exe 2884 jjdjp.exe 2516 rlxflrx.exe 3980 xflffff.exe 956 thhbbb.exe 920 3xxrxxf.exe 1852 frlrxlr.exe 3156 ddppv.exe 3792 fflllrl.exe 3348 pdjdd.exe 1392 lrlllxf.exe 1224 djjvj.exe 2224 lfrrlfl.exe 2244 9hnnnt.exe 4844 flfxfll.exe 4204 3thbnb.exe 4612 jvpdv.exe 2968 7rffxfr.exe 2340 7bnnnt.exe 3512 dvddj.exe 3716 jdjpv.exe 3000 flrrrrx.exe 2964 thbtnh.exe 4224 dvdjd.exe 1236 xfrfxrx.exe 924 tnnttt.exe 2984 1vdjj.exe 1816 fxlllrx.exe 1292 nnhhhn.exe 2568 jppvp.exe 4544 3flrflr.exe 4740 bbhnnt.exe 2228 jjvvv.exe 4624 djvdd.exe 1860 rrxxfff.exe 4864 thtttt.exe 4824 xxlrrrl.exe -
resource yara_rule behavioral2/memory/4516-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2172-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3020-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2964-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2460-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4196-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3728-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/324-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4064-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1480-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1112-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-824-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4516 wrote to memory of 3780 4516 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 83 PID 4516 wrote to memory of 3780 4516 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 83 PID 4516 wrote to memory of 3780 4516 b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe 83 PID 3780 wrote to memory of 4364 3780 thhttt.exe 84 PID 3780 wrote to memory of 4364 3780 thhttt.exe 84 PID 3780 wrote to memory of 4364 3780 thhttt.exe 84 PID 4364 wrote to memory of 3304 4364 bnhhhn.exe 85 PID 4364 wrote to memory of 3304 4364 bnhhhn.exe 85 PID 4364 wrote to memory of 3304 4364 bnhhhn.exe 85 PID 3304 wrote to memory of 2804 3304 vdpdp.exe 86 PID 3304 wrote to memory of 2804 3304 vdpdp.exe 86 PID 3304 wrote to memory of 2804 3304 vdpdp.exe 86 PID 2804 wrote to memory of 5064 2804 fxxxlrr.exe 87 PID 2804 wrote to memory of 5064 2804 fxxxlrr.exe 87 PID 2804 wrote to memory of 5064 2804 fxxxlrr.exe 87 PID 5064 wrote to memory of 244 5064 hhnntn.exe 88 PID 5064 wrote to memory of 244 5064 hhnntn.exe 88 PID 5064 wrote to memory of 244 5064 hhnntn.exe 88 PID 244 wrote to memory of 4952 244 hthbbb.exe 89 PID 244 wrote to memory of 4952 244 hthbbb.exe 89 PID 244 wrote to memory of 4952 244 hthbbb.exe 89 PID 4952 wrote to memory of 2232 4952 pjpjv.exe 90 PID 4952 wrote to memory of 2232 4952 pjpjv.exe 90 PID 4952 wrote to memory of 2232 4952 pjpjv.exe 90 PID 2232 wrote to memory of 1292 2232 hbnnhn.exe 91 PID 2232 wrote to memory of 1292 2232 hbnnhn.exe 91 PID 2232 wrote to memory of 1292 2232 hbnnhn.exe 91 PID 1292 wrote to memory of 1252 1292 dvdvv.exe 92 PID 1292 wrote to memory of 1252 1292 dvdvv.exe 92 PID 1292 wrote to memory of 1252 1292 dvdvv.exe 92 PID 1252 wrote to memory of 4740 1252 lflrxxf.exe 93 PID 1252 wrote to memory of 4740 1252 lflrxxf.exe 93 PID 1252 wrote to memory of 4740 1252 lflrxxf.exe 93 PID 4740 wrote to memory of 1692 4740 fxrfxlf.exe 94 PID 4740 wrote to memory of 1692 4740 fxrfxlf.exe 94 PID 4740 wrote to memory of 1692 4740 fxrfxlf.exe 94 PID 1692 wrote to memory of 3572 1692 htbbbb.exe 95 PID 1692 wrote to memory of 3572 1692 htbbbb.exe 95 PID 1692 wrote to memory of 3572 1692 htbbbb.exe 95 PID 3572 wrote to memory of 2688 3572 jjpjd.exe 96 PID 3572 wrote to memory of 2688 3572 jjpjd.exe 96 PID 3572 wrote to memory of 2688 3572 jjpjd.exe 96 PID 2688 wrote to memory of 4876 2688 hhbbnt.exe 97 PID 2688 wrote to memory of 4876 2688 hhbbnt.exe 97 PID 2688 wrote to memory of 4876 2688 hhbbnt.exe 97 PID 4876 wrote to memory of 3776 4876 nttttt.exe 98 PID 4876 wrote to memory of 3776 4876 nttttt.exe 98 PID 4876 wrote to memory of 3776 4876 nttttt.exe 98 PID 3776 wrote to memory of 3752 3776 3dvdd.exe 99 PID 3776 wrote to memory of 3752 3776 3dvdd.exe 99 PID 3776 wrote to memory of 3752 3776 3dvdd.exe 99 PID 3752 wrote to memory of 4196 3752 rlffxxl.exe 100 PID 3752 wrote to memory of 4196 3752 rlffxxl.exe 100 PID 3752 wrote to memory of 4196 3752 rlffxxl.exe 100 PID 4196 wrote to memory of 4820 4196 xxrrlff.exe 101 PID 4196 wrote to memory of 4820 4196 xxrrlff.exe 101 PID 4196 wrote to memory of 4820 4196 xxrrlff.exe 101 PID 4820 wrote to memory of 2172 4820 3ffrxfl.exe 102 PID 4820 wrote to memory of 2172 4820 3ffrxfl.exe 102 PID 4820 wrote to memory of 2172 4820 3ffrxfl.exe 102 PID 2172 wrote to memory of 3292 2172 ddvvv.exe 103 PID 2172 wrote to memory of 3292 2172 ddvvv.exe 103 PID 2172 wrote to memory of 3292 2172 ddvvv.exe 103 PID 3292 wrote to memory of 4460 3292 rrxlfrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe"C:\Users\Admin\AppData\Local\Temp\b025947833ea07e51b37b20cb909f8bea25c680a09cebe89fcc69bb8ea34c9efN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\thhttt.exec:\thhttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\bnhhhn.exec:\bnhhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\vdpdp.exec:\vdpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\fxxxlrr.exec:\fxxxlrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hhnntn.exec:\hhnntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\hthbbb.exec:\hthbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:244 -
\??\c:\pjpjv.exec:\pjpjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbnnhn.exec:\hbnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvdvv.exec:\dvdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\lflrxxf.exec:\lflrxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\fxrfxlf.exec:\fxrfxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\htbbbb.exec:\htbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\jjpjd.exec:\jjpjd.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hhbbnt.exec:\hhbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\nttttt.exec:\nttttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\3dvdd.exec:\3dvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\rlffxxl.exec:\rlffxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\xxrrlff.exec:\xxrrlff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\3ffrxfl.exec:\3ffrxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\ddvvv.exec:\ddvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rrxlfrl.exec:\rrxlfrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\vpdjv.exec:\vpdjv.exe23⤵
- Executes dropped EXE
PID:4460 -
\??\c:\fxxlrlr.exec:\fxxlrlr.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bbhnbn.exec:\bbhnbn.exe25⤵
- Executes dropped EXE
PID:648 -
\??\c:\djpvv.exec:\djpvv.exe26⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lxxxrff.exec:\lxxxrff.exe27⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1ntnhn.exec:\1ntnhn.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7djjd.exec:\7djjd.exe29⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jjdjp.exec:\jjdjp.exe30⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rlxflrx.exec:\rlxflrx.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xflffff.exec:\xflffff.exe32⤵
- Executes dropped EXE
PID:3980 -
\??\c:\thhbbb.exec:\thhbbb.exe33⤵
- Executes dropped EXE
PID:956 -
\??\c:\3xxrxxf.exec:\3xxrxxf.exe34⤵
- Executes dropped EXE
PID:920 -
\??\c:\frlrxlr.exec:\frlrxlr.exe35⤵
- Executes dropped EXE
PID:1852 -
\??\c:\ddppv.exec:\ddppv.exe36⤵
- Executes dropped EXE
PID:3156 -
\??\c:\fflllrl.exec:\fflllrl.exe37⤵
- Executes dropped EXE
PID:3792 -
\??\c:\pdjdd.exec:\pdjdd.exe38⤵
- Executes dropped EXE
PID:3348 -
\??\c:\lrlllxf.exec:\lrlllxf.exe39⤵
- Executes dropped EXE
PID:1392 -
\??\c:\djjvj.exec:\djjvj.exe40⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lfrrlfl.exec:\lfrrlfl.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9hnnnt.exec:\9hnnnt.exe42⤵
- Executes dropped EXE
PID:2244 -
\??\c:\flfxfll.exec:\flfxfll.exe43⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3thbnb.exec:\3thbnb.exe44⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jvpdv.exec:\jvpdv.exe45⤵
- Executes dropped EXE
PID:4612 -
\??\c:\7rffxfr.exec:\7rffxfr.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7bnnnt.exec:\7bnnnt.exe47⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvddj.exec:\dvddj.exe48⤵
- Executes dropped EXE
PID:3512 -
\??\c:\jdjpv.exec:\jdjpv.exe49⤵
- Executes dropped EXE
PID:3716 -
\??\c:\flrrrrx.exec:\flrrrrx.exe50⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thbtnh.exec:\thbtnh.exe51⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvdjd.exec:\dvdjd.exe52⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xfrfxrx.exec:\xfrfxrx.exe53⤵
- Executes dropped EXE
PID:1236 -
\??\c:\tnnttt.exec:\tnnttt.exe54⤵
- Executes dropped EXE
PID:924 -
\??\c:\1vdjj.exec:\1vdjj.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\fxlllrx.exec:\fxlllrx.exe56⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nnhhhn.exec:\nnhhhn.exe57⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jppvp.exec:\jppvp.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3flrflr.exec:\3flrflr.exe59⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bbhnnt.exec:\bbhnnt.exe60⤵
- Executes dropped EXE
PID:4740 -
\??\c:\jjvvv.exec:\jjvvv.exe61⤵
- Executes dropped EXE
PID:2228 -
\??\c:\djvdd.exec:\djvdd.exe62⤵
- Executes dropped EXE
PID:4624 -
\??\c:\rrxxfff.exec:\rrxxfff.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\thtttt.exec:\thtttt.exe64⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xxlrrrl.exec:\xxlrrrl.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824 -
\??\c:\flxfflr.exec:\flxfflr.exe66⤵PID:4436
-
\??\c:\nthnhh.exec:\nthnhh.exe67⤵PID:2460
-
\??\c:\rllllll.exec:\rllllll.exe68⤵PID:2208
-
\??\c:\xxffxfl.exec:\xxffxfl.exe69⤵PID:4196
-
\??\c:\pvpjd.exec:\pvpjd.exe70⤵PID:224
-
\??\c:\xfrflxx.exec:\xfrflxx.exe71⤵PID:3628
-
\??\c:\5rxffrr.exec:\5rxffrr.exe72⤵PID:1400
-
\??\c:\5bhhtb.exec:\5bhhtb.exe73⤵PID:4296
-
\??\c:\pjvvd.exec:\pjvvd.exe74⤵PID:1384
-
\??\c:\flllrfl.exec:\flllrfl.exe75⤵PID:1628
-
\??\c:\nbntnb.exec:\nbntnb.exe76⤵PID:4164
-
\??\c:\jdjjj.exec:\jdjjj.exe77⤵PID:4724
-
\??\c:\lrxflxf.exec:\lrxflxf.exe78⤵PID:344
-
\??\c:\btbbhh.exec:\btbbhh.exe79⤵PID:3968
-
\??\c:\vvjvd.exec:\vvjvd.exe80⤵PID:1952
-
\??\c:\flxlrrl.exec:\flxlrrl.exe81⤵PID:3408
-
\??\c:\llrllrl.exec:\llrllrl.exe82⤵PID:2692
-
\??\c:\hthhbh.exec:\hthhbh.exe83⤵PID:60
-
\??\c:\vvppv.exec:\vvppv.exe84⤵PID:1112
-
\??\c:\rxxfrfr.exec:\rxxfrfr.exe85⤵PID:2884
-
\??\c:\vjdpd.exec:\vjdpd.exe86⤵PID:2788
-
\??\c:\xlxrxfl.exec:\xlxrxfl.exe87⤵PID:2724
-
\??\c:\xllrrxl.exec:\xllrrxl.exe88⤵PID:2484
-
\??\c:\djvvp.exec:\djvvp.exe89⤵PID:4044
-
\??\c:\rrffffl.exec:\rrffffl.exe90⤵PID:1368
-
\??\c:\3lllrxx.exec:\3lllrxx.exe91⤵PID:2936
-
\??\c:\hnnttn.exec:\hnnttn.exe92⤵PID:3992
-
\??\c:\dvjpp.exec:\dvjpp.exe93⤵PID:3792
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe94⤵PID:1084
-
\??\c:\hntthh.exec:\hntthh.exe95⤵PID:2296
-
\??\c:\vvddd.exec:\vvddd.exe96⤵PID:5012
-
\??\c:\1fffxff.exec:\1fffxff.exe97⤵PID:4424
-
\??\c:\hbbnnh.exec:\hbbnnh.exe98⤵PID:4040
-
\??\c:\vvjpp.exec:\vvjpp.exe99⤵PID:4880
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe100⤵PID:3780
-
\??\c:\btbhbh.exec:\btbhbh.exe101⤵PID:3728
-
\??\c:\jpvdj.exec:\jpvdj.exe102⤵PID:3740
-
\??\c:\bbhttt.exec:\bbhttt.exe103⤵PID:3636
-
\??\c:\hhnnbb.exec:\hhnnbb.exe104⤵PID:3212
-
\??\c:\ddvjp.exec:\ddvjp.exe105⤵PID:4004
-
\??\c:\3fxxfll.exec:\3fxxfll.exe106⤵PID:1016
-
\??\c:\tnnbth.exec:\tnnbth.exe107⤵PID:4316
-
\??\c:\pppjp.exec:\pppjp.exe108⤵PID:1444
-
\??\c:\rfrrrxl.exec:\rfrrrxl.exe109⤵PID:2276
-
\??\c:\nhnnbh.exec:\nhnnbh.exe110⤵PID:324
-
\??\c:\dvvjv.exec:\dvvjv.exe111⤵PID:2368
-
\??\c:\9lxxlxf.exec:\9lxxlxf.exe112⤵PID:1704
-
\??\c:\tntnnt.exec:\tntnnt.exe113⤵PID:1372
-
\??\c:\3vpvp.exec:\3vpvp.exe114⤵PID:4132
-
\??\c:\lfrxxff.exec:\lfrxxff.exe115⤵PID:3424
-
\??\c:\nnbtnt.exec:\nnbtnt.exe116⤵PID:4964
-
\??\c:\1jdvv.exec:\1jdvv.exe117⤵PID:3468
-
\??\c:\5xxxxxx.exec:\5xxxxxx.exe118⤵
- System Location Discovery: System Language Discovery
PID:4788 -
\??\c:\nntnbb.exec:\nntnbb.exe119⤵PID:2684
-
\??\c:\1vdvp.exec:\1vdvp.exe120⤵PID:1064
-
\??\c:\llfxfll.exec:\llfxfll.exe121⤵PID:4876
-
\??\c:\nnthbh.exec:\nnthbh.exe122⤵PID:3244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-