Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2024, 11:16
Behavioral task
behavioral1
Sample
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
Resource
win7-20240903-en
General
-
Target
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe
-
Size
79KB
-
MD5
db4d557f0966cb63b3f5e13b5c5b80bd
-
SHA1
4147b743c1503eafa8bfc539323d82980d568078
-
SHA256
a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165
-
SHA512
1606ac94b7a0ba40a53efb35b258f6ba0fcee09fa1f0f4c8435758567283e740e73787c447c6cfeb35f217db3dadef3e45eefce99f4edcb0e7e8cbd736efe735
-
SSDEEP
1536:xvQBeOGtrYS3srx93UBWfwC6Ggnouy82F13w1rCJtzx8/p7ke2t:xhOmTsF93UYfwC6GIout03LzGFO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2352-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1996-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2536-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4956-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2716-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3524-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3768-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-629-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-739-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-783-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-855-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-991-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-1007-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4884 vvvvv.exe 4920 rfxrlrr.exe 5032 bhhhbn.exe 1996 vvvjd.exe 1484 lflxfff.exe 2520 ntbbbb.exe 1216 ppjjj.exe 4156 9fxrlrx.exe 4596 lxrfxxf.exe 1764 nnnnhh.exe 3716 vjddv.exe 1568 fxlfffr.exe 4152 bhnhbb.exe 3248 jjddj.exe 4960 ffxfrxr.exe 4256 bhtttt.exe 668 vdddj.exe 2536 nnbbhn.exe 1268 7vjdj.exe 4148 vpvpp.exe 3764 flxxlfl.exe 2828 bhnhhb.exe 3912 tnhhhn.exe 1336 jvjjj.exe 4724 9lxrrfx.exe 4956 hbtttb.exe 1160 nhnhbb.exe 2716 9jjvp.exe 3736 jdvpp.exe 544 1fxrrxf.exe 3296 9nnbbb.exe 852 vpppj.exe 3524 xlrlxxx.exe 4964 hthhhh.exe 4500 vpdvv.exe 2392 djjvp.exe 2452 3xrrrrr.exe 2404 hhhhbb.exe 1032 hbbttt.exe 4292 xrxlfrf.exe 2372 nbbnnh.exe 2944 vvjjv.exe 3660 nhhhtb.exe 4672 hbttbh.exe 4252 vvdvp.exe 2972 5xlrxlx.exe 4756 tntbbb.exe 1600 djpdj.exe 1996 jvddv.exe 4280 hbtntb.exe 1424 lxxxxff.exe 2272 ttttnn.exe 2160 djvpj.exe 4664 vpdvv.exe 812 3httth.exe 1784 ppvdd.exe 3808 rxrxrff.exe 2212 3httnt.exe 3428 jvvvp.exe 3300 ffrrrxf.exe 1704 bnttbb.exe 3768 nthhnt.exe 3248 vpjdd.exe 2724 ffxfflf.exe -
resource yara_rule behavioral2/memory/2352-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2352-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b6d-3.dat upx behavioral2/files/0x000a000000023b74-9.dat upx behavioral2/memory/4884-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b75-11.dat upx behavioral2/memory/4920-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5032-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b76-20.dat upx behavioral2/files/0x000a000000023b77-25.dat upx behavioral2/memory/1996-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b78-31.dat upx behavioral2/memory/1484-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b79-37.dat upx behavioral2/memory/2520-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7a-43.dat upx behavioral2/memory/4156-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7b-48.dat upx behavioral2/files/0x000a000000023b7c-53.dat upx behavioral2/memory/4596-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7d-59.dat upx behavioral2/memory/3716-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1764-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7e-66.dat upx behavioral2/memory/1568-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b7f-72.dat upx behavioral2/files/0x000a000000023b80-76.dat upx behavioral2/memory/4152-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b81-82.dat upx behavioral2/memory/3248-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4960-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b82-88.dat upx behavioral2/memory/4256-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b83-93.dat upx behavioral2/files/0x0031000000023b84-102.dat upx behavioral2/memory/668-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023b86-106.dat upx behavioral2/memory/1268-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b87-112.dat upx behavioral2/memory/2536-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4148-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b89-124.dat upx behavioral2/files/0x000a000000023b88-120.dat upx behavioral2/memory/2828-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3764-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8a-132.dat upx behavioral2/memory/3912-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8b-137.dat upx behavioral2/memory/1336-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b71-146.dat upx behavioral2/memory/3912-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8c-151.dat upx behavioral2/memory/4956-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8d-156.dat upx behavioral2/files/0x000a000000023b8e-163.dat upx behavioral2/memory/2716-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b8f-167.dat upx behavioral2/memory/1160-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b90-173.dat upx behavioral2/memory/544-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b91-180.dat upx behavioral2/files/0x000a000000023b92-184.dat upx behavioral2/memory/852-189-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4884 2352 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 2352 wrote to memory of 4884 2352 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 2352 wrote to memory of 4884 2352 a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe 83 PID 4884 wrote to memory of 4920 4884 vvvvv.exe 84 PID 4884 wrote to memory of 4920 4884 vvvvv.exe 84 PID 4884 wrote to memory of 4920 4884 vvvvv.exe 84 PID 4920 wrote to memory of 5032 4920 rfxrlrr.exe 85 PID 4920 wrote to memory of 5032 4920 rfxrlrr.exe 85 PID 4920 wrote to memory of 5032 4920 rfxrlrr.exe 85 PID 5032 wrote to memory of 1996 5032 bhhhbn.exe 86 PID 5032 wrote to memory of 1996 5032 bhhhbn.exe 86 PID 5032 wrote to memory of 1996 5032 bhhhbn.exe 86 PID 1996 wrote to memory of 1484 1996 vvvjd.exe 87 PID 1996 wrote to memory of 1484 1996 vvvjd.exe 87 PID 1996 wrote to memory of 1484 1996 vvvjd.exe 87 PID 1484 wrote to memory of 2520 1484 lflxfff.exe 88 PID 1484 wrote to memory of 2520 1484 lflxfff.exe 88 PID 1484 wrote to memory of 2520 1484 lflxfff.exe 88 PID 2520 wrote to memory of 1216 2520 ntbbbb.exe 89 PID 2520 wrote to memory of 1216 2520 ntbbbb.exe 89 PID 2520 wrote to memory of 1216 2520 ntbbbb.exe 89 PID 1216 wrote to memory of 4156 1216 ppjjj.exe 90 PID 1216 wrote to memory of 4156 1216 ppjjj.exe 90 PID 1216 wrote to memory of 4156 1216 ppjjj.exe 90 PID 4156 wrote to memory of 4596 4156 9fxrlrx.exe 91 PID 4156 wrote to memory of 4596 4156 9fxrlrx.exe 91 PID 4156 wrote to memory of 4596 4156 9fxrlrx.exe 91 PID 4596 wrote to memory of 1764 4596 lxrfxxf.exe 92 PID 4596 wrote to memory of 1764 4596 lxrfxxf.exe 92 PID 4596 wrote to memory of 1764 4596 lxrfxxf.exe 92 PID 1764 wrote to memory of 3716 1764 nnnnhh.exe 93 PID 1764 wrote to memory of 3716 1764 nnnnhh.exe 93 PID 1764 wrote to memory of 3716 1764 nnnnhh.exe 93 PID 3716 wrote to memory of 1568 3716 vjddv.exe 94 PID 3716 wrote to memory of 1568 3716 vjddv.exe 94 PID 3716 wrote to memory of 1568 3716 vjddv.exe 94 PID 1568 wrote to memory of 4152 1568 fxlfffr.exe 95 PID 1568 wrote to memory of 4152 1568 fxlfffr.exe 95 PID 1568 wrote to memory of 4152 1568 fxlfffr.exe 95 PID 4152 wrote to memory of 3248 4152 bhnhbb.exe 96 PID 4152 wrote to memory of 3248 4152 bhnhbb.exe 96 PID 4152 wrote to memory of 3248 4152 bhnhbb.exe 96 PID 3248 wrote to memory of 4960 3248 jjddj.exe 97 PID 3248 wrote to memory of 4960 3248 jjddj.exe 97 PID 3248 wrote to memory of 4960 3248 jjddj.exe 97 PID 4960 wrote to memory of 4256 4960 ffxfrxr.exe 98 PID 4960 wrote to memory of 4256 4960 ffxfrxr.exe 98 PID 4960 wrote to memory of 4256 4960 ffxfrxr.exe 98 PID 4256 wrote to memory of 668 4256 bhtttt.exe 99 PID 4256 wrote to memory of 668 4256 bhtttt.exe 99 PID 4256 wrote to memory of 668 4256 bhtttt.exe 99 PID 668 wrote to memory of 2536 668 vdddj.exe 100 PID 668 wrote to memory of 2536 668 vdddj.exe 100 PID 668 wrote to memory of 2536 668 vdddj.exe 100 PID 2536 wrote to memory of 1268 2536 nnbbhn.exe 101 PID 2536 wrote to memory of 1268 2536 nnbbhn.exe 101 PID 2536 wrote to memory of 1268 2536 nnbbhn.exe 101 PID 1268 wrote to memory of 4148 1268 7vjdj.exe 102 PID 1268 wrote to memory of 4148 1268 7vjdj.exe 102 PID 1268 wrote to memory of 4148 1268 7vjdj.exe 102 PID 4148 wrote to memory of 3764 4148 vpvpp.exe 103 PID 4148 wrote to memory of 3764 4148 vpvpp.exe 103 PID 4148 wrote to memory of 3764 4148 vpvpp.exe 103 PID 3764 wrote to memory of 2828 3764 flxxlfl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"C:\Users\Admin\AppData\Local\Temp\a45d264c0fd34bcab8bedd7cd9d40696c933277aab140a69b70cf1cf8c4df165.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vvvvv.exec:\vvvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\bhhhbn.exec:\bhhhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\vvvjd.exec:\vvvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\lflxfff.exec:\lflxfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\ntbbbb.exec:\ntbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\ppjjj.exec:\ppjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\9fxrlrx.exec:\9fxrlrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\lxrfxxf.exec:\lxrfxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\nnnnhh.exec:\nnnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\vjddv.exec:\vjddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\fxlfffr.exec:\fxlfffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\bhnhbb.exec:\bhnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\jjddj.exec:\jjddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\bhtttt.exec:\bhtttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\vdddj.exec:\vdddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\nnbbhn.exec:\nnbbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7vjdj.exec:\7vjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\vpvpp.exec:\vpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\flxxlfl.exec:\flxxlfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\bhnhhb.exec:\bhnhhb.exe23⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tnhhhn.exec:\tnhhhn.exe24⤵
- Executes dropped EXE
PID:3912 -
\??\c:\jvjjj.exec:\jvjjj.exe25⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9lxrrfx.exec:\9lxrrfx.exe26⤵
- Executes dropped EXE
PID:4724 -
\??\c:\hbtttb.exec:\hbtttb.exe27⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nhnhbb.exec:\nhnhbb.exe28⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9jjvp.exec:\9jjvp.exe29⤵
- Executes dropped EXE
PID:2716 -
\??\c:\jdvpp.exec:\jdvpp.exe30⤵
- Executes dropped EXE
PID:3736 -
\??\c:\1fxrrxf.exec:\1fxrrxf.exe31⤵
- Executes dropped EXE
PID:544 -
\??\c:\9nnbbb.exec:\9nnbbb.exe32⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vpppj.exec:\vpppj.exe33⤵
- Executes dropped EXE
PID:852 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe34⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hthhhh.exec:\hthhhh.exe35⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vpdvv.exec:\vpdvv.exe36⤵
- Executes dropped EXE
PID:4500 -
\??\c:\djjvp.exec:\djjvp.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\3xrrrrr.exec:\3xrrrrr.exe38⤵
- Executes dropped EXE
PID:2452 -
\??\c:\hhhhbb.exec:\hhhhbb.exe39⤵
- Executes dropped EXE
PID:2404 -
\??\c:\hbbttt.exec:\hbbttt.exe40⤵
- Executes dropped EXE
PID:1032 -
\??\c:\xrxlfrf.exec:\xrxlfrf.exe41⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nbbnnh.exec:\nbbnnh.exe42⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vvjjv.exec:\vvjjv.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhhhtb.exec:\nhhhtb.exe44⤵
- Executes dropped EXE
PID:3660 -
\??\c:\hbttbh.exec:\hbttbh.exe45⤵
- Executes dropped EXE
PID:4672 -
\??\c:\vvdvp.exec:\vvdvp.exe46⤵
- Executes dropped EXE
PID:4252 -
\??\c:\5xlrxlx.exec:\5xlrxlx.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tntbbb.exec:\tntbbb.exe48⤵
- Executes dropped EXE
PID:4756 -
\??\c:\djpdj.exec:\djpdj.exe49⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hbtntb.exec:\hbtntb.exe51⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lxxxxff.exec:\lxxxxff.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ttttnn.exec:\ttttnn.exe53⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djvpj.exec:\djvpj.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vpdvv.exec:\vpdvv.exe55⤵
- Executes dropped EXE
PID:4664 -
\??\c:\3httth.exec:\3httth.exe56⤵
- Executes dropped EXE
PID:812 -
\??\c:\ppvdd.exec:\ppvdd.exe57⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rxrxrff.exec:\rxrxrff.exe58⤵
- Executes dropped EXE
PID:3808 -
\??\c:\3httnt.exec:\3httnt.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jvvvp.exec:\jvvvp.exe60⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe61⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bnttbb.exec:\bnttbb.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nthhnt.exec:\nthhnt.exe63⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vpjdd.exec:\vpjdd.exe64⤵
- Executes dropped EXE
PID:3248 -
\??\c:\ffxfflf.exec:\ffxfflf.exe65⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nntbhn.exec:\nntbhn.exe66⤵PID:2968
-
\??\c:\vpvvp.exec:\vpvvp.exe67⤵PID:1616
-
\??\c:\pjvvp.exec:\pjvvp.exe68⤵PID:668
-
\??\c:\xrxrllr.exec:\xrxrllr.exe69⤵PID:4568
-
\??\c:\bnbbbh.exec:\bnbbbh.exe70⤵PID:3460
-
\??\c:\tthhhn.exec:\tthhhn.exe71⤵PID:4216
-
\??\c:\pjppv.exec:\pjppv.exe72⤵PID:4076
-
\??\c:\fxffxxx.exec:\fxffxxx.exe73⤵PID:5068
-
\??\c:\rxfffll.exec:\rxfffll.exe74⤵PID:2932
-
\??\c:\bnbbbh.exec:\bnbbbh.exe75⤵PID:4008
-
\??\c:\3hhhhn.exec:\3hhhhn.exe76⤵PID:5016
-
\??\c:\dvjjp.exec:\dvjjp.exe77⤵PID:4928
-
\??\c:\rrfrflr.exec:\rrfrflr.exe78⤵PID:444
-
\??\c:\9lffxrr.exec:\9lffxrr.exe79⤵
- System Location Discovery: System Language Discovery
PID:3712 -
\??\c:\btbhnt.exec:\btbhnt.exe80⤵PID:2016
-
\??\c:\dpvjp.exec:\dpvjp.exe81⤵PID:1160
-
\??\c:\vdddv.exec:\vdddv.exe82⤵PID:4776
-
\??\c:\1rxxrrr.exec:\1rxxrrr.exe83⤵PID:4020
-
\??\c:\nnbbhh.exec:\nnbbhh.exe84⤵PID:2288
-
\??\c:\7bbbtb.exec:\7bbbtb.exe85⤵PID:4136
-
\??\c:\vjjpp.exec:\vjjpp.exe86⤵PID:2748
-
\??\c:\vvjjv.exec:\vvjjv.exe87⤵PID:5112
-
\??\c:\9fxxxrf.exec:\9fxxxrf.exe88⤵PID:3708
-
\??\c:\tttnhh.exec:\tttnhh.exe89⤵PID:744
-
\??\c:\bhttnn.exec:\bhttnn.exe90⤵PID:4732
-
\??\c:\xrfxlrl.exec:\xrfxlrl.exe91⤵PID:4964
-
\??\c:\rffffff.exec:\rffffff.exe92⤵PID:5084
-
\??\c:\ttbhnn.exec:\ttbhnn.exe93⤵PID:756
-
\??\c:\jpjjj.exec:\jpjjj.exe94⤵PID:3704
-
\??\c:\pjdvv.exec:\pjdvv.exe95⤵PID:2948
-
\??\c:\xrxrlll.exec:\xrxrlll.exe96⤵PID:1032
-
\??\c:\bbnbnn.exec:\bbnbnn.exe97⤵PID:4292
-
\??\c:\ppppp.exec:\ppppp.exe98⤵PID:4352
-
\??\c:\vvvpp.exec:\vvvpp.exe99⤵PID:4412
-
\??\c:\llllfxx.exec:\llllfxx.exe100⤵PID:5104
-
\??\c:\7hhnhn.exec:\7hhnhn.exe101⤵PID:4672
-
\??\c:\thnbtn.exec:\thnbtn.exe102⤵PID:2208
-
\??\c:\jpvvv.exec:\jpvvv.exe103⤵PID:4920
-
\??\c:\ffxrxll.exec:\ffxrxll.exe104⤵PID:5032
-
\??\c:\lffrxll.exec:\lffrxll.exe105⤵PID:5008
-
\??\c:\hhnnnn.exec:\hhnnnn.exe106⤵PID:2408
-
\??\c:\vvvvv.exec:\vvvvv.exe107⤵PID:4976
-
\??\c:\djjjj.exec:\djjjj.exe108⤵PID:3088
-
\??\c:\lrllffr.exec:\lrllffr.exe109⤵PID:368
-
\??\c:\thhtnn.exec:\thhtnn.exe110⤵PID:1388
-
\??\c:\ddpdd.exec:\ddpdd.exe111⤵PID:2332
-
\??\c:\jpdpv.exec:\jpdpv.exe112⤵PID:2416
-
\??\c:\lxxxlfl.exec:\lxxxlfl.exe113⤵PID:1036
-
\??\c:\nbhbbb.exec:\nbhbbb.exe114⤵PID:2244
-
\??\c:\bbhbbt.exec:\bbhbbt.exe115⤵PID:2428
-
\??\c:\jdddp.exec:\jdddp.exe116⤵PID:2464
-
\??\c:\ffrrrxl.exec:\ffrrrxl.exe117⤵PID:3056
-
\??\c:\rlxrfxr.exec:\rlxrfxr.exe118⤵PID:1644
-
\??\c:\bhnhbh.exec:\bhnhbh.exe119⤵PID:4268
-
\??\c:\ddddd.exec:\ddddd.exe120⤵PID:2344
-
\??\c:\rllrfrf.exec:\rllrfrf.exe121⤵PID:636
-
\??\c:\lflfxrl.exec:\lflfxrl.exe122⤵PID:4100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-