Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/12/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe
Resource
win7-20240708-en
General
-
Target
97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe
-
Size
452KB
-
MD5
74df0160dee9bfb4631c8564fb16aad0
-
SHA1
a065e7639ee1fdd03d73e35b7230eb12bab7a2b1
-
SHA256
97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41
-
SHA512
d863acd7729a03ab2b918b5019a74486976e2071a968e48b05428bd43b8681d4ec5cd1adf6990a8f8cd9c722ba4314c718497342d331e98c1ccf1a3f6270a904
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/924-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2208-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2328-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1148-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3164-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3140-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3176-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3352-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2000-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-685-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-860-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-1090-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-1522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-1659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1164 flxlxfl.exe 432 bttnhh.exe 3488 vvvpj.exe 2016 jjjpp.exe 4568 rlrlffx.exe 688 jppjp.exe 1396 fxrlfxx.exe 3836 vpvpp.exe 1220 5xlffxx.exe 532 vvjpj.exe 4220 tnhhbh.exe 3828 frrlxxl.exe 4492 7bhbtt.exe 8 djdjp.exe 3140 nnbttt.exe 5072 7jdvj.exe 1476 7rrrffx.exe 3024 vjvpj.exe 1620 nhhbbt.exe 3868 nhnntn.exe 2208 xxfxrrl.exe 4708 tnntnh.exe 1776 dvvvv.exe 2328 tbhbtn.exe 4900 bhhbbb.exe 3852 hhnhbb.exe 4504 vdvvd.exe 2240 bbbttt.exe 540 djjdv.exe 2688 rlfllrl.exe 3664 7jdvp.exe 3592 vpjjv.exe 1624 xrxxxxf.exe 964 5nnthh.exe 2036 7vpjd.exe 1284 bbnhtt.exe 1148 ttnhbb.exe 3692 vjjjv.exe 1592 xrrlrrr.exe 4376 nhhttn.exe 1644 dvdvj.exe 4276 flrlfll.exe 836 5nttbt.exe 3876 3ntntt.exe 2536 vvpdd.exe 4048 xrrlllf.exe 4388 5hnhbn.exe 3164 dvvpp.exe 4032 jjppj.exe 3960 flxfrxl.exe 3532 bhnhbb.exe 4444 jvdvp.exe 4736 jdpjj.exe 1212 lrxrlfx.exe 4440 7ntnnn.exe 4568 dpvvp.exe 688 jppjj.exe 2620 lffxxff.exe 3424 bhnhbt.exe 3836 dpdpj.exe 1220 3xxrxxf.exe 2616 nnbtnn.exe 708 httnbb.exe 2988 djjjd.exe -
resource yara_rule behavioral2/memory/924-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/688-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2208-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2328-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1148-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3164-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3140-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3352-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2000-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-844-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 924 wrote to memory of 1164 924 97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe 84 PID 924 wrote to memory of 1164 924 97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe 84 PID 924 wrote to memory of 1164 924 97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe 84 PID 1164 wrote to memory of 432 1164 flxlxfl.exe 85 PID 1164 wrote to memory of 432 1164 flxlxfl.exe 85 PID 1164 wrote to memory of 432 1164 flxlxfl.exe 85 PID 432 wrote to memory of 3488 432 bttnhh.exe 86 PID 432 wrote to memory of 3488 432 bttnhh.exe 86 PID 432 wrote to memory of 3488 432 bttnhh.exe 86 PID 3488 wrote to memory of 2016 3488 vvvpj.exe 87 PID 3488 wrote to memory of 2016 3488 vvvpj.exe 87 PID 3488 wrote to memory of 2016 3488 vvvpj.exe 87 PID 2016 wrote to memory of 4568 2016 jjjpp.exe 88 PID 2016 wrote to memory of 4568 2016 jjjpp.exe 88 PID 2016 wrote to memory of 4568 2016 jjjpp.exe 88 PID 4568 wrote to memory of 688 4568 rlrlffx.exe 89 PID 4568 wrote to memory of 688 4568 rlrlffx.exe 89 PID 4568 wrote to memory of 688 4568 rlrlffx.exe 89 PID 688 wrote to memory of 1396 688 jppjp.exe 90 PID 688 wrote to memory of 1396 688 jppjp.exe 90 PID 688 wrote to memory of 1396 688 jppjp.exe 90 PID 1396 wrote to memory of 3836 1396 fxrlfxx.exe 91 PID 1396 wrote to memory of 3836 1396 fxrlfxx.exe 91 PID 1396 wrote to memory of 3836 1396 fxrlfxx.exe 91 PID 3836 wrote to memory of 1220 3836 vpvpp.exe 92 PID 3836 wrote to memory of 1220 3836 vpvpp.exe 92 PID 3836 wrote to memory of 1220 3836 vpvpp.exe 92 PID 1220 wrote to memory of 532 1220 5xlffxx.exe 93 PID 1220 wrote to memory of 532 1220 5xlffxx.exe 93 PID 1220 wrote to memory of 532 1220 5xlffxx.exe 93 PID 532 wrote to memory of 4220 532 vvjpj.exe 94 PID 532 wrote to memory of 4220 532 vvjpj.exe 94 PID 532 wrote to memory of 4220 532 vvjpj.exe 94 PID 4220 wrote to memory of 3828 4220 tnhhbh.exe 95 PID 4220 wrote to memory of 3828 4220 tnhhbh.exe 95 PID 4220 wrote to memory of 3828 4220 tnhhbh.exe 95 PID 3828 wrote to memory of 4492 3828 frrlxxl.exe 96 PID 3828 wrote to memory of 4492 3828 frrlxxl.exe 96 PID 3828 wrote to memory of 4492 3828 frrlxxl.exe 96 PID 4492 wrote to memory of 8 4492 7bhbtt.exe 97 PID 4492 wrote to memory of 8 4492 7bhbtt.exe 97 PID 4492 wrote to memory of 8 4492 7bhbtt.exe 97 PID 8 wrote to memory of 3140 8 djdjp.exe 98 PID 8 wrote to memory of 3140 8 djdjp.exe 98 PID 8 wrote to memory of 3140 8 djdjp.exe 98 PID 3140 wrote to memory of 5072 3140 nnbttt.exe 99 PID 3140 wrote to memory of 5072 3140 nnbttt.exe 99 PID 3140 wrote to memory of 5072 3140 nnbttt.exe 99 PID 5072 wrote to memory of 1476 5072 7jdvj.exe 100 PID 5072 wrote to memory of 1476 5072 7jdvj.exe 100 PID 5072 wrote to memory of 1476 5072 7jdvj.exe 100 PID 1476 wrote to memory of 3024 1476 7rrrffx.exe 101 PID 1476 wrote to memory of 3024 1476 7rrrffx.exe 101 PID 1476 wrote to memory of 3024 1476 7rrrffx.exe 101 PID 3024 wrote to memory of 1620 3024 vjvpj.exe 102 PID 3024 wrote to memory of 1620 3024 vjvpj.exe 102 PID 3024 wrote to memory of 1620 3024 vjvpj.exe 102 PID 1620 wrote to memory of 3868 1620 nhhbbt.exe 103 PID 1620 wrote to memory of 3868 1620 nhhbbt.exe 103 PID 1620 wrote to memory of 3868 1620 nhhbbt.exe 103 PID 3868 wrote to memory of 2208 3868 nhnntn.exe 104 PID 3868 wrote to memory of 2208 3868 nhnntn.exe 104 PID 3868 wrote to memory of 2208 3868 nhnntn.exe 104 PID 2208 wrote to memory of 4708 2208 xxfxrrl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe"C:\Users\Admin\AppData\Local\Temp\97691710e8e3ae5e0d8bd7e442eaae5eff9c5e0b374e73dc9adb7844ab4e2b41N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\flxlxfl.exec:\flxlxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\bttnhh.exec:\bttnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\vvvpj.exec:\vvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\jjjpp.exec:\jjjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rlrlffx.exec:\rlrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\jppjp.exec:\jppjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\vpvpp.exec:\vpvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\5xlffxx.exec:\5xlffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\vvjpj.exec:\vvjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\tnhhbh.exec:\tnhhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\frrlxxl.exec:\frrlxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\7bhbtt.exec:\7bhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\djdjp.exec:\djdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\nnbttt.exec:\nnbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\7jdvj.exec:\7jdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\7rrrffx.exec:\7rrrffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\vjvpj.exec:\vjvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nhhbbt.exec:\nhhbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\nhnntn.exec:\nhnntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\tnntnh.exec:\tnntnh.exe23⤵
- Executes dropped EXE
PID:4708 -
\??\c:\dvvvv.exec:\dvvvv.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\tbhbtn.exec:\tbhbtn.exe25⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bhhbbb.exec:\bhhbbb.exe26⤵
- Executes dropped EXE
PID:4900 -
\??\c:\hhnhbb.exec:\hhnhbb.exe27⤵
- Executes dropped EXE
PID:3852 -
\??\c:\vdvvd.exec:\vdvvd.exe28⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bbbttt.exec:\bbbttt.exe29⤵
- Executes dropped EXE
PID:2240 -
\??\c:\djjdv.exec:\djjdv.exe30⤵
- Executes dropped EXE
PID:540 -
\??\c:\rlfllrl.exec:\rlfllrl.exe31⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7jdvp.exec:\7jdvp.exe32⤵
- Executes dropped EXE
PID:3664 -
\??\c:\vpjjv.exec:\vpjjv.exe33⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5nnthh.exec:\5nnthh.exe35⤵
- Executes dropped EXE
PID:964 -
\??\c:\7vpjd.exec:\7vpjd.exe36⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbnhtt.exec:\bbnhtt.exe37⤵
- Executes dropped EXE
PID:1284 -
\??\c:\ttnhbb.exec:\ttnhbb.exe38⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vjjjv.exec:\vjjjv.exe39⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xrrlrrr.exec:\xrrlrrr.exe40⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nhhttn.exec:\nhhttn.exe41⤵
- Executes dropped EXE
PID:4376 -
\??\c:\dvdvj.exec:\dvdvj.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\flrlfll.exec:\flrlfll.exe43⤵
- Executes dropped EXE
PID:4276 -
\??\c:\5nttbt.exec:\5nttbt.exe44⤵
- Executes dropped EXE
PID:836 -
\??\c:\3ntntt.exec:\3ntntt.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3876 -
\??\c:\vvpdd.exec:\vvpdd.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrrlllf.exec:\xrrlllf.exe47⤵
- Executes dropped EXE
PID:4048 -
\??\c:\5hnhbn.exec:\5hnhbn.exe48⤵
- Executes dropped EXE
PID:4388 -
\??\c:\dvvpp.exec:\dvvpp.exe49⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jjppj.exec:\jjppj.exe50⤵
- Executes dropped EXE
PID:4032 -
\??\c:\flxfrxl.exec:\flxfrxl.exe51⤵
- Executes dropped EXE
PID:3960 -
\??\c:\bhnhbb.exec:\bhnhbb.exe52⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jvdvp.exec:\jvdvp.exe53⤵
- Executes dropped EXE
PID:4444 -
\??\c:\jdpjj.exec:\jdpjj.exe54⤵
- Executes dropped EXE
PID:4736 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe55⤵
- Executes dropped EXE
PID:1212 -
\??\c:\7ntnnn.exec:\7ntnnn.exe56⤵
- Executes dropped EXE
PID:4440 -
\??\c:\dpvvp.exec:\dpvvp.exe57⤵
- Executes dropped EXE
PID:4568 -
\??\c:\jppjj.exec:\jppjj.exe58⤵
- Executes dropped EXE
PID:688 -
\??\c:\lffxxff.exec:\lffxxff.exe59⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bhnhbt.exec:\bhnhbt.exe60⤵
- Executes dropped EXE
PID:3424 -
\??\c:\dpdpj.exec:\dpdpj.exe61⤵
- Executes dropped EXE
PID:3836 -
\??\c:\3xxrxxf.exec:\3xxrxxf.exe62⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nnbtnn.exec:\nnbtnn.exe63⤵
- Executes dropped EXE
PID:2616 -
\??\c:\httnbb.exec:\httnbb.exe64⤵
- Executes dropped EXE
PID:708 -
\??\c:\djjjd.exec:\djjjd.exe65⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fflfxrl.exec:\fflfxrl.exe66⤵PID:2632
-
\??\c:\nttbht.exec:\nttbht.exe67⤵PID:4220
-
\??\c:\jvdvp.exec:\jvdvp.exe68⤵PID:4720
-
\??\c:\7lfrllf.exec:\7lfrllf.exe69⤵PID:920
-
\??\c:\hbbttn.exec:\hbbttn.exe70⤵PID:3248
-
\??\c:\jdddv.exec:\jdddv.exe71⤵PID:3140
-
\??\c:\rlffxxx.exec:\rlffxxx.exe72⤵PID:2908
-
\??\c:\hnbtnn.exec:\hnbtnn.exe73⤵PID:404
-
\??\c:\djjdv.exec:\djjdv.exe74⤵PID:112
-
\??\c:\xxxrffl.exec:\xxxrffl.exe75⤵PID:4128
-
\??\c:\frxlfxr.exec:\frxlfxr.exe76⤵PID:4508
-
\??\c:\tnbtbb.exec:\tnbtbb.exe77⤵PID:1004
-
\??\c:\vpdvd.exec:\vpdvd.exe78⤵PID:2136
-
\??\c:\9xrrrrr.exec:\9xrrrrr.exe79⤵PID:1216
-
\??\c:\1rrlflf.exec:\1rrlflf.exe80⤵PID:3176
-
\??\c:\bttttt.exec:\bttttt.exe81⤵PID:1140
-
\??\c:\jpjdj.exec:\jpjdj.exe82⤵PID:4136
-
\??\c:\flxrfxr.exec:\flxrfxr.exe83⤵PID:916
-
\??\c:\hbbbbt.exec:\hbbbbt.exe84⤵PID:4900
-
\??\c:\ntbthh.exec:\ntbthh.exe85⤵PID:5096
-
\??\c:\3pjdv.exec:\3pjdv.exe86⤵PID:4204
-
\??\c:\rlxrllf.exec:\rlxrllf.exe87⤵PID:4504
-
\??\c:\hhbbtt.exec:\hhbbtt.exe88⤵PID:4500
-
\??\c:\pdpdv.exec:\pdpdv.exe89⤵PID:4168
-
\??\c:\dvpvv.exec:\dvpvv.exe90⤵PID:3440
-
\??\c:\fxfxffl.exec:\fxfxffl.exe91⤵PID:3352
-
\??\c:\nbhtbt.exec:\nbhtbt.exe92⤵PID:1988
-
\??\c:\dppjd.exec:\dppjd.exe93⤵PID:1320
-
\??\c:\5djjd.exec:\5djjd.exe94⤵PID:1624
-
\??\c:\9xffxfx.exec:\9xffxfx.exe95⤵PID:1900
-
\??\c:\tntbbb.exec:\tntbbb.exe96⤵PID:2216
-
\??\c:\vdjvp.exec:\vdjvp.exe97⤵PID:3612
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe98⤵PID:1612
-
\??\c:\tbnbnh.exec:\tbnbnh.exe99⤵PID:4348
-
\??\c:\9ddvd.exec:\9ddvd.exe100⤵PID:1708
-
\??\c:\rxlxllf.exec:\rxlxllf.exe101⤵PID:1444
-
\??\c:\3hnnhh.exec:\3hnnhh.exe102⤵PID:2440
-
\??\c:\thbttt.exec:\thbttt.exe103⤵PID:1560
-
\??\c:\3vdpv.exec:\3vdpv.exe104⤵PID:3036
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe105⤵PID:4864
-
\??\c:\hbnnnn.exec:\hbnnnn.exe106⤵PID:3700
-
\??\c:\7vvdv.exec:\7vvdv.exe107⤵PID:2608
-
\??\c:\frxxllf.exec:\frxxllf.exe108⤵PID:4344
-
\??\c:\xrxrllf.exec:\xrxrllf.exe109⤵PID:3268
-
\??\c:\nthbtb.exec:\nthbtb.exe110⤵PID:4388
-
\??\c:\5llxlfx.exec:\5llxlfx.exe111⤵PID:4868
-
\??\c:\bhbtnh.exec:\bhbtnh.exe112⤵PID:4032
-
\??\c:\dvvvv.exec:\dvvvv.exe113⤵PID:3484
-
\??\c:\1djpj.exec:\1djpj.exe114⤵PID:4468
-
\??\c:\rllfxrl.exec:\rllfxrl.exe115⤵PID:1204
-
\??\c:\bnhhbb.exec:\bnhhbb.exe116⤵PID:4372
-
\??\c:\7djdp.exec:\7djdp.exe117⤵PID:672
-
\??\c:\rrxrffx.exec:\rrxrffx.exe118⤵PID:4528
-
\??\c:\fxrllll.exec:\fxrllll.exe119⤵
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\nhttbt.exec:\nhttbt.exe120⤵PID:2000
-
\??\c:\7ddvp.exec:\7ddvp.exe121⤵PID:2424
-
\??\c:\xfflfff.exec:\xfflfff.exe122⤵PID:3608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-