Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2024, 03:01
Behavioral task
behavioral1
Sample
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe
Resource
win7-20240903-en
General
-
Target
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe
-
Size
85KB
-
MD5
829f319caed04181cc4b9ecee7e98960
-
SHA1
8e1996dc6aaa6ec0c7db9b67f586d3b93f9b1ab0
-
SHA256
1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647
-
SHA512
9733e56eb6d53a2572d00628e9ccc10a0032ac8a5b5c716c38fa6e5e58b4ce0bf37e4020a8b963a2c8e38e31622f61e08e8352de16b2b4995122b98b50d01eb1
-
SSDEEP
1536:cvQBeOGtrYS3srx93UBWfwC6Ggnouy8HglW8wk8miJd1Rtt8Nqz1xw++:chOmTsF93UYfwC6GIout3tk8mItt8N5P
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3292-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3088-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3176-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2740-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3112-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/956-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1416-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4804-654-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-843-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-857-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-1132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-2094-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 116 3fxxrrr.exe 644 3hhhhn.exe 560 7jjdd.exe 2884 flrxxlf.exe 3184 nbnnnn.exe 4380 dvvvp.exe 2180 rfrlllf.exe 3088 llfxrlx.exe 1532 7thhhh.exe 3980 pjppj.exe 4948 9rfffff.exe 1232 lrlrrxf.exe 1600 hbnnbt.exe 1976 3ppjj.exe 2364 jjjpd.exe 3824 1lxxxxx.exe 3852 hntttb.exe 4348 pppjd.exe 4808 pdpjv.exe 2196 fxllllf.exe 2280 ttntbh.exe 2040 hnbhtn.exe 3176 dppjd.exe 1156 rflfxxr.exe 4692 nhhttn.exe 2652 djddv.exe 2020 dvvpj.exe 3136 3rfxlfx.exe 1548 3hnhbb.exe 4740 jdjvd.exe 5112 5fxrxxl.exe 1772 lxflfff.exe 2664 bbhbnn.exe 1104 bnnnhh.exe 2524 vddvj.exe 2228 rfxrrlf.exe 2188 7frlfxr.exe 2740 lfxrlrf.exe 3480 5nhbnh.exe 2100 vpjvj.exe 2396 bbnnhh.exe 3628 hhhhtt.exe 5012 jvdpd.exe 3048 rfrfxrf.exe 392 tntntt.exe 5044 djddp.exe 5100 lffxrfx.exe 3112 tntnhh.exe 452 djpjv.exe 4188 rxfxrlx.exe 3540 tntnhb.exe 4972 5pddv.exe 728 5pjdv.exe 956 fxfrxrr.exe 4488 5ppvj.exe 3792 jvpvj.exe 3184 ffxrffx.exe 3144 nhhbtt.exe 3944 7jjvj.exe 1580 3rxxxrf.exe 4476 bttnnh.exe 4560 thhhhh.exe 2156 djjjv.exe 3020 1rrlffx.exe -
resource yara_rule behavioral2/memory/3292-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023c07-3.dat upx behavioral2/memory/3292-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023caa-9.dat upx behavioral2/memory/116-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023caf-13.dat upx behavioral2/memory/644-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb0-21.dat upx behavioral2/memory/560-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb1-27.dat upx behavioral2/memory/2884-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-33.dat upx behavioral2/memory/3184-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb3-38.dat upx behavioral2/memory/2180-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4380-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-44.dat upx behavioral2/memory/2180-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb5-50.dat upx behavioral2/memory/1532-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb6-57.dat upx behavioral2/memory/3088-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1532-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-63.dat upx behavioral2/memory/3980-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-69.dat upx behavioral2/memory/4948-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1232-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb9-77.dat upx behavioral2/files/0x0007000000023cba-81.dat upx behavioral2/memory/1976-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1600-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-89.dat upx behavioral2/memory/2364-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-94.dat upx behavioral2/memory/3824-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-101.dat upx behavioral2/files/0x0007000000023cbe-105.dat upx behavioral2/memory/3852-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-111.dat upx behavioral2/memory/4348-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc0-118.dat upx behavioral2/memory/2196-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-124.dat upx behavioral2/files/0x0007000000023cc2-128.dat upx behavioral2/memory/2280-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc3-135.dat upx behavioral2/memory/3176-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-139.dat upx behavioral2/files/0x0007000000023cc6-145.dat upx behavioral2/memory/1156-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-151.dat upx behavioral2/files/0x0007000000023cc8-158.dat upx behavioral2/memory/2652-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4692-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2020-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cab-165.dat upx behavioral2/files/0x0007000000023cc9-169.dat upx behavioral2/files/0x0007000000023cca-177.dat upx behavioral2/memory/4740-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1548-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-183.dat upx behavioral2/files/0x0007000000023ccc-187.dat upx behavioral2/memory/1104-198-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3292 wrote to memory of 116 3292 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 83 PID 3292 wrote to memory of 116 3292 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 83 PID 3292 wrote to memory of 116 3292 1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe 83 PID 116 wrote to memory of 644 116 3fxxrrr.exe 84 PID 116 wrote to memory of 644 116 3fxxrrr.exe 84 PID 116 wrote to memory of 644 116 3fxxrrr.exe 84 PID 644 wrote to memory of 560 644 3hhhhn.exe 85 PID 644 wrote to memory of 560 644 3hhhhn.exe 85 PID 644 wrote to memory of 560 644 3hhhhn.exe 85 PID 560 wrote to memory of 2884 560 7jjdd.exe 86 PID 560 wrote to memory of 2884 560 7jjdd.exe 86 PID 560 wrote to memory of 2884 560 7jjdd.exe 86 PID 2884 wrote to memory of 3184 2884 flrxxlf.exe 87 PID 2884 wrote to memory of 3184 2884 flrxxlf.exe 87 PID 2884 wrote to memory of 3184 2884 flrxxlf.exe 87 PID 3184 wrote to memory of 4380 3184 nbnnnn.exe 88 PID 3184 wrote to memory of 4380 3184 nbnnnn.exe 88 PID 3184 wrote to memory of 4380 3184 nbnnnn.exe 88 PID 4380 wrote to memory of 2180 4380 dvvvp.exe 89 PID 4380 wrote to memory of 2180 4380 dvvvp.exe 89 PID 4380 wrote to memory of 2180 4380 dvvvp.exe 89 PID 2180 wrote to memory of 3088 2180 rfrlllf.exe 90 PID 2180 wrote to memory of 3088 2180 rfrlllf.exe 90 PID 2180 wrote to memory of 3088 2180 rfrlllf.exe 90 PID 3088 wrote to memory of 1532 3088 llfxrlx.exe 91 PID 3088 wrote to memory of 1532 3088 llfxrlx.exe 91 PID 3088 wrote to memory of 1532 3088 llfxrlx.exe 91 PID 1532 wrote to memory of 3980 1532 7thhhh.exe 92 PID 1532 wrote to memory of 3980 1532 7thhhh.exe 92 PID 1532 wrote to memory of 3980 1532 7thhhh.exe 92 PID 3980 wrote to memory of 4948 3980 pjppj.exe 93 PID 3980 wrote to memory of 4948 3980 pjppj.exe 93 PID 3980 wrote to memory of 4948 3980 pjppj.exe 93 PID 4948 wrote to memory of 1232 4948 9rfffff.exe 94 PID 4948 wrote to memory of 1232 4948 9rfffff.exe 94 PID 4948 wrote to memory of 1232 4948 9rfffff.exe 94 PID 1232 wrote to memory of 1600 1232 lrlrrxf.exe 95 PID 1232 wrote to memory of 1600 1232 lrlrrxf.exe 95 PID 1232 wrote to memory of 1600 1232 lrlrrxf.exe 95 PID 1600 wrote to memory of 1976 1600 hbnnbt.exe 96 PID 1600 wrote to memory of 1976 1600 hbnnbt.exe 96 PID 1600 wrote to memory of 1976 1600 hbnnbt.exe 96 PID 1976 wrote to memory of 2364 1976 3ppjj.exe 97 PID 1976 wrote to memory of 2364 1976 3ppjj.exe 97 PID 1976 wrote to memory of 2364 1976 3ppjj.exe 97 PID 2364 wrote to memory of 3824 2364 jjjpd.exe 98 PID 2364 wrote to memory of 3824 2364 jjjpd.exe 98 PID 2364 wrote to memory of 3824 2364 jjjpd.exe 98 PID 3824 wrote to memory of 3852 3824 1lxxxxx.exe 99 PID 3824 wrote to memory of 3852 3824 1lxxxxx.exe 99 PID 3824 wrote to memory of 3852 3824 1lxxxxx.exe 99 PID 3852 wrote to memory of 4348 3852 hntttb.exe 100 PID 3852 wrote to memory of 4348 3852 hntttb.exe 100 PID 3852 wrote to memory of 4348 3852 hntttb.exe 100 PID 4348 wrote to memory of 4808 4348 pppjd.exe 101 PID 4348 wrote to memory of 4808 4348 pppjd.exe 101 PID 4348 wrote to memory of 4808 4348 pppjd.exe 101 PID 4808 wrote to memory of 2196 4808 pdpjv.exe 102 PID 4808 wrote to memory of 2196 4808 pdpjv.exe 102 PID 4808 wrote to memory of 2196 4808 pdpjv.exe 102 PID 2196 wrote to memory of 2280 2196 fxllllf.exe 103 PID 2196 wrote to memory of 2280 2196 fxllllf.exe 103 PID 2196 wrote to memory of 2280 2196 fxllllf.exe 103 PID 2280 wrote to memory of 2040 2280 ttntbh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe"C:\Users\Admin\AppData\Local\Temp\1bf50c5ebe6bf6721a47d7f32bf621fe589d5becfd8e63aafc70361e846ad647N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\3fxxrrr.exec:\3fxxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\3hhhhn.exec:\3hhhhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\7jjdd.exec:\7jjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\flrxxlf.exec:\flrxxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\nbnnnn.exec:\nbnnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\dvvvp.exec:\dvvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\rfrlllf.exec:\rfrlllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\llfxrlx.exec:\llfxrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\7thhhh.exec:\7thhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pjppj.exec:\pjppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\9rfffff.exec:\9rfffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\lrlrrxf.exec:\lrlrrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\hbnnbt.exec:\hbnnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\3ppjj.exec:\3ppjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jjjpd.exec:\jjjpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\1lxxxxx.exec:\1lxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\hntttb.exec:\hntttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\pppjd.exec:\pppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pdpjv.exec:\pdpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\fxllllf.exec:\fxllllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ttntbh.exec:\ttntbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hnbhtn.exec:\hnbhtn.exe23⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dppjd.exec:\dppjd.exe24⤵
- Executes dropped EXE
PID:3176 -
\??\c:\rflfxxr.exec:\rflfxxr.exe25⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nhhttn.exec:\nhhttn.exe26⤵
- Executes dropped EXE
PID:4692 -
\??\c:\djddv.exec:\djddv.exe27⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dvvpj.exec:\dvvpj.exe28⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3rfxlfx.exec:\3rfxlfx.exe29⤵
- Executes dropped EXE
PID:3136 -
\??\c:\3hnhbb.exec:\3hnhbb.exe30⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jdjvd.exec:\jdjvd.exe31⤵
- Executes dropped EXE
PID:4740 -
\??\c:\5fxrxxl.exec:\5fxrxxl.exe32⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lxflfff.exec:\lxflfff.exe33⤵
- Executes dropped EXE
PID:1772 -
\??\c:\bbhbnn.exec:\bbhbnn.exe34⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bnnnhh.exec:\bnnnhh.exe35⤵
- Executes dropped EXE
PID:1104 -
\??\c:\vddvj.exec:\vddvj.exe36⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rfxrrlf.exec:\rfxrrlf.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7frlfxr.exec:\7frlfxr.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfxrlrf.exec:\lfxrlrf.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5nhbnh.exec:\5nhbnh.exe40⤵
- Executes dropped EXE
PID:3480 -
\??\c:\vpjvj.exec:\vpjvj.exe41⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bbnnhh.exec:\bbnnhh.exe42⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhhhtt.exec:\hhhhtt.exe43⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jvdpd.exec:\jvdpd.exe44⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rfrfxrf.exec:\rfrfxrf.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tntntt.exec:\tntntt.exe46⤵
- Executes dropped EXE
PID:392 -
\??\c:\djddp.exec:\djddp.exe47⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lffxrfx.exec:\lffxrfx.exe48⤵
- Executes dropped EXE
PID:5100 -
\??\c:\tntnhh.exec:\tntnhh.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\djpjv.exec:\djpjv.exe50⤵
- Executes dropped EXE
PID:452 -
\??\c:\rxfxrlx.exec:\rxfxrlx.exe51⤵
- Executes dropped EXE
PID:4188 -
\??\c:\tntnhb.exec:\tntnhb.exe52⤵
- Executes dropped EXE
PID:3540 -
\??\c:\5pddv.exec:\5pddv.exe53⤵
- Executes dropped EXE
PID:4972 -
\??\c:\5pjdv.exec:\5pjdv.exe54⤵
- Executes dropped EXE
PID:728 -
\??\c:\fxfrxrr.exec:\fxfrxrr.exe55⤵
- Executes dropped EXE
PID:956 -
\??\c:\5ppvj.exec:\5ppvj.exe56⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jvpvj.exec:\jvpvj.exe57⤵
- Executes dropped EXE
PID:3792 -
\??\c:\ffxrffx.exec:\ffxrffx.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\nhhbtt.exec:\nhhbtt.exe59⤵
- Executes dropped EXE
PID:3144 -
\??\c:\7jjvj.exec:\7jjvj.exe60⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3rxxxrf.exec:\3rxxxrf.exe61⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bttnnh.exec:\bttnnh.exe62⤵
- Executes dropped EXE
PID:4476 -
\??\c:\thhhhh.exec:\thhhhh.exe63⤵
- Executes dropped EXE
PID:4560 -
\??\c:\djjjv.exec:\djjjv.exe64⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1rrlffx.exec:\1rrlffx.exe65⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7jjdd.exec:\7jjdd.exe66⤵PID:4948
-
\??\c:\7jddd.exec:\7jddd.exe67⤵PID:4104
-
\??\c:\lllfxxx.exec:\lllfxxx.exe68⤵PID:4896
-
\??\c:\9nhhhh.exec:\9nhhhh.exe69⤵PID:384
-
\??\c:\vpppj.exec:\vpppj.exe70⤵PID:1860
-
\??\c:\ddpjp.exec:\ddpjp.exe71⤵PID:2492
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe72⤵PID:1688
-
\??\c:\lrfllxx.exec:\lrfllxx.exe73⤵PID:3824
-
\??\c:\tnbnhh.exec:\tnbnhh.exe74⤵PID:5052
-
\??\c:\nhnntt.exec:\nhnntt.exe75⤵PID:1668
-
\??\c:\jjdjp.exec:\jjdjp.exe76⤵PID:4956
-
\??\c:\lflfxxl.exec:\lflfxxl.exe77⤵PID:3192
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe78⤵PID:5080
-
\??\c:\htbnhh.exec:\htbnhh.exe79⤵PID:1896
-
\??\c:\nhnhbn.exec:\nhnhbn.exe80⤵PID:4244
-
\??\c:\7jpjd.exec:\7jpjd.exe81⤵PID:2280
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe82⤵PID:4924
-
\??\c:\lllllll.exec:\lllllll.exe83⤵PID:5016
-
\??\c:\bnbttn.exec:\bnbttn.exe84⤵PID:4548
-
\??\c:\ppddj.exec:\ppddj.exe85⤵PID:688
-
\??\c:\dvvvv.exec:\dvvvv.exe86⤵PID:4704
-
\??\c:\ffffxxx.exec:\ffffxxx.exe87⤵PID:3436
-
\??\c:\5thhhh.exec:\5thhhh.exe88⤵PID:3752
-
\??\c:\vjjpd.exec:\vjjpd.exe89⤵PID:4140
-
\??\c:\dvdvd.exec:\dvdvd.exe90⤵PID:64
-
\??\c:\lfxxlll.exec:\lfxxlll.exe91⤵PID:2680
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe92⤵PID:2776
-
\??\c:\nnbhtb.exec:\nnbhtb.exe93⤵PID:4876
-
\??\c:\nbtnhb.exec:\nbtnhb.exe94⤵PID:2824
-
\??\c:\vdvvp.exec:\vdvvp.exe95⤵PID:5084
-
\??\c:\1llfxxx.exec:\1llfxxx.exe96⤵PID:1680
-
\??\c:\fxrllxx.exec:\fxrllxx.exe97⤵PID:2324
-
\??\c:\tnhhbb.exec:\tnhhbb.exe98⤵PID:1416
-
\??\c:\3ppjd.exec:\3ppjd.exe99⤵PID:3188
-
\??\c:\ddddv.exec:\ddddv.exe100⤵PID:1964
-
\??\c:\fxffrrx.exec:\fxffrrx.exe101⤵PID:4964
-
\??\c:\flxlxlf.exec:\flxlxlf.exe102⤵PID:3692
-
\??\c:\1bnhbb.exec:\1bnhbb.exe103⤵PID:4236
-
\??\c:\bthhtn.exec:\bthhtn.exe104⤵PID:3920
-
\??\c:\ppppd.exec:\ppppd.exe105⤵PID:3804
-
\??\c:\ffffxxx.exec:\ffffxxx.exe106⤵PID:3156
-
\??\c:\hhnnhh.exec:\hhnnhh.exe107⤵PID:828
-
\??\c:\pjjdv.exec:\pjjdv.exe108⤵PID:1664
-
\??\c:\dpvvp.exec:\dpvvp.exe109⤵PID:2428
-
\??\c:\xxxrfxr.exec:\xxxrfxr.exe110⤵PID:2104
-
\??\c:\rlxxrxl.exec:\rlxxrxl.exe111⤵PID:4844
-
\??\c:\ttttnn.exec:\ttttnn.exe112⤵PID:3924
-
\??\c:\5vdvj.exec:\5vdvj.exe113⤵PID:1612
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe114⤵PID:452
-
\??\c:\frrrrrl.exec:\frrrrrl.exe115⤵PID:4188
-
\??\c:\bhhhbb.exec:\bhhhbb.exe116⤵PID:656
-
\??\c:\pjvpp.exec:\pjvpp.exe117⤵PID:2236
-
\??\c:\xxlrrrr.exec:\xxlrrrr.exe118⤵PID:2336
-
\??\c:\7lflrrr.exec:\7lflrrr.exe119⤵PID:520
-
\??\c:\tbtbth.exec:\tbtbth.exe120⤵PID:420
-
\??\c:\btntht.exec:\btntht.exe121⤵PID:3728
-
\??\c:\vpdvp.exec:\vpdvp.exe122⤵PID:2648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-