Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe
Resource
win7-20241010-en
General
-
Target
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe
-
Size
453KB
-
MD5
504d2daf4325e92a95a56e3bdd575423
-
SHA1
b7b497b7c316c1f99d9b8d06c39f52cec83df12d
-
SHA256
67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77
-
SHA512
9a6d801b15244b7b40b2340c546ab64668e4db3ec5f6be7537198dffd4523c144f9c11b557cba297087ab73c6eda63df71abc43c120ece5756ac855c6d19c85d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2312-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2288-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4060-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4276-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/780-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-727-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-768-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-971-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-1026-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-1042-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-1212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 xllfxlf.exe 1704 ttbnhn.exe 2312 jppjv.exe 2288 rxxlffx.exe 3112 tbhhbb.exe 2772 btbntn.exe 3520 vppvp.exe 4060 htbtnn.exe 4148 1flffxx.exe 1364 ppvpv.exe 380 5llfxxr.exe 3528 lffrlfr.exe 1812 hhnhbt.exe 3516 lxfxffl.exe 220 bttttt.exe 1612 vvjdd.exe 5044 xllfrlf.exe 3592 xflfxlf.exe 872 xfrfxxr.exe 4516 ttnhht.exe 1312 lffxrrl.exe 3680 5tbtnt.exe 1476 xrrlfxr.exe 4640 nbnhbb.exe 4928 rlxxlll.exe 2480 tnhbnn.exe 4236 3rrlffl.exe 2284 nhttnt.exe 1244 7fffrrl.exe 3660 tbnnhh.exe 3264 jvvvv.exe 2328 nnnhhb.exe 1208 vjjdv.exe 2304 xrxxrrx.exe 3664 nhhbbb.exe 3192 jdvpj.exe 1496 1lxfxrr.exe 3864 thhbnn.exe 1808 5tnhbb.exe 4628 dvvpv.exe 4228 xlllfxr.exe 5116 hnbttt.exe 784 vppjv.exe 920 llrrlxr.exe 4760 tnbtnn.exe 4168 jdvdd.exe 1168 3lllxxx.exe 4276 xlrfxxr.exe 1316 bthbhh.exe 2812 jvjdv.exe 2688 llxrlll.exe 5000 bttnhn.exe 3444 dddjd.exe 4300 lxlffxf.exe 4272 fxxrlll.exe 2320 ntbbtt.exe 4624 dpdvp.exe 1824 flxrlfr.exe 1792 ttthnh.exe 1968 ppdvd.exe 3436 lffxxrr.exe 1568 nbtnhb.exe 3484 hbhbtt.exe 2024 3djdp.exe -
resource yara_rule behavioral2/memory/1996-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2288-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4060-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4276-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/780-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-768-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-1169-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1092 wrote to memory of 1996 1092 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 82 PID 1092 wrote to memory of 1996 1092 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 82 PID 1092 wrote to memory of 1996 1092 67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe 82 PID 1996 wrote to memory of 1704 1996 xllfxlf.exe 83 PID 1996 wrote to memory of 1704 1996 xllfxlf.exe 83 PID 1996 wrote to memory of 1704 1996 xllfxlf.exe 83 PID 1704 wrote to memory of 2312 1704 ttbnhn.exe 84 PID 1704 wrote to memory of 2312 1704 ttbnhn.exe 84 PID 1704 wrote to memory of 2312 1704 ttbnhn.exe 84 PID 2312 wrote to memory of 2288 2312 jppjv.exe 85 PID 2312 wrote to memory of 2288 2312 jppjv.exe 85 PID 2312 wrote to memory of 2288 2312 jppjv.exe 85 PID 2288 wrote to memory of 3112 2288 rxxlffx.exe 86 PID 2288 wrote to memory of 3112 2288 rxxlffx.exe 86 PID 2288 wrote to memory of 3112 2288 rxxlffx.exe 86 PID 3112 wrote to memory of 2772 3112 tbhhbb.exe 87 PID 3112 wrote to memory of 2772 3112 tbhhbb.exe 87 PID 3112 wrote to memory of 2772 3112 tbhhbb.exe 87 PID 2772 wrote to memory of 3520 2772 btbntn.exe 88 PID 2772 wrote to memory of 3520 2772 btbntn.exe 88 PID 2772 wrote to memory of 3520 2772 btbntn.exe 88 PID 3520 wrote to memory of 4060 3520 vppvp.exe 89 PID 3520 wrote to memory of 4060 3520 vppvp.exe 89 PID 3520 wrote to memory of 4060 3520 vppvp.exe 89 PID 4060 wrote to memory of 4148 4060 htbtnn.exe 90 PID 4060 wrote to memory of 4148 4060 htbtnn.exe 90 PID 4060 wrote to memory of 4148 4060 htbtnn.exe 90 PID 4148 wrote to memory of 1364 4148 1flffxx.exe 91 PID 4148 wrote to memory of 1364 4148 1flffxx.exe 91 PID 4148 wrote to memory of 1364 4148 1flffxx.exe 91 PID 1364 wrote to memory of 380 1364 ppvpv.exe 92 PID 1364 wrote to memory of 380 1364 ppvpv.exe 92 PID 1364 wrote to memory of 380 1364 ppvpv.exe 92 PID 380 wrote to memory of 3528 380 5llfxxr.exe 93 PID 380 wrote to memory of 3528 380 5llfxxr.exe 93 PID 380 wrote to memory of 3528 380 5llfxxr.exe 93 PID 3528 wrote to memory of 1812 3528 lffrlfr.exe 94 PID 3528 wrote to memory of 1812 3528 lffrlfr.exe 94 PID 3528 wrote to memory of 1812 3528 lffrlfr.exe 94 PID 1812 wrote to memory of 3516 1812 hhnhbt.exe 95 PID 1812 wrote to memory of 3516 1812 hhnhbt.exe 95 PID 1812 wrote to memory of 3516 1812 hhnhbt.exe 95 PID 3516 wrote to memory of 220 3516 lxfxffl.exe 96 PID 3516 wrote to memory of 220 3516 lxfxffl.exe 96 PID 3516 wrote to memory of 220 3516 lxfxffl.exe 96 PID 220 wrote to memory of 1612 220 bttttt.exe 97 PID 220 wrote to memory of 1612 220 bttttt.exe 97 PID 220 wrote to memory of 1612 220 bttttt.exe 97 PID 1612 wrote to memory of 5044 1612 vvjdd.exe 98 PID 1612 wrote to memory of 5044 1612 vvjdd.exe 98 PID 1612 wrote to memory of 5044 1612 vvjdd.exe 98 PID 5044 wrote to memory of 3592 5044 xllfrlf.exe 99 PID 5044 wrote to memory of 3592 5044 xllfrlf.exe 99 PID 5044 wrote to memory of 3592 5044 xllfrlf.exe 99 PID 3592 wrote to memory of 872 3592 xflfxlf.exe 100 PID 3592 wrote to memory of 872 3592 xflfxlf.exe 100 PID 3592 wrote to memory of 872 3592 xflfxlf.exe 100 PID 872 wrote to memory of 4516 872 xfrfxxr.exe 101 PID 872 wrote to memory of 4516 872 xfrfxxr.exe 101 PID 872 wrote to memory of 4516 872 xfrfxxr.exe 101 PID 4516 wrote to memory of 1312 4516 ttnhht.exe 102 PID 4516 wrote to memory of 1312 4516 ttnhht.exe 102 PID 4516 wrote to memory of 1312 4516 ttnhht.exe 102 PID 1312 wrote to memory of 3680 1312 lffxrrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe"C:\Users\Admin\AppData\Local\Temp\67b998a04d0a9277eacc0f080e1fd6d5b7a4d2c2d13c8ed2d45994d046789b77.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\xllfxlf.exec:\xllfxlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\ttbnhn.exec:\ttbnhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\jppjv.exec:\jppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\rxxlffx.exec:\rxxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tbhhbb.exec:\tbhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\btbntn.exec:\btbntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vppvp.exec:\vppvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\htbtnn.exec:\htbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\1flffxx.exec:\1flffxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\ppvpv.exec:\ppvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\5llfxxr.exec:\5llfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\lffrlfr.exec:\lffrlfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\hhnhbt.exec:\hhnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\lxfxffl.exec:\lxfxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\bttttt.exec:\bttttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\vvjdd.exec:\vvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\xllfrlf.exec:\xllfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\xflfxlf.exec:\xflfxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\ttnhht.exec:\ttnhht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\lffxrrl.exec:\lffxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\5tbtnt.exec:\5tbtnt.exe23⤵
- Executes dropped EXE
PID:3680 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nbnhbb.exec:\nbnhbb.exe25⤵
- Executes dropped EXE
PID:4640 -
\??\c:\rlxxlll.exec:\rlxxlll.exe26⤵
- Executes dropped EXE
PID:4928 -
\??\c:\tnhbnn.exec:\tnhbnn.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3rrlffl.exec:\3rrlffl.exe28⤵
- Executes dropped EXE
PID:4236 -
\??\c:\nhttnt.exec:\nhttnt.exe29⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7fffrrl.exec:\7fffrrl.exe30⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tbnnhh.exec:\tbnnhh.exe31⤵
- Executes dropped EXE
PID:3660 -
\??\c:\jvvvv.exec:\jvvvv.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\nnnhhb.exec:\nnnhhb.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vjjdv.exec:\vjjdv.exe34⤵
- Executes dropped EXE
PID:1208 -
\??\c:\xrxxrrx.exec:\xrxxrrx.exe35⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhhbbb.exec:\nhhbbb.exe36⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jdvpj.exec:\jdvpj.exe37⤵
- Executes dropped EXE
PID:3192 -
\??\c:\1lxfxrr.exec:\1lxfxrr.exe38⤵
- Executes dropped EXE
PID:1496 -
\??\c:\thhbnn.exec:\thhbnn.exe39⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5tnhbb.exec:\5tnhbb.exe40⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dvvpv.exec:\dvvpv.exe41⤵
- Executes dropped EXE
PID:4628 -
\??\c:\xlllfxr.exec:\xlllfxr.exe42⤵
- Executes dropped EXE
PID:4228 -
\??\c:\hnbttt.exec:\hnbttt.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vppjv.exec:\vppjv.exe44⤵
- Executes dropped EXE
PID:784 -
\??\c:\llrrlxr.exec:\llrrlxr.exe45⤵
- Executes dropped EXE
PID:920 -
\??\c:\tnbtnn.exec:\tnbtnn.exe46⤵
- Executes dropped EXE
PID:4760 -
\??\c:\jdvdd.exec:\jdvdd.exe47⤵
- Executes dropped EXE
PID:4168 -
\??\c:\3lllxxx.exec:\3lllxxx.exe48⤵
- Executes dropped EXE
PID:1168 -
\??\c:\xlrfxxr.exec:\xlrfxxr.exe49⤵
- Executes dropped EXE
PID:4276 -
\??\c:\bthbhh.exec:\bthbhh.exe50⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jvjdv.exec:\jvjdv.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\llxrlll.exec:\llxrlll.exe52⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bttnhn.exec:\bttnhn.exe53⤵
- Executes dropped EXE
PID:5000 -
\??\c:\dddjd.exec:\dddjd.exe54⤵
- Executes dropped EXE
PID:3444 -
\??\c:\lxlffxf.exec:\lxlffxf.exe55⤵
- Executes dropped EXE
PID:4300 -
\??\c:\fxxrlll.exec:\fxxrlll.exe56⤵
- Executes dropped EXE
PID:4272 -
\??\c:\ntbbtt.exec:\ntbbtt.exe57⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dpdvp.exec:\dpdvp.exe58⤵
- Executes dropped EXE
PID:4624 -
\??\c:\flxrlfr.exec:\flxrlfr.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ttthnh.exec:\ttthnh.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\ppdvd.exec:\ppdvd.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lffxxrr.exec:\lffxxrr.exe62⤵
- Executes dropped EXE
PID:3436 -
\??\c:\nbtnhb.exec:\nbtnhb.exe63⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbhbtt.exec:\hbhbtt.exe64⤵
- Executes dropped EXE
PID:3484 -
\??\c:\3djdp.exec:\3djdp.exe65⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxxrlll.exec:\fxxrlll.exe66⤵PID:3908
-
\??\c:\tnnhhb.exec:\tnnhhb.exe67⤵PID:2572
-
\??\c:\nnbthb.exec:\nnbthb.exe68⤵PID:2984
-
\??\c:\pjjvp.exec:\pjjvp.exe69⤵PID:1076
-
\??\c:\lffxrll.exec:\lffxrll.exe70⤵PID:3972
-
\??\c:\hhhbtn.exec:\hhhbtn.exe71⤵PID:2832
-
\??\c:\vvvpv.exec:\vvvpv.exe72⤵PID:1896
-
\??\c:\llrxlrr.exec:\llrxlrr.exe73⤵PID:232
-
\??\c:\9lrlfxx.exec:\9lrlfxx.exe74⤵PID:4000
-
\??\c:\bnnhtt.exec:\bnnhtt.exe75⤵PID:712
-
\??\c:\nhhbtn.exec:\nhhbtn.exe76⤵PID:780
-
\??\c:\jvpjd.exec:\jvpjd.exe77⤵PID:1396
-
\??\c:\lrxxrlf.exec:\lrxxrlf.exe78⤵PID:2576
-
\??\c:\hbnbbb.exec:\hbnbbb.exe79⤵PID:2760
-
\??\c:\1jdjd.exec:\1jdjd.exe80⤵PID:2940
-
\??\c:\rllrlff.exec:\rllrlff.exe81⤵PID:3356
-
\??\c:\lxllxrl.exec:\lxllxrl.exe82⤵
- System Location Discovery: System Language Discovery
PID:4544 -
\??\c:\bhnhtn.exec:\bhnhtn.exe83⤵PID:3936
-
\??\c:\ttnbtt.exec:\ttnbtt.exe84⤵PID:2644
-
\??\c:\3vvjd.exec:\3vvjd.exe85⤵PID:1936
-
\??\c:\fflfrxl.exec:\fflfrxl.exe86⤵PID:1312
-
\??\c:\hbnhhh.exec:\hbnhhh.exe87⤵PID:5060
-
\??\c:\ntbtbb.exec:\ntbtbb.exe88⤵PID:1032
-
\??\c:\pdpjd.exec:\pdpjd.exe89⤵PID:3852
-
\??\c:\dvpdd.exec:\dvpdd.exe90⤵PID:2392
-
\??\c:\rfffxrf.exec:\rfffxrf.exe91⤵PID:3304
-
\??\c:\ntbthh.exec:\ntbthh.exe92⤵PID:3492
-
\??\c:\hhhbbt.exec:\hhhbbt.exe93⤵PID:1656
-
\??\c:\vjvpv.exec:\vjvpv.exe94⤵PID:2656
-
\??\c:\rflfrrl.exec:\rflfrrl.exe95⤵PID:864
-
\??\c:\xflflff.exec:\xflflff.exe96⤵PID:4220
-
\??\c:\1thbhb.exec:\1thbhb.exe97⤵PID:1460
-
\??\c:\dpdvj.exec:\dpdvj.exe98⤵PID:4348
-
\??\c:\flrlxxr.exec:\flrlxxr.exe99⤵PID:3244
-
\??\c:\nnhbbt.exec:\nnhbbt.exe100⤵PID:2328
-
\??\c:\jvjdv.exec:\jvjdv.exe101⤵PID:4464
-
\??\c:\ddpjd.exec:\ddpjd.exe102⤵PID:2304
-
\??\c:\rrrllff.exec:\rrrllff.exe103⤵PID:1724
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe104⤵PID:4420
-
\??\c:\hthbtn.exec:\hthbtn.exe105⤵PID:3584
-
\??\c:\djpjd.exec:\djpjd.exe106⤵PID:4616
-
\??\c:\xxlllrf.exec:\xxlllrf.exe107⤵PID:2868
-
\??\c:\1rxfxrr.exec:\1rxfxrr.exe108⤵PID:4628
-
\??\c:\9nttnn.exec:\9nttnn.exe109⤵PID:4828
-
\??\c:\pjpjd.exec:\pjpjd.exe110⤵PID:2964
-
\??\c:\pvdvv.exec:\pvdvv.exe111⤵PID:4932
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe112⤵PID:3472
-
\??\c:\nhhbtn.exec:\nhhbtn.exe113⤵PID:5100
-
\??\c:\ddjjp.exec:\ddjjp.exe114⤵PID:4392
-
\??\c:\jvvpj.exec:\jvvpj.exe115⤵PID:1168
-
\??\c:\lrxrffx.exec:\lrxrffx.exe116⤵PID:4276
-
\??\c:\7hnnhn.exec:\7hnnhn.exe117⤵PID:4240
-
\??\c:\vjpjd.exec:\vjpjd.exe118⤵PID:1632
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe119⤵PID:2528
-
\??\c:\llxrffx.exec:\llxrffx.exe120⤵PID:2040
-
\??\c:\hthnth.exec:\hthnth.exe121⤵PID:3460
-
\??\c:\vppvv.exec:\vppvv.exe122⤵PID:4328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-