Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 23:13
Behavioral task
behavioral1
Sample
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe
Resource
win7-20240903-en
General
-
Target
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe
-
Size
331KB
-
MD5
36cd88908d3cd56f0b39bd788def1edb
-
SHA1
3df68d6be00757ebead6b7af7110c6b40ed27691
-
SHA256
79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46
-
SHA512
c3cf0fe5d65db0157660235dfd639ab20cffcbb8d78dba4de7189ba47122201accef3d5fd6b4978f66a0b0a3a67d8b19fbf142497ff16184186abb0c7a7faf5a
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeU:R4wFHoSHYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4872-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2464-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3308-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/120-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3612-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3920-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1900-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-448-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1244-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-919-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-1054-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-1073-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2348 pvdpd.exe 4620 llfxrrl.exe 2036 nntntt.exe 1644 vdddj.exe 4804 dvdvp.exe 2060 llfrlfx.exe 2840 9rlfrrf.exe 2464 ttntnn.exe 644 9nhtnn.exe 1616 djjjd.exe 8 tthbtn.exe 628 llllffx.exe 312 vdpjd.exe 4952 vvdvv.exe 4860 lrlrllf.exe 3308 7rlxllf.exe 2280 hhnhbt.exe 1800 bbnbtn.exe 4500 vpvvp.exe 4372 rllxrlf.exe 320 dpdpd.exe 1140 rfrlffx.exe 1952 jddjj.exe 2664 xrrlfff.exe 3620 jdddd.exe 1384 lxlflll.exe 3716 bbnbtn.exe 3868 hhbttn.exe 1924 rxfxllx.exe 4368 djddv.exe 4176 lflffxx.exe 4412 bbhbnn.exe 3168 1fffxfx.exe 1360 3rffxll.exe 4564 dvppj.exe 1820 frrrllf.exe 1472 ntnnbt.exe 4388 dpjjd.exe 660 pdjdv.exe 2516 9bbtnn.exe 3128 3hnhtt.exe 2588 xrrllfx.exe 120 nnnhbb.exe 3772 ppjvj.exe 2392 9xrlxxx.exe 3552 xlxlffr.exe 4424 hnbtbt.exe 3120 dvvpj.exe 2760 llfrlrf.exe 4820 thtnhb.exe 3612 vpjdp.exe 4456 rffxrxr.exe 544 thnbtt.exe 5064 9dvpd.exe 3352 ppdpd.exe 392 rxlffxx.exe 4988 ntnhhn.exe 4816 jvddv.exe 1436 lxxrffx.exe 1520 xflfrlf.exe 1644 bthbtn.exe 2176 7ttbbn.exe 2040 dpvdv.exe 3336 xrfrlfx.exe -
resource yara_rule behavioral2/memory/4872-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bbf-3.dat upx behavioral2/memory/4872-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023ca0-8.dat upx behavioral2/memory/2348-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb2-11.dat upx behavioral2/files/0x0007000000023cb3-20.dat upx behavioral2/memory/2036-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4620-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb4-24.dat upx behavioral2/files/0x0007000000023cb5-28.dat upx behavioral2/memory/2060-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb7-33.dat upx behavioral2/memory/2840-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2060-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cb8-38.dat upx behavioral2/files/0x0007000000023cb9-42.dat upx behavioral2/memory/2464-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cba-47.dat upx behavioral2/memory/644-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbb-52.dat upx behavioral2/memory/1616-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbc-57.dat upx behavioral2/memory/8-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbd-62.dat upx behavioral2/memory/628-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/312-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbe-69.dat upx behavioral2/files/0x0007000000023cc0-77.dat upx behavioral2/memory/3308-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4860-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cbf-73.dat upx behavioral2/files/0x0009000000023ca1-82.dat upx behavioral2/memory/2280-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-86.dat upx behavioral2/files/0x0007000000023cc2-91.dat upx behavioral2/files/0x0007000000023cc3-97.dat upx behavioral2/memory/4500-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc4-100.dat upx behavioral2/files/0x0007000000023cc5-104.dat upx behavioral2/memory/320-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-109.dat upx behavioral2/files/0x0007000000023cc7-112.dat upx behavioral2/files/0x0007000000023cc8-117.dat upx behavioral2/memory/2664-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cca-124.dat upx behavioral2/memory/3620-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc1-127.dat upx behavioral2/files/0x0007000000023ccb-132.dat upx behavioral2/memory/1384-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3868-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-137.dat upx behavioral2/files/0x0007000000023ccd-141.dat upx behavioral2/memory/1924-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-146.dat upx behavioral2/files/0x0007000000023ccf-150.dat upx behavioral2/memory/4412-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1360-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4564-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1472-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4388-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/660-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/120-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3772-185-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4872 wrote to memory of 2348 4872 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 83 PID 4872 wrote to memory of 2348 4872 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 83 PID 4872 wrote to memory of 2348 4872 79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe 83 PID 2348 wrote to memory of 4620 2348 pvdpd.exe 84 PID 2348 wrote to memory of 4620 2348 pvdpd.exe 84 PID 2348 wrote to memory of 4620 2348 pvdpd.exe 84 PID 4620 wrote to memory of 2036 4620 llfxrrl.exe 85 PID 4620 wrote to memory of 2036 4620 llfxrrl.exe 85 PID 4620 wrote to memory of 2036 4620 llfxrrl.exe 85 PID 2036 wrote to memory of 1644 2036 nntntt.exe 86 PID 2036 wrote to memory of 1644 2036 nntntt.exe 86 PID 2036 wrote to memory of 1644 2036 nntntt.exe 86 PID 1644 wrote to memory of 4804 1644 vdddj.exe 87 PID 1644 wrote to memory of 4804 1644 vdddj.exe 87 PID 1644 wrote to memory of 4804 1644 vdddj.exe 87 PID 4804 wrote to memory of 2060 4804 dvdvp.exe 88 PID 4804 wrote to memory of 2060 4804 dvdvp.exe 88 PID 4804 wrote to memory of 2060 4804 dvdvp.exe 88 PID 2060 wrote to memory of 2840 2060 llfrlfx.exe 89 PID 2060 wrote to memory of 2840 2060 llfrlfx.exe 89 PID 2060 wrote to memory of 2840 2060 llfrlfx.exe 89 PID 2840 wrote to memory of 2464 2840 9rlfrrf.exe 90 PID 2840 wrote to memory of 2464 2840 9rlfrrf.exe 90 PID 2840 wrote to memory of 2464 2840 9rlfrrf.exe 90 PID 2464 wrote to memory of 644 2464 ttntnn.exe 91 PID 2464 wrote to memory of 644 2464 ttntnn.exe 91 PID 2464 wrote to memory of 644 2464 ttntnn.exe 91 PID 644 wrote to memory of 1616 644 9nhtnn.exe 92 PID 644 wrote to memory of 1616 644 9nhtnn.exe 92 PID 644 wrote to memory of 1616 644 9nhtnn.exe 92 PID 1616 wrote to memory of 8 1616 djjjd.exe 93 PID 1616 wrote to memory of 8 1616 djjjd.exe 93 PID 1616 wrote to memory of 8 1616 djjjd.exe 93 PID 8 wrote to memory of 628 8 tthbtn.exe 94 PID 8 wrote to memory of 628 8 tthbtn.exe 94 PID 8 wrote to memory of 628 8 tthbtn.exe 94 PID 628 wrote to memory of 312 628 llllffx.exe 95 PID 628 wrote to memory of 312 628 llllffx.exe 95 PID 628 wrote to memory of 312 628 llllffx.exe 95 PID 312 wrote to memory of 4952 312 vdpjd.exe 96 PID 312 wrote to memory of 4952 312 vdpjd.exe 96 PID 312 wrote to memory of 4952 312 vdpjd.exe 96 PID 4952 wrote to memory of 4860 4952 vvdvv.exe 97 PID 4952 wrote to memory of 4860 4952 vvdvv.exe 97 PID 4952 wrote to memory of 4860 4952 vvdvv.exe 97 PID 4860 wrote to memory of 3308 4860 lrlrllf.exe 98 PID 4860 wrote to memory of 3308 4860 lrlrllf.exe 98 PID 4860 wrote to memory of 3308 4860 lrlrllf.exe 98 PID 3308 wrote to memory of 2280 3308 7rlxllf.exe 99 PID 3308 wrote to memory of 2280 3308 7rlxllf.exe 99 PID 3308 wrote to memory of 2280 3308 7rlxllf.exe 99 PID 2280 wrote to memory of 1800 2280 hhnhbt.exe 100 PID 2280 wrote to memory of 1800 2280 hhnhbt.exe 100 PID 2280 wrote to memory of 1800 2280 hhnhbt.exe 100 PID 1800 wrote to memory of 4500 1800 bbnbtn.exe 101 PID 1800 wrote to memory of 4500 1800 bbnbtn.exe 101 PID 1800 wrote to memory of 4500 1800 bbnbtn.exe 101 PID 4500 wrote to memory of 4372 4500 vpvvp.exe 102 PID 4500 wrote to memory of 4372 4500 vpvvp.exe 102 PID 4500 wrote to memory of 4372 4500 vpvvp.exe 102 PID 4372 wrote to memory of 320 4372 rllxrlf.exe 103 PID 4372 wrote to memory of 320 4372 rllxrlf.exe 103 PID 4372 wrote to memory of 320 4372 rllxrlf.exe 103 PID 320 wrote to memory of 1140 320 dpdpd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe"C:\Users\Admin\AppData\Local\Temp\79d5085a8820e90aff2fc626c204ed301074d0baa5ca0997e7737d934308af46.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\pvdpd.exec:\pvdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\llfxrrl.exec:\llfxrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\nntntt.exec:\nntntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\vdddj.exec:\vdddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dvdvp.exec:\dvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\llfrlfx.exec:\llfrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\9rlfrrf.exec:\9rlfrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\ttntnn.exec:\ttntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\9nhtnn.exec:\9nhtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\djjjd.exec:\djjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\tthbtn.exec:\tthbtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\llllffx.exec:\llllffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\vdpjd.exec:\vdpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\vvdvv.exec:\vvdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\lrlrllf.exec:\lrlrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\7rlxllf.exec:\7rlxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\hhnhbt.exec:\hhnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bbnbtn.exec:\bbnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\vpvvp.exec:\vpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\rllxrlf.exec:\rllxrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\dpdpd.exec:\dpdpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\rfrlffx.exec:\rfrlffx.exe23⤵
- Executes dropped EXE
PID:1140 -
\??\c:\jddjj.exec:\jddjj.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\xrrlfff.exec:\xrrlfff.exe25⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jdddd.exec:\jdddd.exe26⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lxlflll.exec:\lxlflll.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bbnbtn.exec:\bbnbtn.exe28⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hhbttn.exec:\hhbttn.exe29⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rxfxllx.exec:\rxfxllx.exe30⤵
- Executes dropped EXE
PID:1924 -
\??\c:\djddv.exec:\djddv.exe31⤵
- Executes dropped EXE
PID:4368 -
\??\c:\lflffxx.exec:\lflffxx.exe32⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bbhbnn.exec:\bbhbnn.exe33⤵
- Executes dropped EXE
PID:4412 -
\??\c:\1fffxfx.exec:\1fffxfx.exe34⤵
- Executes dropped EXE
PID:3168 -
\??\c:\3rffxll.exec:\3rffxll.exe35⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dvppj.exec:\dvppj.exe36⤵
- Executes dropped EXE
PID:4564 -
\??\c:\frrrllf.exec:\frrrllf.exe37⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ntnnbt.exec:\ntnnbt.exe38⤵
- Executes dropped EXE
PID:1472 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4388 -
\??\c:\pdjdv.exec:\pdjdv.exe40⤵
- Executes dropped EXE
PID:660 -
\??\c:\9bbtnn.exec:\9bbtnn.exe41⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3hnhtt.exec:\3hnhtt.exe42⤵
- Executes dropped EXE
PID:3128 -
\??\c:\xrrllfx.exec:\xrrllfx.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nnnhbb.exec:\nnnhbb.exe44⤵
- Executes dropped EXE
PID:120 -
\??\c:\ppjvj.exec:\ppjvj.exe45⤵
- Executes dropped EXE
PID:3772 -
\??\c:\9xrlxxx.exec:\9xrlxxx.exe46⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xlxlffr.exec:\xlxlffr.exe47⤵
- Executes dropped EXE
PID:3552 -
\??\c:\hnbtbt.exec:\hnbtbt.exe48⤵
- Executes dropped EXE
PID:4424 -
\??\c:\dvvpj.exec:\dvvpj.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3120 -
\??\c:\llfrlrf.exec:\llfrlrf.exe50⤵
- Executes dropped EXE
PID:2760 -
\??\c:\thtnhb.exec:\thtnhb.exe51⤵
- Executes dropped EXE
PID:4820 -
\??\c:\vpjdp.exec:\vpjdp.exe52⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rffxrxr.exec:\rffxrxr.exe53⤵
- Executes dropped EXE
PID:4456 -
\??\c:\thnbtt.exec:\thnbtt.exe54⤵
- Executes dropped EXE
PID:544 -
\??\c:\9dvpd.exec:\9dvpd.exe55⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ppdpd.exec:\ppdpd.exe56⤵
- Executes dropped EXE
PID:3352 -
\??\c:\rxlffxx.exec:\rxlffxx.exe57⤵
- Executes dropped EXE
PID:392 -
\??\c:\ntnhhn.exec:\ntnhhn.exe58⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jvddv.exec:\jvddv.exe59⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lxxrffx.exec:\lxxrffx.exe60⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xflfrlf.exec:\xflfrlf.exe61⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bthbtn.exec:\bthbtn.exe62⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7ttbbn.exec:\7ttbbn.exe63⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dpvdv.exec:\dpvdv.exe64⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrfrlfx.exec:\xrfrlfx.exe65⤵
- Executes dropped EXE
PID:3336 -
\??\c:\hntnhh.exec:\hntnhh.exe66⤵PID:2572
-
\??\c:\nhhbth.exec:\nhhbth.exe67⤵PID:4892
-
\??\c:\pddpd.exec:\pddpd.exe68⤵PID:4148
-
\??\c:\fffrllx.exec:\fffrllx.exe69⤵PID:3644
-
\??\c:\bntthh.exec:\bntthh.exe70⤵PID:4300
-
\??\c:\tbbnhn.exec:\tbbnhn.exe71⤵PID:212
-
\??\c:\vpjdv.exec:\vpjdv.exe72⤵PID:5016
-
\??\c:\vjjdv.exec:\vjjdv.exe73⤵PID:3356
-
\??\c:\rrxrffr.exec:\rrxrffr.exe74⤵PID:2852
-
\??\c:\bbnhtn.exec:\bbnhtn.exe75⤵PID:312
-
\??\c:\vjjvj.exec:\vjjvj.exe76⤵PID:3920
-
\??\c:\1vjvp.exec:\1vjvp.exe77⤵PID:1400
-
\??\c:\rlflxxr.exec:\rlflxxr.exe78⤵PID:1900
-
\??\c:\thhbtn.exec:\thhbtn.exe79⤵PID:4948
-
\??\c:\ntbbtt.exec:\ntbbtt.exe80⤵PID:2072
-
\??\c:\fxlxxfl.exec:\fxlxxfl.exe81⤵PID:3448
-
\??\c:\tntttt.exec:\tntttt.exe82⤵PID:4500
-
\??\c:\tnbhhn.exec:\tnbhhn.exe83⤵PID:1376
-
\??\c:\vdddd.exec:\vdddd.exe84⤵PID:1244
-
\??\c:\frfxrrl.exec:\frfxrrl.exe85⤵PID:4284
-
\??\c:\tnthbh.exec:\tnthbh.exe86⤵PID:3600
-
\??\c:\tnbnhb.exec:\tnbnhb.exe87⤵PID:568
-
\??\c:\jppjd.exec:\jppjd.exe88⤵PID:4760
-
\??\c:\xffxxrr.exec:\xffxxrr.exe89⤵
- System Location Discovery: System Language Discovery
PID:4236 -
\??\c:\ntntnn.exec:\ntntnn.exe90⤵PID:4044
-
\??\c:\hthhbn.exec:\hthhbn.exe91⤵PID:2228
-
\??\c:\djdvj.exec:\djdvj.exe92⤵PID:3700
-
\??\c:\vvpjd.exec:\vvpjd.exe93⤵PID:4232
-
\??\c:\fxffxrf.exec:\fxffxrf.exe94⤵PID:1928
-
\??\c:\hhhbbb.exec:\hhhbbb.exe95⤵PID:848
-
\??\c:\hbbbtt.exec:\hbbbtt.exe96⤵PID:3628
-
\??\c:\jdddj.exec:\jdddj.exe97⤵PID:1356
-
\??\c:\lrffxfr.exec:\lrffxfr.exe98⤵PID:1012
-
\??\c:\fxrlxxl.exec:\fxrlxxl.exe99⤵PID:704
-
\??\c:\bbbbtt.exec:\bbbbtt.exe100⤵PID:1160
-
\??\c:\5vvpj.exec:\5vvpj.exe101⤵PID:2860
-
\??\c:\pvdpj.exec:\pvdpj.exe102⤵PID:3168
-
\??\c:\lffrxrf.exec:\lffrxrf.exe103⤵PID:2368
-
\??\c:\ttttbb.exec:\ttttbb.exe104⤵PID:4564
-
\??\c:\9nbtbb.exec:\9nbtbb.exe105⤵PID:1820
-
\??\c:\ppppv.exec:\ppppv.exe106⤵PID:1472
-
\??\c:\5jdpd.exec:\5jdpd.exe107⤵PID:2616
-
\??\c:\rflfxxx.exec:\rflfxxx.exe108⤵PID:560
-
\??\c:\hhbtnn.exec:\hhbtnn.exe109⤵PID:4832
-
\??\c:\pjpvv.exec:\pjpvv.exe110⤵PID:2444
-
\??\c:\jvdvv.exec:\jvdvv.exe111⤵PID:5116
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe112⤵
- System Location Discovery: System Language Discovery
PID:4676 -
\??\c:\nnhhbb.exec:\nnhhbb.exe113⤵PID:3188
-
\??\c:\1tnhbb.exec:\1tnhbb.exe114⤵PID:1636
-
\??\c:\3jdvv.exec:\3jdvv.exe115⤵PID:4928
-
\??\c:\7rlfxfx.exec:\7rlfxfx.exe116⤵PID:3372
-
\??\c:\bbnntt.exec:\bbnntt.exe117⤵PID:4704
-
\??\c:\htttnt.exec:\htttnt.exe118⤵PID:5076
-
\??\c:\pppjj.exec:\pppjj.exe119⤵PID:2760
-
\??\c:\3lrxrlf.exec:\3lrxrlf.exe120⤵PID:1948
-
\??\c:\9lffrll.exec:\9lffrll.exe121⤵PID:4656
-
\??\c:\9btttt.exec:\9btttt.exe122⤵PID:4136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-