Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 22:51
Static task
static1
Behavioral task
behavioral1
Sample
979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe
Resource
win7-20241010-en
General
-
Target
979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe
-
Size
454KB
-
MD5
1f8ebb5f32dba39b5d2fd24f1fa1b6f0
-
SHA1
857eaabab23326f1dd9db4f84a0716db7d23215e
-
SHA256
979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7f
-
SHA512
be083541a8b123c38ecca5de2e9b73bae1c91cbee28368ed8979848216e209ed9eed187ae596fe22ea045cc66d02268357245f20d7c6973df66131a0ba183e17
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1868-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/364-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1784-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5020-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/996-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-626-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-854-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1652-990-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-1570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4676 ppvjv.exe 3232 jjppp.exe 364 xflllll.exe 4664 bhhhhn.exe 668 vjvpj.exe 1008 jvddd.exe 4008 rrlrfxx.exe 4508 hnhbtt.exe 1408 tnbttt.exe 1736 lrlfxfx.exe 3488 vdjvv.exe 3456 hnnnnn.exe 4948 vvddd.exe 1664 ddvvv.exe 1784 1frrfff.exe 2388 ttbbbt.exe 5020 ttttnn.exe 3832 djvdp.exe 4796 bthhhn.exe 5032 3jppp.exe 1108 bhhthb.exe 2336 vvddj.exe 996 ffxrffx.exe 4728 ttnbht.exe 1892 dvjdv.exe 1396 lfrfxxx.exe 1228 rrfffff.exe 3664 bnbbbb.exe 3120 ppvjp.exe 1904 btnnhn.exe 4800 pjdjp.exe 2196 djddp.exe 1700 rfrfxrl.exe 4504 9hnnnn.exe 1604 7bttnt.exe 4164 xflffff.exe 4588 tnbbbh.exe 4736 lfxrlrr.exe 404 hbbttb.exe 4172 ppppv.exe 1816 hhnhhh.exe 2344 tthttb.exe 3220 dvjjd.exe 3588 rrrrflf.exe 220 hhnbtt.exe 3316 dpjjj.exe 4032 rrxxxff.exe 1684 nnbhnb.exe 2132 thttbb.exe 1068 7ppjv.exe 4492 lffrrll.exe 776 7tbbtt.exe 3356 pjddd.exe 2780 pvdvp.exe 1048 lrxlfxr.exe 5112 hbhtnh.exe 3444 jjpvv.exe 1844 9xfxrrl.exe 3752 fffxxxx.exe 3460 hhnhtn.exe 4020 jdddv.exe 3712 9pvvp.exe 5084 rlxrrrx.exe 4428 hhhhtt.exe -
resource yara_rule behavioral2/memory/1868-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/364-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1784-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5020-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/996-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4728-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4856-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2564-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-680-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 4676 1868 979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe 82 PID 1868 wrote to memory of 4676 1868 979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe 82 PID 1868 wrote to memory of 4676 1868 979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe 82 PID 4676 wrote to memory of 3232 4676 ppvjv.exe 83 PID 4676 wrote to memory of 3232 4676 ppvjv.exe 83 PID 4676 wrote to memory of 3232 4676 ppvjv.exe 83 PID 3232 wrote to memory of 364 3232 jjppp.exe 84 PID 3232 wrote to memory of 364 3232 jjppp.exe 84 PID 3232 wrote to memory of 364 3232 jjppp.exe 84 PID 364 wrote to memory of 4664 364 xflllll.exe 85 PID 364 wrote to memory of 4664 364 xflllll.exe 85 PID 364 wrote to memory of 4664 364 xflllll.exe 85 PID 4664 wrote to memory of 668 4664 bhhhhn.exe 86 PID 4664 wrote to memory of 668 4664 bhhhhn.exe 86 PID 4664 wrote to memory of 668 4664 bhhhhn.exe 86 PID 668 wrote to memory of 1008 668 vjvpj.exe 87 PID 668 wrote to memory of 1008 668 vjvpj.exe 87 PID 668 wrote to memory of 1008 668 vjvpj.exe 87 PID 1008 wrote to memory of 4008 1008 jvddd.exe 88 PID 1008 wrote to memory of 4008 1008 jvddd.exe 88 PID 1008 wrote to memory of 4008 1008 jvddd.exe 88 PID 4008 wrote to memory of 4508 4008 rrlrfxx.exe 89 PID 4008 wrote to memory of 4508 4008 rrlrfxx.exe 89 PID 4008 wrote to memory of 4508 4008 rrlrfxx.exe 89 PID 4508 wrote to memory of 1408 4508 hnhbtt.exe 90 PID 4508 wrote to memory of 1408 4508 hnhbtt.exe 90 PID 4508 wrote to memory of 1408 4508 hnhbtt.exe 90 PID 1408 wrote to memory of 1736 1408 tnbttt.exe 91 PID 1408 wrote to memory of 1736 1408 tnbttt.exe 91 PID 1408 wrote to memory of 1736 1408 tnbttt.exe 91 PID 1736 wrote to memory of 3488 1736 lrlfxfx.exe 92 PID 1736 wrote to memory of 3488 1736 lrlfxfx.exe 92 PID 1736 wrote to memory of 3488 1736 lrlfxfx.exe 92 PID 3488 wrote to memory of 3456 3488 vdjvv.exe 93 PID 3488 wrote to memory of 3456 3488 vdjvv.exe 93 PID 3488 wrote to memory of 3456 3488 vdjvv.exe 93 PID 3456 wrote to memory of 4948 3456 hnnnnn.exe 94 PID 3456 wrote to memory of 4948 3456 hnnnnn.exe 94 PID 3456 wrote to memory of 4948 3456 hnnnnn.exe 94 PID 4948 wrote to memory of 1664 4948 vvddd.exe 95 PID 4948 wrote to memory of 1664 4948 vvddd.exe 95 PID 4948 wrote to memory of 1664 4948 vvddd.exe 95 PID 1664 wrote to memory of 1784 1664 ddvvv.exe 96 PID 1664 wrote to memory of 1784 1664 ddvvv.exe 96 PID 1664 wrote to memory of 1784 1664 ddvvv.exe 96 PID 1784 wrote to memory of 2388 1784 1frrfff.exe 97 PID 1784 wrote to memory of 2388 1784 1frrfff.exe 97 PID 1784 wrote to memory of 2388 1784 1frrfff.exe 97 PID 2388 wrote to memory of 5020 2388 ttbbbt.exe 98 PID 2388 wrote to memory of 5020 2388 ttbbbt.exe 98 PID 2388 wrote to memory of 5020 2388 ttbbbt.exe 98 PID 5020 wrote to memory of 3832 5020 ttttnn.exe 99 PID 5020 wrote to memory of 3832 5020 ttttnn.exe 99 PID 5020 wrote to memory of 3832 5020 ttttnn.exe 99 PID 3832 wrote to memory of 4796 3832 djvdp.exe 100 PID 3832 wrote to memory of 4796 3832 djvdp.exe 100 PID 3832 wrote to memory of 4796 3832 djvdp.exe 100 PID 4796 wrote to memory of 5032 4796 bthhhn.exe 101 PID 4796 wrote to memory of 5032 4796 bthhhn.exe 101 PID 4796 wrote to memory of 5032 4796 bthhhn.exe 101 PID 5032 wrote to memory of 1108 5032 3jppp.exe 102 PID 5032 wrote to memory of 1108 5032 3jppp.exe 102 PID 5032 wrote to memory of 1108 5032 3jppp.exe 102 PID 1108 wrote to memory of 2336 1108 bhhthb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe"C:\Users\Admin\AppData\Local\Temp\979f5a317d2e59c715eb3475923e76ad596bcc5dde31f1294a57fca1e3a96d7fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ppvjv.exec:\ppvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\jjppp.exec:\jjppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\xflllll.exec:\xflllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\bhhhhn.exec:\bhhhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\vjvpj.exec:\vjvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\jvddd.exec:\jvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\rrlrfxx.exec:\rrlrfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\hnhbtt.exec:\hnhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\tnbttt.exec:\tnbttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\lrlfxfx.exec:\lrlfxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\vdjvv.exec:\vdjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\hnnnnn.exec:\hnnnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vvddd.exec:\vvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\ddvvv.exec:\ddvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\1frrfff.exec:\1frrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\ttbbbt.exec:\ttbbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ttttnn.exec:\ttttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\djvdp.exec:\djvdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\bthhhn.exec:\bthhhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3jppp.exec:\3jppp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\bhhthb.exec:\bhhthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vvddj.exec:\vvddj.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ffxrffx.exec:\ffxrffx.exe24⤵
- Executes dropped EXE
PID:996 -
\??\c:\ttnbht.exec:\ttnbht.exe25⤵
- Executes dropped EXE
PID:4728 -
\??\c:\dvjdv.exec:\dvjdv.exe26⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lfrfxxx.exec:\lfrfxxx.exe27⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rrfffff.exec:\rrfffff.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bnbbbb.exec:\bnbbbb.exe29⤵
- Executes dropped EXE
PID:3664 -
\??\c:\ppvjp.exec:\ppvjp.exe30⤵
- Executes dropped EXE
PID:3120 -
\??\c:\btnnhn.exec:\btnnhn.exe31⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pjdjp.exec:\pjdjp.exe32⤵
- Executes dropped EXE
PID:4800 -
\??\c:\djddp.exec:\djddp.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rfrfxrl.exec:\rfrfxrl.exe34⤵
- Executes dropped EXE
PID:1700 -
\??\c:\9hnnnn.exec:\9hnnnn.exe35⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7bttnt.exec:\7bttnt.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xflffff.exec:\xflffff.exe37⤵
- Executes dropped EXE
PID:4164 -
\??\c:\tnbbbh.exec:\tnbbbh.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe39⤵
- Executes dropped EXE
PID:4736 -
\??\c:\hbbttb.exec:\hbbttb.exe40⤵
- Executes dropped EXE
PID:404 -
\??\c:\ppppv.exec:\ppppv.exe41⤵
- Executes dropped EXE
PID:4172 -
\??\c:\hhnhhh.exec:\hhnhhh.exe42⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tthttb.exec:\tthttb.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvjjd.exec:\dvjjd.exe44⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rrrrflf.exec:\rrrrflf.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\hhnbtt.exec:\hhnbtt.exe46⤵
- Executes dropped EXE
PID:220 -
\??\c:\dpjjj.exec:\dpjjj.exe47⤵
- Executes dropped EXE
PID:3316 -
\??\c:\rrxxxff.exec:\rrxxxff.exe48⤵
- Executes dropped EXE
PID:4032 -
\??\c:\nnbhnb.exec:\nnbhnb.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\thttbb.exec:\thttbb.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7ppjv.exec:\7ppjv.exe51⤵
- Executes dropped EXE
PID:1068 -
\??\c:\lffrrll.exec:\lffrrll.exe52⤵
- Executes dropped EXE
PID:4492 -
\??\c:\7tbbtt.exec:\7tbbtt.exe53⤵
- Executes dropped EXE
PID:776 -
\??\c:\pjddd.exec:\pjddd.exe54⤵
- Executes dropped EXE
PID:3356 -
\??\c:\pvdvp.exec:\pvdvp.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe56⤵
- Executes dropped EXE
PID:1048 -
\??\c:\hbhtnh.exec:\hbhtnh.exe57⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jjpvv.exec:\jjpvv.exe58⤵
- Executes dropped EXE
PID:3444 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe59⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fffxxxx.exec:\fffxxxx.exe60⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hhnhtn.exec:\hhnhtn.exe61⤵
- Executes dropped EXE
PID:3460 -
\??\c:\jdddv.exec:\jdddv.exe62⤵
- Executes dropped EXE
PID:4020 -
\??\c:\9pvvp.exec:\9pvvp.exe63⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe64⤵
- Executes dropped EXE
PID:5084 -
\??\c:\hhhhtt.exec:\hhhhtt.exe65⤵
- Executes dropped EXE
PID:4428 -
\??\c:\3pvvp.exec:\3pvvp.exe66⤵PID:4748
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe67⤵PID:5036
-
\??\c:\tbtbtn.exec:\tbtbtn.exe68⤵PID:1176
-
\??\c:\pdjjd.exec:\pdjjd.exe69⤵PID:2984
-
\??\c:\rrfrxrx.exec:\rrfrxrx.exe70⤵PID:2552
-
\??\c:\frrrrrr.exec:\frrrrrr.exe71⤵PID:3732
-
\??\c:\bbhbhh.exec:\bbhbhh.exe72⤵PID:4928
-
\??\c:\jvdjv.exec:\jvdjv.exe73⤵PID:1320
-
\??\c:\lxrrrll.exec:\lxrrrll.exe74⤵PID:3492
-
\??\c:\flxrlll.exec:\flxrlll.exe75⤵PID:3044
-
\??\c:\bnbtnn.exec:\bnbtnn.exe76⤵PID:232
-
\??\c:\vpjpd.exec:\vpjpd.exe77⤵PID:4816
-
\??\c:\rrfflxl.exec:\rrfflxl.exe78⤵PID:4724
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe79⤵PID:3212
-
\??\c:\bbnbhn.exec:\bbnbhn.exe80⤵PID:5020
-
\??\c:\hbnnnt.exec:\hbnnnt.exe81⤵PID:3080
-
\??\c:\5djdd.exec:\5djdd.exe82⤵PID:1652
-
\??\c:\fxfllll.exec:\fxfllll.exe83⤵PID:4796
-
\??\c:\nhnhbn.exec:\nhnhbn.exe84⤵PID:5032
-
\??\c:\vvjvj.exec:\vvjvj.exe85⤵PID:1608
-
\??\c:\ddjvv.exec:\ddjvv.exe86⤵PID:4856
-
\??\c:\btttnn.exec:\btttnn.exe87⤵PID:4936
-
\??\c:\thnhhn.exec:\thnhhn.exe88⤵PID:1956
-
\??\c:\ddpjd.exec:\ddpjd.exe89⤵PID:1492
-
\??\c:\fffrllx.exec:\fffrllx.exe90⤵PID:452
-
\??\c:\7ttbbb.exec:\7ttbbb.exe91⤵PID:4616
-
\??\c:\nhhhbh.exec:\nhhhbh.exe92⤵PID:4972
-
\??\c:\jjpdv.exec:\jjpdv.exe93⤵PID:412
-
\??\c:\frflfrl.exec:\frflfrl.exe94⤵PID:4880
-
\??\c:\thbtnh.exec:\thbtnh.exe95⤵PID:920
-
\??\c:\nnnhbb.exec:\nnnhbb.exe96⤵PID:4600
-
\??\c:\xxllxfr.exec:\xxllxfr.exe97⤵PID:3420
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe98⤵PID:4308
-
\??\c:\btbthh.exec:\btbthh.exe99⤵PID:1860
-
\??\c:\djpdv.exec:\djpdv.exe100⤵PID:1700
-
\??\c:\xflxfxr.exec:\xflxfxr.exe101⤵PID:2676
-
\??\c:\xxxrlrl.exec:\xxxrlrl.exe102⤵PID:4504
-
\??\c:\vpvdd.exec:\vpvdd.exe103⤵PID:1604
-
\??\c:\rlfflrx.exec:\rlfflrx.exe104⤵PID:4164
-
\??\c:\nbtnht.exec:\nbtnht.exe105⤵PID:1332
-
\??\c:\thbntb.exec:\thbntb.exe106⤵PID:2248
-
\??\c:\ppvpj.exec:\ppvpj.exe107⤵PID:1288
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe108⤵PID:3516
-
\??\c:\bthhbh.exec:\bthhbh.exe109⤵PID:1644
-
\??\c:\bhthtb.exec:\bhthtb.exe110⤵PID:3396
-
\??\c:\ffrlfff.exec:\ffrlfff.exe111⤵PID:1400
-
\??\c:\bbhhbb.exec:\bbhhbb.exe112⤵PID:3996
-
\??\c:\3dpvv.exec:\3dpvv.exe113⤵PID:4012
-
\??\c:\jddvp.exec:\jddvp.exe114⤵PID:3820
-
\??\c:\llxfxrl.exec:\llxfxrl.exe115⤵PID:2548
-
\??\c:\hhthbt.exec:\hhthbt.exe116⤵PID:2988
-
\??\c:\hhhnhn.exec:\hhhnhn.exe117⤵PID:3652
-
\??\c:\jjvvv.exec:\jjvvv.exe118⤵PID:3096
-
\??\c:\rxrlrrx.exec:\rxrlrrx.exe119⤵PID:2132
-
\??\c:\bnbtnh.exec:\bnbtnh.exe120⤵PID:4744
-
\??\c:\pdvjv.exec:\pdvjv.exe121⤵PID:4460
-
\??\c:\vvppj.exec:\vvppj.exe122⤵PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-