Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 23:27
Static task
static1
Behavioral task
behavioral1
Sample
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe
Resource
win7-20241010-en
General
-
Target
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe
-
Size
453KB
-
MD5
0f11cf5335407caf1fcfcf3c8bcb3c60
-
SHA1
0621a07c5ca3db8501175efb13168e7f51933bbd
-
SHA256
141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9
-
SHA512
d531d625880816b18cdd600559c9dce5097f19fe554d66876955330bed07202acf8dfef21f637fd0cd414c6b1bc4bd2fb036b12b666f7e96698fd57d0db43d34
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4376-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2704-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2020-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/740-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1048-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1272-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3952-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-892-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-1017-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-1192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4176-1454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4136-1458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2716 nbbnbt.exe 4672 5lfrfxl.exe 5024 1llfllx.exe 4936 htnbtt.exe 3000 jvpjv.exe 4560 rxxxxxf.exe 3560 pjvvj.exe 2704 hbthtb.exe 1388 pjdvp.exe 2484 3jdvp.exe 3264 dvjvv.exe 3804 1fxlxrf.exe 116 btnhbt.exe 3952 rlxllff.exe 2020 thhbtn.exe 3516 xxxlfxx.exe 532 nhbthb.exe 3932 dpjjv.exe 852 lffxlfl.exe 4300 htbnbt.exe 1704 nhbnhb.exe 4660 ddvpv.exe 4388 fflfxrl.exe 4496 nbbnbb.exe 4264 ppjpj.exe 4140 9rlxrlr.exe 3736 5nbnhb.exe 1924 rrxrllf.exe 1140 1tnbnh.exe 2200 frlxlfr.exe 212 htnnbh.exe 2388 xrxrrrl.exe 4572 nhbtnn.exe 2556 thnbbn.exe 1620 vjdvd.exe 2820 rrxrffx.exe 648 bhhbnh.exe 1108 hthtnh.exe 1600 1djvp.exe 4176 xxxrlll.exe 4404 btnthb.exe 4172 pddvp.exe 740 xxfrlrf.exe 2284 nnnhtn.exe 412 5vdvj.exe 60 5jjvv.exe 1392 7lrfllr.exe 4392 nnttnn.exe 4368 jddpj.exe 1048 xrfrlll.exe 1372 nhthhb.exe 448 hhnbtn.exe 5052 7jdvj.exe 5024 rfffrlx.exe 4256 bnbnhb.exe 4936 jdddv.exe 3532 3ffxllf.exe 4780 3lffxlf.exe 3016 nbbnhb.exe 320 9jjdd.exe 64 7vjvp.exe 3484 xlrffxx.exe 4824 lxxrxxx.exe 3332 5hthtt.exe -
resource yara_rule behavioral2/memory/4376-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2704-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2020-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1048-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1272-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3952-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-1192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4176-1454-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrlrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4376 wrote to memory of 2716 4376 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 82 PID 4376 wrote to memory of 2716 4376 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 82 PID 4376 wrote to memory of 2716 4376 141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe 82 PID 2716 wrote to memory of 4672 2716 nbbnbt.exe 83 PID 2716 wrote to memory of 4672 2716 nbbnbt.exe 83 PID 2716 wrote to memory of 4672 2716 nbbnbt.exe 83 PID 4672 wrote to memory of 5024 4672 5lfrfxl.exe 84 PID 4672 wrote to memory of 5024 4672 5lfrfxl.exe 84 PID 4672 wrote to memory of 5024 4672 5lfrfxl.exe 84 PID 5024 wrote to memory of 4936 5024 1llfllx.exe 85 PID 5024 wrote to memory of 4936 5024 1llfllx.exe 85 PID 5024 wrote to memory of 4936 5024 1llfllx.exe 85 PID 4936 wrote to memory of 3000 4936 htnbtt.exe 86 PID 4936 wrote to memory of 3000 4936 htnbtt.exe 86 PID 4936 wrote to memory of 3000 4936 htnbtt.exe 86 PID 3000 wrote to memory of 4560 3000 jvpjv.exe 87 PID 3000 wrote to memory of 4560 3000 jvpjv.exe 87 PID 3000 wrote to memory of 4560 3000 jvpjv.exe 87 PID 4560 wrote to memory of 3560 4560 rxxxxxf.exe 88 PID 4560 wrote to memory of 3560 4560 rxxxxxf.exe 88 PID 4560 wrote to memory of 3560 4560 rxxxxxf.exe 88 PID 3560 wrote to memory of 2704 3560 pjvvj.exe 89 PID 3560 wrote to memory of 2704 3560 pjvvj.exe 89 PID 3560 wrote to memory of 2704 3560 pjvvj.exe 89 PID 2704 wrote to memory of 1388 2704 hbthtb.exe 90 PID 2704 wrote to memory of 1388 2704 hbthtb.exe 90 PID 2704 wrote to memory of 1388 2704 hbthtb.exe 90 PID 1388 wrote to memory of 2484 1388 pjdvp.exe 91 PID 1388 wrote to memory of 2484 1388 pjdvp.exe 91 PID 1388 wrote to memory of 2484 1388 pjdvp.exe 91 PID 2484 wrote to memory of 3264 2484 3jdvp.exe 92 PID 2484 wrote to memory of 3264 2484 3jdvp.exe 92 PID 2484 wrote to memory of 3264 2484 3jdvp.exe 92 PID 3264 wrote to memory of 3804 3264 dvjvv.exe 93 PID 3264 wrote to memory of 3804 3264 dvjvv.exe 93 PID 3264 wrote to memory of 3804 3264 dvjvv.exe 93 PID 3804 wrote to memory of 116 3804 1fxlxrf.exe 94 PID 3804 wrote to memory of 116 3804 1fxlxrf.exe 94 PID 3804 wrote to memory of 116 3804 1fxlxrf.exe 94 PID 116 wrote to memory of 3952 116 btnhbt.exe 95 PID 116 wrote to memory of 3952 116 btnhbt.exe 95 PID 116 wrote to memory of 3952 116 btnhbt.exe 95 PID 3952 wrote to memory of 2020 3952 rlxllff.exe 96 PID 3952 wrote to memory of 2020 3952 rlxllff.exe 96 PID 3952 wrote to memory of 2020 3952 rlxllff.exe 96 PID 2020 wrote to memory of 3516 2020 thhbtn.exe 97 PID 2020 wrote to memory of 3516 2020 thhbtn.exe 97 PID 2020 wrote to memory of 3516 2020 thhbtn.exe 97 PID 3516 wrote to memory of 532 3516 xxxlfxx.exe 98 PID 3516 wrote to memory of 532 3516 xxxlfxx.exe 98 PID 3516 wrote to memory of 532 3516 xxxlfxx.exe 98 PID 532 wrote to memory of 3932 532 nhbthb.exe 99 PID 532 wrote to memory of 3932 532 nhbthb.exe 99 PID 532 wrote to memory of 3932 532 nhbthb.exe 99 PID 3932 wrote to memory of 852 3932 dpjjv.exe 100 PID 3932 wrote to memory of 852 3932 dpjjv.exe 100 PID 3932 wrote to memory of 852 3932 dpjjv.exe 100 PID 852 wrote to memory of 4300 852 lffxlfl.exe 101 PID 852 wrote to memory of 4300 852 lffxlfl.exe 101 PID 852 wrote to memory of 4300 852 lffxlfl.exe 101 PID 4300 wrote to memory of 1704 4300 htbnbt.exe 102 PID 4300 wrote to memory of 1704 4300 htbnbt.exe 102 PID 4300 wrote to memory of 1704 4300 htbnbt.exe 102 PID 1704 wrote to memory of 4660 1704 nhbnhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe"C:\Users\Admin\AppData\Local\Temp\141b38a326a9b515657f4f5df1c503c1a32172782afb53b877785fea99cd77a9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\nbbnbt.exec:\nbbnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5lfrfxl.exec:\5lfrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\1llfllx.exec:\1llfllx.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\htnbtt.exec:\htnbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jvpjv.exec:\jvpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\pjvvj.exec:\pjvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\hbthtb.exec:\hbthtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\pjdvp.exec:\pjdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\3jdvp.exec:\3jdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dvjvv.exec:\dvjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\1fxlxrf.exec:\1fxlxrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\btnhbt.exec:\btnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rlxllff.exec:\rlxllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\thhbtn.exec:\thhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\xxxlfxx.exec:\xxxlfxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\nhbthb.exec:\nhbthb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\dpjjv.exec:\dpjjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\lffxlfl.exec:\lffxlfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\htbnbt.exec:\htbnbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\nhbnhb.exec:\nhbnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\ddvpv.exec:\ddvpv.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4660 -
\??\c:\fflfxrl.exec:\fflfxrl.exe24⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nbbnbb.exec:\nbbnbb.exe25⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ppjpj.exec:\ppjpj.exe26⤵
- Executes dropped EXE
PID:4264 -
\??\c:\9rlxrlr.exec:\9rlxrlr.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\5nbnhb.exec:\5nbnhb.exe28⤵
- Executes dropped EXE
PID:3736 -
\??\c:\rrxrllf.exec:\rrxrllf.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1tnbnh.exec:\1tnbnh.exe30⤵
- Executes dropped EXE
PID:1140 -
\??\c:\frlxlfr.exec:\frlxlfr.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\htnnbh.exec:\htnnbh.exe32⤵
- Executes dropped EXE
PID:212 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nhbtnn.exec:\nhbtnn.exe34⤵
- Executes dropped EXE
PID:4572 -
\??\c:\thnbbn.exec:\thnbbn.exe35⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vjdvd.exec:\vjdvd.exe36⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrxrffx.exec:\rrxrffx.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bhhbnh.exec:\bhhbnh.exe38⤵
- Executes dropped EXE
PID:648 -
\??\c:\hthtnh.exec:\hthtnh.exe39⤵
- Executes dropped EXE
PID:1108 -
\??\c:\1djvp.exec:\1djvp.exe40⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xxxrlll.exec:\xxxrlll.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4176 -
\??\c:\btnthb.exec:\btnthb.exe42⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pddvp.exec:\pddvp.exe43⤵
- Executes dropped EXE
PID:4172 -
\??\c:\xxfrlrf.exec:\xxfrlrf.exe44⤵
- Executes dropped EXE
PID:740 -
\??\c:\nnnhtn.exec:\nnnhtn.exe45⤵
- Executes dropped EXE
PID:2284 -
\??\c:\5vdvj.exec:\5vdvj.exe46⤵
- Executes dropped EXE
PID:412 -
\??\c:\5jjvv.exec:\5jjvv.exe47⤵
- Executes dropped EXE
PID:60 -
\??\c:\7lrfllr.exec:\7lrfllr.exe48⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nnttnn.exec:\nnttnn.exe49⤵
- Executes dropped EXE
PID:4392 -
\??\c:\jddpj.exec:\jddpj.exe50⤵
- Executes dropped EXE
PID:4368 -
\??\c:\xrfrlll.exec:\xrfrlll.exe51⤵
- Executes dropped EXE
PID:1048 -
\??\c:\nhthhb.exec:\nhthhb.exe52⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hhnbtn.exec:\hhnbtn.exe53⤵
- Executes dropped EXE
PID:448 -
\??\c:\7jdvj.exec:\7jdvj.exe54⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rfffrlx.exec:\rfffrlx.exe55⤵
- Executes dropped EXE
PID:5024 -
\??\c:\bnbnhb.exec:\bnbnhb.exe56⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jdddv.exec:\jdddv.exe57⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3ffxllf.exec:\3ffxllf.exe58⤵
- Executes dropped EXE
PID:3532 -
\??\c:\3lffxlf.exec:\3lffxlf.exe59⤵
- Executes dropped EXE
PID:4780 -
\??\c:\nbbnhb.exec:\nbbnhb.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9jjdd.exec:\9jjdd.exe61⤵
- Executes dropped EXE
PID:320 -
\??\c:\7vjvp.exec:\7vjvp.exe62⤵
- Executes dropped EXE
PID:64 -
\??\c:\xlrffxx.exec:\xlrffxx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3484 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe64⤵
- Executes dropped EXE
PID:4824 -
\??\c:\5hthtt.exec:\5hthtt.exe65⤵
- Executes dropped EXE
PID:3332 -
\??\c:\vdjvd.exec:\vdjvd.exe66⤵PID:3412
-
\??\c:\xlfrffx.exec:\xlfrffx.exe67⤵PID:2860
-
\??\c:\nhbnht.exec:\nhbnht.exe68⤵PID:1752
-
\??\c:\5djvd.exec:\5djvd.exe69⤵PID:3140
-
\??\c:\vpvvj.exec:\vpvvj.exe70⤵PID:4252
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe71⤵PID:1272
-
\??\c:\bhnbtn.exec:\bhnbtn.exe72⤵PID:3952
-
\??\c:\nbbnbn.exec:\nbbnbn.exe73⤵PID:4756
-
\??\c:\dppdp.exec:\dppdp.exe74⤵PID:5068
-
\??\c:\frlxrlf.exec:\frlxrlf.exe75⤵PID:1896
-
\??\c:\nbnbnh.exec:\nbnbnh.exe76⤵PID:2244
-
\??\c:\jjpjj.exec:\jjpjj.exe77⤵PID:1120
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe78⤵PID:3528
-
\??\c:\tnnbnh.exec:\tnnbnh.exe79⤵PID:4912
-
\??\c:\jvvpd.exec:\jvvpd.exe80⤵PID:3520
-
\??\c:\vddpj.exec:\vddpj.exe81⤵PID:1704
-
\??\c:\frxllff.exec:\frxllff.exe82⤵PID:4164
-
\??\c:\hbtbhn.exec:\hbtbhn.exe83⤵PID:1680
-
\??\c:\nhthtn.exec:\nhthtn.exe84⤵PID:4708
-
\??\c:\jvpdp.exec:\jvpdp.exe85⤵PID:2772
-
\??\c:\dpjvp.exec:\dpjvp.exe86⤵PID:1472
-
\??\c:\xxfxrll.exec:\xxfxrll.exe87⤵PID:1332
-
\??\c:\hththb.exec:\hththb.exe88⤵PID:3480
-
\??\c:\htbtnh.exec:\htbtnh.exe89⤵PID:2764
-
\??\c:\vjpjv.exec:\vjpjv.exe90⤵PID:1668
-
\??\c:\jddpd.exec:\jddpd.exe91⤵PID:4880
-
\??\c:\frrfrlf.exec:\frrfrlf.exe92⤵PID:3540
-
\??\c:\btbthb.exec:\btbthb.exe93⤵PID:2016
-
\??\c:\vppjv.exec:\vppjv.exe94⤵PID:1140
-
\??\c:\dpppj.exec:\dpppj.exe95⤵PID:2464
-
\??\c:\xffrffx.exec:\xffrffx.exe96⤵PID:1624
-
\??\c:\3bthtn.exec:\3bthtn.exe97⤵PID:4940
-
\??\c:\djpjj.exec:\djpjj.exe98⤵PID:1664
-
\??\c:\lrxrffx.exec:\lrxrffx.exe99⤵PID:4024
-
\??\c:\tnthbb.exec:\tnthbb.exe100⤵PID:1812
-
\??\c:\tnhhbh.exec:\tnhhbh.exe101⤵PID:4924
-
\??\c:\ddjjp.exec:\ddjjp.exe102⤵PID:4864
-
\??\c:\xlrlxrr.exec:\xlrlxrr.exe103⤵PID:4292
-
\??\c:\nhhbtt.exec:\nhhbtt.exe104⤵PID:4688
-
\??\c:\pvpjj.exec:\pvpjj.exe105⤵PID:784
-
\??\c:\xxrrxrr.exec:\xxrrxrr.exe106⤵PID:5020
-
\??\c:\rrxlflf.exec:\rrxlflf.exe107⤵PID:3420
-
\??\c:\htthbt.exec:\htthbt.exe108⤵PID:4992
-
\??\c:\7vjjd.exec:\7vjjd.exe109⤵PID:1476
-
\??\c:\3rfxlxl.exec:\3rfxlxl.exe110⤵PID:4032
-
\??\c:\tnnhhb.exec:\tnnhhb.exe111⤵PID:2664
-
\??\c:\ttbthh.exec:\ttbthh.exe112⤵PID:2068
-
\??\c:\dvpjj.exec:\dvpjj.exe113⤵PID:4556
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe114⤵PID:2424
-
\??\c:\nbbttt.exec:\nbbttt.exe115⤵PID:1444
-
\??\c:\bbbtnt.exec:\bbbtnt.exe116⤵PID:4368
-
\??\c:\djvpd.exec:\djvpd.exe117⤵PID:4100
-
\??\c:\rlrlffx.exec:\rlrlffx.exe118⤵PID:1372
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe119⤵PID:1548
-
\??\c:\nhbbtt.exec:\nhbbtt.exe120⤵PID:3632
-
\??\c:\jdvpv.exec:\jdvpv.exe121⤵PID:3680
-
\??\c:\pddvv.exec:\pddvv.exe122⤵PID:3564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-