Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 16:11
Static task
static1
Behavioral task
behavioral1
Sample
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe
Resource
win7-20240903-en
General
-
Target
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe
-
Size
453KB
-
MD5
677b4d591e9cf494125b2ea79c284e80
-
SHA1
6d249e1f6573690574c37a8b7e6ef72e2bc18234
-
SHA256
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8
-
SHA512
2645517ab7a3b1d5dbff29db278b89c16cb9ec0099151b76d25f6878f5dc206728f1cedc25e52eb7d786ef8d6ad5e0b359464ef65328fc482b28cdc61e71356f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4244-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3976-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1388-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2400-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1880-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2276-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2060-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4268-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1132-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2344-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/528-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3976 xxlflff.exe 2164 tnbhnb.exe 2388 jpdjv.exe 4944 lxfxlfl.exe 2844 vjjdd.exe 4760 fxfxfxf.exe 1388 vjdvv.exe 2400 fxxlfxl.exe 4800 vppdp.exe 2768 1llrfxx.exe 3172 9jddp.exe 1344 nbnhtb.exe 2980 7vpjd.exe 316 nnttbn.exe 1880 vpdjp.exe 1908 fxxlffx.exe 2016 xrxlxrf.exe 5028 hnnbtn.exe 3752 jvdvv.exe 4700 bthtbt.exe 2432 3bthbb.exe 448 tthbbb.exe 2276 9jpjv.exe 2892 jpvpj.exe 2060 fxlxlfx.exe 4256 thnhtt.exe 3664 rlxrrlf.exe 2824 vpdpv.exe 4268 rflxrlf.exe 2292 xxfxrrr.exe 3496 xflfrrl.exe 4092 pdvpj.exe 3232 ddpjj.exe 1124 rlllfxf.exe 1924 vpppp.exe 3200 1dvjd.exe 2780 fxxlxrx.exe 1620 tbbhbn.exe 1132 btnbtn.exe 372 jvpdv.exe 4972 ffffrxf.exe 3436 1bbttn.exe 4352 5btnnh.exe 4744 djpdp.exe 3268 tttnhh.exe 2340 bntnhn.exe 1868 vjjjv.exe 3112 rffxfxr.exe 1300 3thbnn.exe 3152 tnhbnn.exe 4944 rflfrrf.exe 3904 xrxrffr.exe 2144 nhbthb.exe 4200 httnhb.exe 4472 dpvjv.exe 3508 rrxxxxf.exe 3188 htthbb.exe 5024 pvdvp.exe 2588 dvvpv.exe 2560 5lrlfxr.exe 4456 thhbbt.exe 3252 9vdvj.exe 4804 lffrllx.exe 4056 nhhbtn.exe -
resource yara_rule behavioral2/memory/4244-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3976-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1388-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2400-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2016-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1880-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2276-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2060-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4268-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1132-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1512-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2344-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-687-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 3976 4244 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 82 PID 4244 wrote to memory of 3976 4244 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 82 PID 4244 wrote to memory of 3976 4244 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 82 PID 3976 wrote to memory of 2164 3976 xxlflff.exe 83 PID 3976 wrote to memory of 2164 3976 xxlflff.exe 83 PID 3976 wrote to memory of 2164 3976 xxlflff.exe 83 PID 2164 wrote to memory of 2388 2164 tnbhnb.exe 84 PID 2164 wrote to memory of 2388 2164 tnbhnb.exe 84 PID 2164 wrote to memory of 2388 2164 tnbhnb.exe 84 PID 2388 wrote to memory of 4944 2388 jpdjv.exe 85 PID 2388 wrote to memory of 4944 2388 jpdjv.exe 85 PID 2388 wrote to memory of 4944 2388 jpdjv.exe 85 PID 4944 wrote to memory of 2844 4944 lxfxlfl.exe 86 PID 4944 wrote to memory of 2844 4944 lxfxlfl.exe 86 PID 4944 wrote to memory of 2844 4944 lxfxlfl.exe 86 PID 2844 wrote to memory of 4760 2844 vjjdd.exe 87 PID 2844 wrote to memory of 4760 2844 vjjdd.exe 87 PID 2844 wrote to memory of 4760 2844 vjjdd.exe 87 PID 4760 wrote to memory of 1388 4760 fxfxfxf.exe 88 PID 4760 wrote to memory of 1388 4760 fxfxfxf.exe 88 PID 4760 wrote to memory of 1388 4760 fxfxfxf.exe 88 PID 1388 wrote to memory of 2400 1388 vjdvv.exe 89 PID 1388 wrote to memory of 2400 1388 vjdvv.exe 89 PID 1388 wrote to memory of 2400 1388 vjdvv.exe 89 PID 2400 wrote to memory of 4800 2400 fxxlfxl.exe 90 PID 2400 wrote to memory of 4800 2400 fxxlfxl.exe 90 PID 2400 wrote to memory of 4800 2400 fxxlfxl.exe 90 PID 4800 wrote to memory of 2768 4800 vppdp.exe 91 PID 4800 wrote to memory of 2768 4800 vppdp.exe 91 PID 4800 wrote to memory of 2768 4800 vppdp.exe 91 PID 2768 wrote to memory of 3172 2768 1llrfxx.exe 92 PID 2768 wrote to memory of 3172 2768 1llrfxx.exe 92 PID 2768 wrote to memory of 3172 2768 1llrfxx.exe 92 PID 3172 wrote to memory of 1344 3172 9jddp.exe 93 PID 3172 wrote to memory of 1344 3172 9jddp.exe 93 PID 3172 wrote to memory of 1344 3172 9jddp.exe 93 PID 1344 wrote to memory of 2980 1344 nbnhtb.exe 94 PID 1344 wrote to memory of 2980 1344 nbnhtb.exe 94 PID 1344 wrote to memory of 2980 1344 nbnhtb.exe 94 PID 2980 wrote to memory of 316 2980 7vpjd.exe 95 PID 2980 wrote to memory of 316 2980 7vpjd.exe 95 PID 2980 wrote to memory of 316 2980 7vpjd.exe 95 PID 316 wrote to memory of 1880 316 nnttbn.exe 96 PID 316 wrote to memory of 1880 316 nnttbn.exe 96 PID 316 wrote to memory of 1880 316 nnttbn.exe 96 PID 1880 wrote to memory of 1908 1880 vpdjp.exe 97 PID 1880 wrote to memory of 1908 1880 vpdjp.exe 97 PID 1880 wrote to memory of 1908 1880 vpdjp.exe 97 PID 1908 wrote to memory of 2016 1908 fxxlffx.exe 98 PID 1908 wrote to memory of 2016 1908 fxxlffx.exe 98 PID 1908 wrote to memory of 2016 1908 fxxlffx.exe 98 PID 2016 wrote to memory of 5028 2016 xrxlxrf.exe 99 PID 2016 wrote to memory of 5028 2016 xrxlxrf.exe 99 PID 2016 wrote to memory of 5028 2016 xrxlxrf.exe 99 PID 5028 wrote to memory of 3752 5028 hnnbtn.exe 100 PID 5028 wrote to memory of 3752 5028 hnnbtn.exe 100 PID 5028 wrote to memory of 3752 5028 hnnbtn.exe 100 PID 3752 wrote to memory of 4700 3752 jvdvv.exe 101 PID 3752 wrote to memory of 4700 3752 jvdvv.exe 101 PID 3752 wrote to memory of 4700 3752 jvdvv.exe 101 PID 4700 wrote to memory of 2432 4700 bthtbt.exe 102 PID 4700 wrote to memory of 2432 4700 bthtbt.exe 102 PID 4700 wrote to memory of 2432 4700 bthtbt.exe 102 PID 2432 wrote to memory of 448 2432 3bthbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe"C:\Users\Admin\AppData\Local\Temp\62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\xxlflff.exec:\xxlflff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\tnbhnb.exec:\tnbhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jpdjv.exec:\jpdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lxfxlfl.exec:\lxfxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vjjdd.exec:\vjjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\vjdvv.exec:\vjdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\fxxlfxl.exec:\fxxlfxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\vppdp.exec:\vppdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\1llrfxx.exec:\1llrfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\9jddp.exec:\9jddp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\nbnhtb.exec:\nbnhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\7vpjd.exec:\7vpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nnttbn.exec:\nnttbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vpdjp.exec:\vpdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\fxxlffx.exec:\fxxlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\xrxlxrf.exec:\xrxlxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\hnnbtn.exec:\hnnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jvdvv.exec:\jvdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\bthtbt.exec:\bthtbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\3bthbb.exec:\3bthbb.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tthbbb.exec:\tthbbb.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\9jpjv.exec:\9jpjv.exe24⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jpvpj.exec:\jpvpj.exe25⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxlxlfx.exec:\fxlxlfx.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\thnhtt.exec:\thnhtt.exe27⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rlxrrlf.exec:\rlxrrlf.exe28⤵
- Executes dropped EXE
PID:3664 -
\??\c:\vpdpv.exec:\vpdpv.exe29⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rflxrlf.exec:\rflxrlf.exe30⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe31⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xflfrrl.exec:\xflfrrl.exe32⤵
- Executes dropped EXE
PID:3496 -
\??\c:\pdvpj.exec:\pdvpj.exe33⤵
- Executes dropped EXE
PID:4092 -
\??\c:\ddpjj.exec:\ddpjj.exe34⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rlllfxf.exec:\rlllfxf.exe35⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vpppp.exec:\vpppp.exe36⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1dvjd.exec:\1dvjd.exe37⤵
- Executes dropped EXE
PID:3200 -
\??\c:\fxxlxrx.exec:\fxxlxrx.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tbbhbn.exec:\tbbhbn.exe39⤵
- Executes dropped EXE
PID:1620 -
\??\c:\btnbtn.exec:\btnbtn.exe40⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jvpdv.exec:\jvpdv.exe41⤵
- Executes dropped EXE
PID:372 -
\??\c:\ffffrxf.exec:\ffffrxf.exe42⤵
- Executes dropped EXE
PID:4972 -
\??\c:\1bbttn.exec:\1bbttn.exe43⤵
- Executes dropped EXE
PID:3436 -
\??\c:\5btnnh.exec:\5btnnh.exe44⤵
- Executes dropped EXE
PID:4352 -
\??\c:\djpdp.exec:\djpdp.exe45⤵
- Executes dropped EXE
PID:4744 -
\??\c:\tttnhh.exec:\tttnhh.exe46⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bntnhn.exec:\bntnhn.exe47⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vjjjv.exec:\vjjjv.exe48⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rffxfxr.exec:\rffxfxr.exe49⤵
- Executes dropped EXE
PID:3112 -
\??\c:\3thbnn.exec:\3thbnn.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\tnhbnn.exec:\tnhbnn.exe51⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rflfrrf.exec:\rflfrrf.exe52⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xrxrffr.exec:\xrxrffr.exe53⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nhbthb.exec:\nhbthb.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\httnhb.exec:\httnhb.exe55⤵
- Executes dropped EXE
PID:4200 -
\??\c:\dpvjv.exec:\dpvjv.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe57⤵
- Executes dropped EXE
PID:3508 -
\??\c:\htthbb.exec:\htthbb.exe58⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pvdvp.exec:\pvdvp.exe59⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dvvpv.exec:\dvvpv.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5lrlfxr.exec:\5lrlfxr.exe61⤵
- Executes dropped EXE
PID:2560 -
\??\c:\thhbbt.exec:\thhbbt.exe62⤵
- Executes dropped EXE
PID:4456 -
\??\c:\9vdvj.exec:\9vdvj.exe63⤵
- Executes dropped EXE
PID:3252 -
\??\c:\lffrllx.exec:\lffrllx.exe64⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nhhbtn.exec:\nhhbtn.exe65⤵
- Executes dropped EXE
PID:4056 -
\??\c:\7pjdp.exec:\7pjdp.exe66⤵PID:1344
-
\??\c:\1fllfrl.exec:\1fllfrl.exe67⤵PID:4960
-
\??\c:\1llxrlf.exec:\1llxrlf.exe68⤵PID:3536
-
\??\c:\tnhbtn.exec:\tnhbtn.exe69⤵PID:812
-
\??\c:\7jddv.exec:\7jddv.exe70⤵PID:3576
-
\??\c:\flffrlx.exec:\flffrlx.exe71⤵PID:3748
-
\??\c:\bthtth.exec:\bthtth.exe72⤵PID:1880
-
\??\c:\bnbtnn.exec:\bnbtnn.exe73⤵PID:840
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:2364
-
\??\c:\5lrrllx.exec:\5lrrllx.exe75⤵PID:5028
-
\??\c:\3ttnnt.exec:\3ttnnt.exe76⤵PID:3752
-
\??\c:\bntnhb.exec:\bntnhb.exe77⤵PID:1856
-
\??\c:\dpppp.exec:\dpppp.exe78⤵PID:4700
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe79⤵PID:1512
-
\??\c:\3tbbtt.exec:\3tbbtt.exe80⤵PID:4388
-
\??\c:\jdddd.exec:\jdddd.exe81⤵PID:4140
-
\??\c:\ddddv.exec:\ddddv.exe82⤵PID:4912
-
\??\c:\flrlffx.exec:\flrlffx.exe83⤵PID:5044
-
\??\c:\nttnnt.exec:\nttnnt.exe84⤵PID:4976
-
\??\c:\tnnbtn.exec:\tnnbtn.exe85⤵PID:2732
-
\??\c:\3vjdd.exec:\3vjdd.exe86⤵PID:2060
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe87⤵PID:3816
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe88⤵PID:2344
-
\??\c:\nnnhbb.exec:\nnnhbb.exe89⤵PID:3468
-
\??\c:\3pjdv.exec:\3pjdv.exe90⤵PID:1784
-
\??\c:\9llfxff.exec:\9llfxff.exe91⤵PID:1992
-
\??\c:\1nnhbb.exec:\1nnhbb.exe92⤵PID:3216
-
\??\c:\ttbttt.exec:\ttbttt.exe93⤵PID:2252
-
\??\c:\dpvdv.exec:\dpvdv.exe94⤵PID:3256
-
\??\c:\lflfllr.exec:\lflfllr.exe95⤵PID:2468
-
\??\c:\7bhbhh.exec:\7bhbhh.exe96⤵PID:2384
-
\??\c:\jddvv.exec:\jddvv.exe97⤵PID:1976
-
\??\c:\1vvvj.exec:\1vvvj.exe98⤵PID:1476
-
\??\c:\9llxllf.exec:\9llxllf.exe99⤵PID:3024
-
\??\c:\5ttbtt.exec:\5ttbtt.exe100⤵PID:4768
-
\??\c:\pdvdv.exec:\pdvdv.exe101⤵PID:3272
-
\??\c:\flrlllr.exec:\flrlllr.exe102⤵PID:4152
-
\??\c:\xxffxfx.exec:\xxffxfx.exe103⤵PID:1408
-
\??\c:\nbtbtn.exec:\nbtbtn.exe104⤵PID:3596
-
\??\c:\ppppp.exec:\ppppp.exe105⤵PID:1264
-
\??\c:\fffxrrl.exec:\fffxrrl.exe106⤵PID:3548
-
\??\c:\rrrllfx.exec:\rrrllfx.exe107⤵PID:1160
-
\??\c:\hnnnhb.exec:\hnnnhb.exe108⤵PID:4440
-
\??\c:\dppjd.exec:\dppjd.exe109⤵PID:2184
-
\??\c:\jjvpv.exec:\jjvpv.exe110⤵PID:2756
-
\??\c:\ffflxff.exec:\ffflxff.exe111⤵PID:1644
-
\??\c:\bbhhbb.exec:\bbhhbb.exe112⤵PID:4712
-
\??\c:\btbttt.exec:\btbttt.exe113⤵PID:2840
-
\??\c:\7vvpj.exec:\7vvpj.exe114⤵PID:4068
-
\??\c:\bnnhhn.exec:\bnnhhn.exe115⤵PID:2544
-
\??\c:\bbhhnn.exec:\bbhhnn.exe116⤵PID:4044
-
\??\c:\pdjdp.exec:\pdjdp.exe117⤵PID:4196
-
\??\c:\flrfxxx.exec:\flrfxxx.exe118⤵PID:3464
-
\??\c:\xllffrl.exec:\xllffrl.exe119⤵PID:4544
-
\??\c:\hhhbbb.exec:\hhhbbb.exe120⤵PID:3640
-
\??\c:\jjddv.exec:\jjddv.exe121⤵PID:3180
-
\??\c:\1rlfrlf.exec:\1rlfrlf.exe122⤵PID:4200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-