Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe
Resource
win7-20241010-en
General
-
Target
a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe
-
Size
455KB
-
MD5
635edd3910b63ffeff1ad3b39d528e4f
-
SHA1
53ddfa7c0f53ba53ff228b4971ce24d9a0e4f226
-
SHA256
a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a
-
SHA512
38eaca9916e832e10680cf5d3bcfc4c401196456cb1ecced49640a5009d97d0ad2582792f8ad065c6c29da53380e141f4e410daa2117b17baa802d299ae5ade3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRt:q7Tc2NYHUrAwfMp3CDRt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1320-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/804-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4840-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1124-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-816-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-883-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-920-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-1408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1360 xxxfxfx.exe 3196 bbnhbb.exe 4928 1jddv.exe 2104 5pddv.exe 4616 xrfxffl.exe 3208 7nhbtt.exe 1576 jjjdv.exe 2948 lfllfll.exe 3632 3ttthh.exe 4612 jdpjd.exe 2536 ntntbt.exe 4976 lfxfrff.exe 3504 1rlxfxr.exe 4536 thhbnn.exe 3964 7nbhbt.exe 804 7vvjv.exe 2256 tnnhbb.exe 1292 nnnhbt.exe 3308 ffxxxxf.exe 3648 rrrfxfx.exe 4840 pvdvp.exe 3256 xrxlffr.exe 3064 hbbnhb.exe 512 nbttnh.exe 1108 pjpvp.exe 184 fflfrrl.exe 1796 vpdvp.exe 4508 pvjdp.exe 2044 nbbthh.exe 4404 rlfxrlf.exe 4392 pdjdd.exe 3952 frxfrlf.exe 3536 vpdvv.exe 2508 hntnhh.exe 764 vpdpj.exe 1288 9xxrllx.exe 972 hhnbbt.exe 2204 vdjvp.exe 1124 bhnhtn.exe 4004 hnnhtt.exe 2800 ddvjj.exe 4524 9lfxlfx.exe 2004 thhbtt.exe 364 ppvdp.exe 2368 ppjvp.exe 1956 rfflffx.exe 1488 bnnbnh.exe 4600 7dpdv.exe 5052 xlllxfx.exe 1504 nhhbtn.exe 4984 hbthhb.exe 1100 jpdpj.exe 1076 xrxrffr.exe 2652 bbhtnn.exe 2472 1jpdv.exe 4900 vjpjd.exe 1116 rffxlfr.exe 3800 bhhnbh.exe 2976 jvpjd.exe 2948 rxrfxrx.exe 3724 bbnhhb.exe 2428 dvvvp.exe 1780 xxfxllx.exe 4980 7ttnnn.exe -
resource yara_rule behavioral2/memory/1320-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3964-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/804-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4840-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1108-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1124-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-816-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 1360 1320 a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe 83 PID 1320 wrote to memory of 1360 1320 a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe 83 PID 1320 wrote to memory of 1360 1320 a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe 83 PID 1360 wrote to memory of 3196 1360 xxxfxfx.exe 84 PID 1360 wrote to memory of 3196 1360 xxxfxfx.exe 84 PID 1360 wrote to memory of 3196 1360 xxxfxfx.exe 84 PID 3196 wrote to memory of 4928 3196 bbnhbb.exe 85 PID 3196 wrote to memory of 4928 3196 bbnhbb.exe 85 PID 3196 wrote to memory of 4928 3196 bbnhbb.exe 85 PID 4928 wrote to memory of 2104 4928 1jddv.exe 86 PID 4928 wrote to memory of 2104 4928 1jddv.exe 86 PID 4928 wrote to memory of 2104 4928 1jddv.exe 86 PID 2104 wrote to memory of 4616 2104 5pddv.exe 87 PID 2104 wrote to memory of 4616 2104 5pddv.exe 87 PID 2104 wrote to memory of 4616 2104 5pddv.exe 87 PID 4616 wrote to memory of 3208 4616 xrfxffl.exe 88 PID 4616 wrote to memory of 3208 4616 xrfxffl.exe 88 PID 4616 wrote to memory of 3208 4616 xrfxffl.exe 88 PID 3208 wrote to memory of 1576 3208 7nhbtt.exe 89 PID 3208 wrote to memory of 1576 3208 7nhbtt.exe 89 PID 3208 wrote to memory of 1576 3208 7nhbtt.exe 89 PID 1576 wrote to memory of 2948 1576 jjjdv.exe 90 PID 1576 wrote to memory of 2948 1576 jjjdv.exe 90 PID 1576 wrote to memory of 2948 1576 jjjdv.exe 90 PID 2948 wrote to memory of 3632 2948 lfllfll.exe 91 PID 2948 wrote to memory of 3632 2948 lfllfll.exe 91 PID 2948 wrote to memory of 3632 2948 lfllfll.exe 91 PID 3632 wrote to memory of 4612 3632 3ttthh.exe 92 PID 3632 wrote to memory of 4612 3632 3ttthh.exe 92 PID 3632 wrote to memory of 4612 3632 3ttthh.exe 92 PID 4612 wrote to memory of 2536 4612 jdpjd.exe 93 PID 4612 wrote to memory of 2536 4612 jdpjd.exe 93 PID 4612 wrote to memory of 2536 4612 jdpjd.exe 93 PID 2536 wrote to memory of 4976 2536 ntntbt.exe 94 PID 2536 wrote to memory of 4976 2536 ntntbt.exe 94 PID 2536 wrote to memory of 4976 2536 ntntbt.exe 94 PID 4976 wrote to memory of 3504 4976 lfxfrff.exe 95 PID 4976 wrote to memory of 3504 4976 lfxfrff.exe 95 PID 4976 wrote to memory of 3504 4976 lfxfrff.exe 95 PID 3504 wrote to memory of 4536 3504 1rlxfxr.exe 96 PID 3504 wrote to memory of 4536 3504 1rlxfxr.exe 96 PID 3504 wrote to memory of 4536 3504 1rlxfxr.exe 96 PID 4536 wrote to memory of 3964 4536 thhbnn.exe 97 PID 4536 wrote to memory of 3964 4536 thhbnn.exe 97 PID 4536 wrote to memory of 3964 4536 thhbnn.exe 97 PID 3964 wrote to memory of 804 3964 7nbhbt.exe 98 PID 3964 wrote to memory of 804 3964 7nbhbt.exe 98 PID 3964 wrote to memory of 804 3964 7nbhbt.exe 98 PID 804 wrote to memory of 2256 804 7vvjv.exe 99 PID 804 wrote to memory of 2256 804 7vvjv.exe 99 PID 804 wrote to memory of 2256 804 7vvjv.exe 99 PID 2256 wrote to memory of 1292 2256 tnnhbb.exe 100 PID 2256 wrote to memory of 1292 2256 tnnhbb.exe 100 PID 2256 wrote to memory of 1292 2256 tnnhbb.exe 100 PID 1292 wrote to memory of 3308 1292 nnnhbt.exe 101 PID 1292 wrote to memory of 3308 1292 nnnhbt.exe 101 PID 1292 wrote to memory of 3308 1292 nnnhbt.exe 101 PID 3308 wrote to memory of 3648 3308 ffxxxxf.exe 102 PID 3308 wrote to memory of 3648 3308 ffxxxxf.exe 102 PID 3308 wrote to memory of 3648 3308 ffxxxxf.exe 102 PID 3648 wrote to memory of 4840 3648 rrrfxfx.exe 103 PID 3648 wrote to memory of 4840 3648 rrrfxfx.exe 103 PID 3648 wrote to memory of 4840 3648 rrrfxfx.exe 103 PID 4840 wrote to memory of 3256 4840 pvdvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe"C:\Users\Admin\AppData\Local\Temp\a3f9af3e5542527f974d4b85b6c47fe2f1b5c50fbf4246d399c0b906efcadb6a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\bbnhbb.exec:\bbnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\1jddv.exec:\1jddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\5pddv.exec:\5pddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xrfxffl.exec:\xrfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7nhbtt.exec:\7nhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\jjjdv.exec:\jjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\lfllfll.exec:\lfllfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\3ttthh.exec:\3ttthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\jdpjd.exec:\jdpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\ntntbt.exec:\ntntbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lfxfrff.exec:\lfxfrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\1rlxfxr.exec:\1rlxfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\thhbnn.exec:\thhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\7nbhbt.exec:\7nbhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\7vvjv.exec:\7vvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\tnnhbb.exec:\tnnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nnnhbt.exec:\nnnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\ffxxxxf.exec:\ffxxxxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\rrrfxfx.exec:\rrrfxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\xrxlffr.exec:\xrxlffr.exe23⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hbbnhb.exec:\hbbnhb.exe24⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nbttnh.exec:\nbttnh.exe25⤵
- Executes dropped EXE
PID:512 -
\??\c:\pjpvp.exec:\pjpvp.exe26⤵
- Executes dropped EXE
PID:1108 -
\??\c:\fflfrrl.exec:\fflfrrl.exe27⤵
- Executes dropped EXE
PID:184 -
\??\c:\vpdvp.exec:\vpdvp.exe28⤵
- Executes dropped EXE
PID:1796 -
\??\c:\pvjdp.exec:\pvjdp.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nbbthh.exec:\nbbthh.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe31⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pdjdd.exec:\pdjdd.exe32⤵
- Executes dropped EXE
PID:4392 -
\??\c:\frxfrlf.exec:\frxfrlf.exe33⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vpdvv.exec:\vpdvv.exe34⤵
- Executes dropped EXE
PID:3536 -
\??\c:\hntnhh.exec:\hntnhh.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\vpdpj.exec:\vpdpj.exe36⤵
- Executes dropped EXE
PID:764 -
\??\c:\9xxrllx.exec:\9xxrllx.exe37⤵
- Executes dropped EXE
PID:1288 -
\??\c:\hhnbbt.exec:\hhnbbt.exe38⤵
- Executes dropped EXE
PID:972 -
\??\c:\vdjvp.exec:\vdjvp.exe39⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bhnhtn.exec:\bhnhtn.exe40⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hnnhtt.exec:\hnnhtt.exe41⤵
- Executes dropped EXE
PID:4004 -
\??\c:\ddvjj.exec:\ddvjj.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9lfxlfx.exec:\9lfxlfx.exe43⤵
- Executes dropped EXE
PID:4524 -
\??\c:\thhbtt.exec:\thhbtt.exe44⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ppvdp.exec:\ppvdp.exe45⤵
- Executes dropped EXE
PID:364 -
\??\c:\ppjvp.exec:\ppjvp.exe46⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rfflffx.exec:\rfflffx.exe47⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bnnbnh.exec:\bnnbnh.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7dpdv.exec:\7dpdv.exe49⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xlllxfx.exec:\xlllxfx.exe50⤵
- Executes dropped EXE
PID:5052 -
\??\c:\nhhbtn.exec:\nhhbtn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504 -
\??\c:\hbthhb.exec:\hbthhb.exe52⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jpdpj.exec:\jpdpj.exe53⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrxrffr.exec:\xrxrffr.exe54⤵
- Executes dropped EXE
PID:1076 -
\??\c:\bbhtnn.exec:\bbhtnn.exe55⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1jpdv.exec:\1jpdv.exe56⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vjpjd.exec:\vjpjd.exe57⤵
- Executes dropped EXE
PID:4900 -
\??\c:\rffxlfr.exec:\rffxlfr.exe58⤵
- Executes dropped EXE
PID:1116 -
\??\c:\bhhnbh.exec:\bhhnbh.exe59⤵
- Executes dropped EXE
PID:3800 -
\??\c:\jvpjd.exec:\jvpjd.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rxrfxrx.exec:\rxrfxrx.exe61⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnhhb.exec:\bbnhhb.exe62⤵
- Executes dropped EXE
PID:3724 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:2428 -
\??\c:\xxfxllx.exec:\xxfxllx.exe64⤵
- Executes dropped EXE
PID:1780 -
\??\c:\7ttnnn.exec:\7ttnnn.exe65⤵
- Executes dropped EXE
PID:4980 -
\??\c:\jvjvj.exec:\jvjvj.exe66⤵PID:4116
-
\??\c:\jpvpd.exec:\jpvpd.exe67⤵PID:2536
-
\??\c:\fxfrlfx.exec:\fxfrlfx.exe68⤵PID:1704
-
\??\c:\3nnbnn.exec:\3nnbnn.exe69⤵PID:4940
-
\??\c:\dvvjd.exec:\dvvjd.exe70⤵PID:3504
-
\??\c:\vppdp.exec:\vppdp.exe71⤵PID:1032
-
\??\c:\xxffxxx.exec:\xxffxxx.exe72⤵PID:964
-
\??\c:\7hbnhb.exec:\7hbnhb.exe73⤵PID:1580
-
\??\c:\vpvvv.exec:\vpvvv.exe74⤵PID:4008
-
\??\c:\llrlfff.exec:\llrlfff.exe75⤵PID:2492
-
\??\c:\9fllrrl.exec:\9fllrrl.exe76⤵PID:1232
-
\??\c:\bbtbhh.exec:\bbtbhh.exe77⤵PID:3024
-
\??\c:\9dvpv.exec:\9dvpv.exe78⤵PID:4936
-
\??\c:\rrlxllf.exec:\rrlxllf.exe79⤵PID:2908
-
\??\c:\nnnbnh.exec:\nnnbnh.exe80⤵PID:2152
-
\??\c:\pjpdd.exec:\pjpdd.exe81⤵PID:4840
-
\??\c:\5lrrlll.exec:\5lrrlll.exe82⤵PID:2984
-
\??\c:\7rrxrrl.exec:\7rrxrrl.exe83⤵PID:932
-
\??\c:\nhtnnn.exec:\nhtnnn.exe84⤵PID:1684
-
\??\c:\9hnnhh.exec:\9hnnhh.exe85⤵PID:1108
-
\??\c:\jjjvv.exec:\jjjvv.exe86⤵PID:3672
-
\??\c:\xxfxlfx.exec:\xxfxlfx.exe87⤵PID:2288
-
\??\c:\ntbbtb.exec:\ntbbtb.exe88⤵PID:4300
-
\??\c:\btttnh.exec:\btttnh.exe89⤵PID:912
-
\??\c:\7djjd.exec:\7djjd.exe90⤵PID:3852
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe91⤵PID:4540
-
\??\c:\nhbthb.exec:\nhbthb.exe92⤵PID:4076
-
\??\c:\dpdvp.exec:\dpdvp.exe93⤵PID:4324
-
\??\c:\1rlxrrx.exec:\1rlxrrx.exe94⤵PID:4392
-
\??\c:\5bnnhn.exec:\5bnnhn.exe95⤵PID:3520
-
\??\c:\pjdpd.exec:\pjdpd.exe96⤵PID:3972
-
\??\c:\3vddp.exec:\3vddp.exe97⤵PID:4152
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe98⤵PID:4572
-
\??\c:\nhthhh.exec:\nhthhh.exe99⤵PID:3260
-
\??\c:\9bhnhh.exec:\9bhnhh.exe100⤵PID:1288
-
\??\c:\pjpvv.exec:\pjpvv.exe101⤵PID:2372
-
\??\c:\lrffrrl.exec:\lrffrrl.exe102⤵PID:2204
-
\??\c:\tbbbbh.exec:\tbbbbh.exe103⤵PID:4124
-
\??\c:\tbnhtt.exec:\tbnhtt.exe104⤵PID:3548
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵PID:2464
-
\??\c:\1rlxxfl.exec:\1rlxxfl.exe106⤵PID:4476
-
\??\c:\3rffxrr.exec:\3rffxrr.exe107⤵PID:716
-
\??\c:\bhhbnn.exec:\bhhbnn.exe108⤵PID:2504
-
\??\c:\jjpjv.exec:\jjpjv.exe109⤵PID:2368
-
\??\c:\fffrrlr.exec:\fffrrlr.exe110⤵PID:916
-
\??\c:\9tbtnn.exec:\9tbtnn.exe111⤵PID:4472
-
\??\c:\dvdvp.exec:\dvdvp.exe112⤵PID:5000
-
\??\c:\rlrrlfx.exec:\rlrrlfx.exe113⤵PID:2276
-
\??\c:\rffxxxx.exec:\rffxxxx.exe114⤵PID:3148
-
\??\c:\hhnnnn.exec:\hhnnnn.exe115⤵PID:4568
-
\??\c:\vvdvp.exec:\vvdvp.exe116⤵PID:4820
-
\??\c:\lfxxrxx.exec:\lfxxrxx.exe117⤵PID:608
-
\??\c:\xfllxfx.exec:\xfllxfx.exe118⤵PID:4972
-
\??\c:\bhtnnn.exec:\bhtnnn.exe119⤵PID:4740
-
\??\c:\vvvvp.exec:\vvvvp.exe120⤵PID:1696
-
\??\c:\xflffxl.exec:\xflffxl.exe121⤵PID:1452
-
\??\c:\ttnhhn.exec:\ttnhhn.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-