Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 00:32
Static task
static1
Behavioral task
behavioral1
Sample
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
Resource
win7-20240903-en
General
-
Target
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe
-
Size
456KB
-
MD5
a0682084762c8b43e2b90c401f22143f
-
SHA1
a4058f7ec326914611cf8081a70187f017b6c74c
-
SHA256
b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9
-
SHA512
c51285661f46543e219d584525a98f0d17b57656b0535f5336d79dd889a7a7c7113ee7b5e9e3e702555ac1f03d6eb94f34882ac16a3d9e933e4425196bc9156d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/664-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4044-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2792-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4284-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/876-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3076-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2552-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2892-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/772-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-1114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-1320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-1644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4472 lllffxx.exe 1624 1tbbtb.exe 3504 dvdvv.exe 4044 jdjdj.exe 3220 xxfffff.exe 2792 nnntnh.exe 3412 pdjdd.exe 3888 xxxxrrr.exe 3056 nttnnn.exe 2736 nhbthh.exe 4588 dvddd.exe 2384 lrfxrrl.exe 3460 xflffff.exe 1912 thbnnt.exe 3252 jvjdd.exe 3628 pjdvd.exe 3032 flxrlll.exe 3076 tntnhb.exe 4488 pdpjd.exe 876 7jjjd.exe 2008 3xxrfff.exe 1664 hbhthn.exe 2820 hthbtt.exe 4364 9pvvv.exe 2228 xfrlfxx.exe 3388 xfffllr.exe 2932 vpdvp.exe 1584 pvjdv.exe 1748 flllfff.exe 4388 9nhbbb.exe 4540 nbhhtb.exe 1152 9pjvv.exe 1696 lflxxrr.exe 3632 fxfrlrr.exe 1564 btbtnn.exe 3972 nbhbtt.exe 4260 pjvpv.exe 4284 rxrrrrl.exe 4256 xrffllf.exe 2928 7tbnht.exe 4536 ddpjp.exe 1560 jjvvv.exe 1444 xfrrfff.exe 4584 ntnhhh.exe 4380 5ttbtt.exe 2016 jpjvp.exe 2816 pjppj.exe 3920 rxfxxfx.exe 3660 bbhnnb.exe 3456 5bbthh.exe 4316 7jppj.exe 3424 rllfxxx.exe 4100 fxfxrrr.exe 2792 bthbtb.exe 2796 jddvd.exe 232 jdppj.exe 2624 rxxllfx.exe 2916 3hhbbh.exe 4572 tntnhh.exe 364 5jdvp.exe 904 xlrlfxx.exe 1092 llrxxlx.exe 2812 nhnhbb.exe 4340 vjpvp.exe -
resource yara_rule behavioral2/memory/664-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4044-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2792-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4284-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/876-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3076-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2552-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2892-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/772-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 664 wrote to memory of 4472 664 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 83 PID 664 wrote to memory of 4472 664 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 83 PID 664 wrote to memory of 4472 664 b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe 83 PID 4472 wrote to memory of 1624 4472 lllffxx.exe 84 PID 4472 wrote to memory of 1624 4472 lllffxx.exe 84 PID 4472 wrote to memory of 1624 4472 lllffxx.exe 84 PID 1624 wrote to memory of 3504 1624 1tbbtb.exe 85 PID 1624 wrote to memory of 3504 1624 1tbbtb.exe 85 PID 1624 wrote to memory of 3504 1624 1tbbtb.exe 85 PID 3504 wrote to memory of 4044 3504 dvdvv.exe 86 PID 3504 wrote to memory of 4044 3504 dvdvv.exe 86 PID 3504 wrote to memory of 4044 3504 dvdvv.exe 86 PID 4044 wrote to memory of 3220 4044 jdjdj.exe 87 PID 4044 wrote to memory of 3220 4044 jdjdj.exe 87 PID 4044 wrote to memory of 3220 4044 jdjdj.exe 87 PID 3220 wrote to memory of 2792 3220 xxfffff.exe 136 PID 3220 wrote to memory of 2792 3220 xxfffff.exe 136 PID 3220 wrote to memory of 2792 3220 xxfffff.exe 136 PID 2792 wrote to memory of 3412 2792 nnntnh.exe 89 PID 2792 wrote to memory of 3412 2792 nnntnh.exe 89 PID 2792 wrote to memory of 3412 2792 nnntnh.exe 89 PID 3412 wrote to memory of 3888 3412 pdjdd.exe 90 PID 3412 wrote to memory of 3888 3412 pdjdd.exe 90 PID 3412 wrote to memory of 3888 3412 pdjdd.exe 90 PID 3888 wrote to memory of 3056 3888 xxxxrrr.exe 91 PID 3888 wrote to memory of 3056 3888 xxxxrrr.exe 91 PID 3888 wrote to memory of 3056 3888 xxxxrrr.exe 91 PID 3056 wrote to memory of 2736 3056 nttnnn.exe 92 PID 3056 wrote to memory of 2736 3056 nttnnn.exe 92 PID 3056 wrote to memory of 2736 3056 nttnnn.exe 92 PID 2736 wrote to memory of 4588 2736 nhbthh.exe 93 PID 2736 wrote to memory of 4588 2736 nhbthh.exe 93 PID 2736 wrote to memory of 4588 2736 nhbthh.exe 93 PID 4588 wrote to memory of 2384 4588 dvddd.exe 94 PID 4588 wrote to memory of 2384 4588 dvddd.exe 94 PID 4588 wrote to memory of 2384 4588 dvddd.exe 94 PID 2384 wrote to memory of 3460 2384 lrfxrrl.exe 95 PID 2384 wrote to memory of 3460 2384 lrfxrrl.exe 95 PID 2384 wrote to memory of 3460 2384 lrfxrrl.exe 95 PID 3460 wrote to memory of 1912 3460 xflffff.exe 96 PID 3460 wrote to memory of 1912 3460 xflffff.exe 96 PID 3460 wrote to memory of 1912 3460 xflffff.exe 96 PID 1912 wrote to memory of 3252 1912 thbnnt.exe 97 PID 1912 wrote to memory of 3252 1912 thbnnt.exe 97 PID 1912 wrote to memory of 3252 1912 thbnnt.exe 97 PID 3252 wrote to memory of 3628 3252 jvjdd.exe 98 PID 3252 wrote to memory of 3628 3252 jvjdd.exe 98 PID 3252 wrote to memory of 3628 3252 jvjdd.exe 98 PID 3628 wrote to memory of 3032 3628 pjdvd.exe 99 PID 3628 wrote to memory of 3032 3628 pjdvd.exe 99 PID 3628 wrote to memory of 3032 3628 pjdvd.exe 99 PID 3032 wrote to memory of 3076 3032 flxrlll.exe 100 PID 3032 wrote to memory of 3076 3032 flxrlll.exe 100 PID 3032 wrote to memory of 3076 3032 flxrlll.exe 100 PID 3076 wrote to memory of 4488 3076 tntnhb.exe 101 PID 3076 wrote to memory of 4488 3076 tntnhb.exe 101 PID 3076 wrote to memory of 4488 3076 tntnhb.exe 101 PID 4488 wrote to memory of 876 4488 pdpjd.exe 102 PID 4488 wrote to memory of 876 4488 pdpjd.exe 102 PID 4488 wrote to memory of 876 4488 pdpjd.exe 102 PID 876 wrote to memory of 2008 876 7jjjd.exe 103 PID 876 wrote to memory of 2008 876 7jjjd.exe 103 PID 876 wrote to memory of 2008 876 7jjjd.exe 103 PID 2008 wrote to memory of 1664 2008 3xxrfff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"C:\Users\Admin\AppData\Local\Temp\b58a5533cfad11ecb27998d91f80f633941a303ca3d5e7897d41bd2f9c1820f9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\lllffxx.exec:\lllffxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\1tbbtb.exec:\1tbbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\dvdvv.exec:\dvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\jdjdj.exec:\jdjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xxfffff.exec:\xxfffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nnntnh.exec:\nnntnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pdjdd.exec:\pdjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\nttnnn.exec:\nttnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nhbthh.exec:\nhbthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\dvddd.exec:\dvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xflffff.exec:\xflffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\thbnnt.exec:\thbnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\jvjdd.exec:\jvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\pjdvd.exec:\pjdvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\flxrlll.exec:\flxrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\tntnhb.exec:\tntnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\pdpjd.exec:\pdpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\7jjjd.exec:\7jjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\3xxrfff.exec:\3xxrfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\hbhthn.exec:\hbhthn.exe23⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hthbtt.exec:\hthbtt.exe24⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9pvvv.exec:\9pvvv.exe25⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe26⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xfffllr.exec:\xfffllr.exe27⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vpdvp.exec:\vpdvp.exe28⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pvjdv.exec:\pvjdv.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\flllfff.exec:\flllfff.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9nhbbb.exec:\9nhbbb.exe31⤵
- Executes dropped EXE
PID:4388 -
\??\c:\nbhhtb.exec:\nbhhtb.exe32⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9pjvv.exec:\9pjvv.exe33⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lflxxrr.exec:\lflxxrr.exe34⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxfrlrr.exec:\fxfrlrr.exe35⤵
- Executes dropped EXE
PID:3632 -
\??\c:\btbtnn.exec:\btbtnn.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbhbtt.exec:\nbhbtt.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pjvpv.exec:\pjvpv.exe38⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rxrrrrl.exec:\rxrrrrl.exe39⤵
- Executes dropped EXE
PID:4284 -
\??\c:\xrffllf.exec:\xrffllf.exe40⤵
- Executes dropped EXE
PID:4256 -
\??\c:\7tbnht.exec:\7tbnht.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ddpjp.exec:\ddpjp.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\jjvvv.exec:\jjvvv.exe43⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xfrrfff.exec:\xfrrfff.exe44⤵
- Executes dropped EXE
PID:1444 -
\??\c:\ntnhhh.exec:\ntnhhh.exe45⤵
- Executes dropped EXE
PID:4584 -
\??\c:\5ttbtt.exec:\5ttbtt.exe46⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jpjvp.exec:\jpjvp.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjppj.exec:\pjppj.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rxfxxfx.exec:\rxfxxfx.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3920 -
\??\c:\bbhnnb.exec:\bbhnnb.exe50⤵
- Executes dropped EXE
PID:3660 -
\??\c:\5bbthh.exec:\5bbthh.exe51⤵
- Executes dropped EXE
PID:3456 -
\??\c:\7jppj.exec:\7jppj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316 -
\??\c:\rllfxxx.exec:\rllfxxx.exe53⤵
- Executes dropped EXE
PID:3424 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100 -
\??\c:\bthbtb.exec:\bthbtb.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jddvd.exec:\jddvd.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdppj.exec:\jdppj.exe57⤵
- Executes dropped EXE
PID:232 -
\??\c:\rxxllfx.exec:\rxxllfx.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3hhbbh.exec:\3hhbbh.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tntnhh.exec:\tntnhh.exe60⤵
- Executes dropped EXE
PID:4572 -
\??\c:\5jdvp.exec:\5jdvp.exe61⤵
- Executes dropped EXE
PID:364 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\llrxxlx.exec:\llrxxlx.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nhnhbb.exec:\nhnhbb.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812 -
\??\c:\vjpvp.exec:\vjpvp.exe65⤵
- Executes dropped EXE
PID:4340 -
\??\c:\1vvvp.exec:\1vvvp.exe66⤵PID:1076
-
\??\c:\rflfxxx.exec:\rflfxxx.exe67⤵PID:4636
-
\??\c:\3hnhnn.exec:\3hnhnn.exe68⤵PID:876
-
\??\c:\jjjdv.exec:\jjjdv.exe69⤵PID:2568
-
\??\c:\vjvvv.exec:\vjvvv.exe70⤵PID:2156
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe71⤵PID:1892
-
\??\c:\rrffrrr.exec:\rrffrrr.exe72⤵PID:1664
-
\??\c:\thnhbt.exec:\thnhbt.exe73⤵PID:5008
-
\??\c:\vjvpj.exec:\vjvpj.exe74⤵PID:4496
-
\??\c:\rlllllf.exec:\rlllllf.exe75⤵PID:1488
-
\??\c:\nbhbnn.exec:\nbhbnn.exe76⤵PID:2604
-
\??\c:\5hnhhn.exec:\5hnhhn.exe77⤵PID:4900
-
\??\c:\vpdvv.exec:\vpdvv.exe78⤵PID:452
-
\??\c:\ffxxrff.exec:\ffxxrff.exe79⤵PID:4860
-
\??\c:\tntnhh.exec:\tntnhh.exe80⤵PID:736
-
\??\c:\djvjd.exec:\djvjd.exe81⤵PID:3236
-
\??\c:\rxlllll.exec:\rxlllll.exe82⤵PID:2224
-
\??\c:\thnhbb.exec:\thnhbb.exe83⤵PID:3396
-
\??\c:\vjjdp.exec:\vjjdp.exe84⤵PID:2376
-
\??\c:\vjvvp.exec:\vjvvp.exe85⤵PID:4284
-
\??\c:\lflfxff.exec:\lflfxff.exe86⤵PID:4256
-
\??\c:\btbttn.exec:\btbttn.exe87⤵PID:4104
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe88⤵PID:2552
-
\??\c:\fflffff.exec:\fflffff.exe89⤵PID:1200
-
\??\c:\jjppj.exec:\jjppj.exe90⤵PID:1444
-
\??\c:\flllrxx.exec:\flllrxx.exe91⤵PID:2024
-
\??\c:\1hhhbh.exec:\1hhhbh.exe92⤵PID:712
-
\??\c:\tbtbbh.exec:\tbtbbh.exe93⤵PID:2808
-
\??\c:\vdvpv.exec:\vdvpv.exe94⤵PID:2740
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe95⤵PID:1572
-
\??\c:\3pvvp.exec:\3pvvp.exe96⤵PID:4500
-
\??\c:\lfllrxf.exec:\lfllrxf.exe97⤵PID:4924
-
\??\c:\bntbbh.exec:\bntbbh.exe98⤵PID:2004
-
\??\c:\jdpjp.exec:\jdpjp.exe99⤵PID:664
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe100⤵PID:1016
-
\??\c:\7tnhbb.exec:\7tnhbb.exe101⤵PID:2888
-
\??\c:\dvjjd.exec:\dvjjd.exe102⤵PID:3532
-
\??\c:\lxlfffx.exec:\lxlfffx.exe103⤵PID:2420
-
\??\c:\3btntt.exec:\3btntt.exe104⤵PID:232
-
\??\c:\pvpjv.exec:\pvpjv.exe105⤵PID:4328
-
\??\c:\lfrrlll.exec:\lfrrlll.exe106⤵PID:1416
-
\??\c:\ttbthb.exec:\ttbthb.exe107⤵PID:4648
-
\??\c:\pvjjv.exec:\pvjjv.exe108⤵PID:1536
-
\??\c:\lrxrxrx.exec:\lrxrxrx.exe109⤵PID:3040
-
\??\c:\3lrllxx.exec:\3lrllxx.exe110⤵PID:1532
-
\??\c:\9bbhbh.exec:\9bbhbh.exe111⤵PID:3252
-
\??\c:\dpppj.exec:\dpppj.exe112⤵PID:4588
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe113⤵PID:1512
-
\??\c:\1nnnbn.exec:\1nnnbn.exe114⤵PID:4232
-
\??\c:\dvpjd.exec:\dvpjd.exe115⤵PID:3076
-
\??\c:\pjjdv.exec:\pjjdv.exe116⤵PID:1884
-
\??\c:\xxrxxxf.exec:\xxrxxxf.exe117⤵PID:4704
-
\??\c:\3hbtnt.exec:\3hbtnt.exe118⤵PID:5060
-
\??\c:\vddvp.exec:\vddvp.exe119⤵PID:2008
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe120⤵PID:5096
-
\??\c:\7pvpd.exec:\7pvpd.exe121⤵PID:4216
-
\??\c:\3rxlrlf.exec:\3rxlrlf.exe122⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-