Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 00:37
Behavioral task
behavioral1
Sample
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe
-
Size
97KB
-
MD5
d44c9356d68532bca2e01071945eb700
-
SHA1
28b000b72f37b6933324764a9e7b09d662b9de42
-
SHA256
1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6
-
SHA512
a701bb3375afd3fa755bdbb2170075564264890cfa84d282dfe9927c9eff42022432dc346654871e64ff936d8d68fd68b841128253f6cd13197f21ece5218a40
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgl:8cm4FmowdHoSgWrXUgl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4460-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2816-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1564-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1504-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2644-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4812-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/880-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2604-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-609-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-636-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1504 xxrllxx.exe 2816 htbbbh.exe 3780 jpjvp.exe 4552 1lxrlll.exe 3576 9ffrlxx.exe 4008 bnnnhh.exe 1564 nbhbtt.exe 3512 pdjjj.exe 760 fxrllff.exe 1548 dvddd.exe 3228 pdvpj.exe 2944 xrfffff.exe 3048 bthhnn.exe 1464 bhbbnn.exe 1812 dpvpj.exe 4184 xxlfrrr.exe 116 hbnhbn.exe 212 xrrrllf.exe 4784 hhnnht.exe 4420 9xllxfr.exe 2536 vpvvd.exe 4976 rlrxrll.exe 2680 fxlrlfx.exe 1336 ttttnn.exe 2284 jdvpp.exe 4156 1xfrrrr.exe 1980 3fllrxf.exe 1364 btbbtb.exe 4928 dvvvv.exe 456 3fllfff.exe 3320 httttt.exe 1480 djjjj.exe 3652 llxrlrr.exe 2112 flrxxff.exe 2108 5btttt.exe 3932 hnhhhn.exe 3352 7vdjj.exe 4844 1llllrx.exe 728 tntttt.exe 4544 vjvvj.exe 4664 rfxlxrf.exe 4736 jjddd.exe 2508 pjjjv.exe 4452 3llflff.exe 3112 nhhhhh.exe 2612 bnnbtn.exe 220 jppvp.exe 1456 pjjvp.exe 2140 rrxxrrr.exe 4496 rrlfxxr.exe 3240 ttttbb.exe 4072 vpvpj.exe 2920 vvpjd.exe 4000 1frlxxx.exe 2640 frrrrlf.exe 1732 hhttbb.exe 3916 tbnnhh.exe 4152 pvpjp.exe 808 rrfxrxx.exe 3880 llfxrlf.exe 4868 hbbhbb.exe 4356 bbbttn.exe 1060 jpvvj.exe 4504 lffrffx.exe -
resource yara_rule behavioral2/memory/4460-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023bb0-3.dat upx behavioral2/memory/4460-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1504-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023bb3-9.dat upx behavioral2/memory/1504-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bcc-12.dat upx behavioral2/memory/2816-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bd1-19.dat upx behavioral2/memory/4552-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3780-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023bd2-25.dat upx behavioral2/files/0x000e000000023bd7-29.dat upx behavioral2/memory/3576-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bd9-34.dat upx behavioral2/memory/4008-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdc-39.dat upx behavioral2/memory/1564-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bdd-44.dat upx behavioral2/memory/3512-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023bde-49.dat upx behavioral2/files/0x0008000000023bdf-53.dat upx behavioral2/files/0x0008000000023c0e-57.dat upx behavioral2/memory/3228-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2944-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c0f-62.dat upx behavioral2/files/0x0008000000023c10-68.dat upx behavioral2/files/0x0008000000023c11-71.dat upx behavioral2/memory/1464-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c12-76.dat upx behavioral2/files/0x0008000000023c13-79.dat upx behavioral2/memory/4184-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c18-85.dat upx behavioral2/memory/116-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c19-90.dat upx behavioral2/memory/212-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c1a-96.dat upx behavioral2/memory/4784-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c2c-100.dat upx behavioral2/files/0x0008000000023c32-104.dat upx behavioral2/files/0x000c000000023bb4-108.dat upx behavioral2/memory/4976-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c33-113.dat upx behavioral2/memory/2680-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1336-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c34-120.dat upx behavioral2/files/0x0008000000023c35-123.dat upx behavioral2/memory/2284-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c37-128.dat upx behavioral2/memory/4156-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023c4c-133.dat upx behavioral2/memory/1364-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0016000000023c4d-139.dat upx behavioral2/files/0x0008000000023c53-143.dat upx behavioral2/memory/456-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/456-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c57-149.dat upx behavioral2/memory/3320-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c63-153.dat upx behavioral2/memory/1480-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3652-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3352-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4844-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 1504 4460 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 82 PID 4460 wrote to memory of 1504 4460 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 82 PID 4460 wrote to memory of 1504 4460 1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe 82 PID 1504 wrote to memory of 2816 1504 xxrllxx.exe 83 PID 1504 wrote to memory of 2816 1504 xxrllxx.exe 83 PID 1504 wrote to memory of 2816 1504 xxrllxx.exe 83 PID 2816 wrote to memory of 3780 2816 htbbbh.exe 84 PID 2816 wrote to memory of 3780 2816 htbbbh.exe 84 PID 2816 wrote to memory of 3780 2816 htbbbh.exe 84 PID 3780 wrote to memory of 4552 3780 jpjvp.exe 85 PID 3780 wrote to memory of 4552 3780 jpjvp.exe 85 PID 3780 wrote to memory of 4552 3780 jpjvp.exe 85 PID 4552 wrote to memory of 3576 4552 1lxrlll.exe 86 PID 4552 wrote to memory of 3576 4552 1lxrlll.exe 86 PID 4552 wrote to memory of 3576 4552 1lxrlll.exe 86 PID 3576 wrote to memory of 4008 3576 9ffrlxx.exe 87 PID 3576 wrote to memory of 4008 3576 9ffrlxx.exe 87 PID 3576 wrote to memory of 4008 3576 9ffrlxx.exe 87 PID 4008 wrote to memory of 1564 4008 bnnnhh.exe 88 PID 4008 wrote to memory of 1564 4008 bnnnhh.exe 88 PID 4008 wrote to memory of 1564 4008 bnnnhh.exe 88 PID 1564 wrote to memory of 3512 1564 nbhbtt.exe 89 PID 1564 wrote to memory of 3512 1564 nbhbtt.exe 89 PID 1564 wrote to memory of 3512 1564 nbhbtt.exe 89 PID 3512 wrote to memory of 760 3512 pdjjj.exe 90 PID 3512 wrote to memory of 760 3512 pdjjj.exe 90 PID 3512 wrote to memory of 760 3512 pdjjj.exe 90 PID 760 wrote to memory of 1548 760 fxrllff.exe 91 PID 760 wrote to memory of 1548 760 fxrllff.exe 91 PID 760 wrote to memory of 1548 760 fxrllff.exe 91 PID 1548 wrote to memory of 3228 1548 dvddd.exe 92 PID 1548 wrote to memory of 3228 1548 dvddd.exe 92 PID 1548 wrote to memory of 3228 1548 dvddd.exe 92 PID 3228 wrote to memory of 2944 3228 pdvpj.exe 93 PID 3228 wrote to memory of 2944 3228 pdvpj.exe 93 PID 3228 wrote to memory of 2944 3228 pdvpj.exe 93 PID 2944 wrote to memory of 3048 2944 xrfffff.exe 94 PID 2944 wrote to memory of 3048 2944 xrfffff.exe 94 PID 2944 wrote to memory of 3048 2944 xrfffff.exe 94 PID 3048 wrote to memory of 1464 3048 bthhnn.exe 95 PID 3048 wrote to memory of 1464 3048 bthhnn.exe 95 PID 3048 wrote to memory of 1464 3048 bthhnn.exe 95 PID 1464 wrote to memory of 1812 1464 bhbbnn.exe 96 PID 1464 wrote to memory of 1812 1464 bhbbnn.exe 96 PID 1464 wrote to memory of 1812 1464 bhbbnn.exe 96 PID 1812 wrote to memory of 4184 1812 dpvpj.exe 97 PID 1812 wrote to memory of 4184 1812 dpvpj.exe 97 PID 1812 wrote to memory of 4184 1812 dpvpj.exe 97 PID 4184 wrote to memory of 116 4184 xxlfrrr.exe 98 PID 4184 wrote to memory of 116 4184 xxlfrrr.exe 98 PID 4184 wrote to memory of 116 4184 xxlfrrr.exe 98 PID 116 wrote to memory of 212 116 hbnhbn.exe 99 PID 116 wrote to memory of 212 116 hbnhbn.exe 99 PID 116 wrote to memory of 212 116 hbnhbn.exe 99 PID 212 wrote to memory of 4784 212 xrrrllf.exe 100 PID 212 wrote to memory of 4784 212 xrrrllf.exe 100 PID 212 wrote to memory of 4784 212 xrrrllf.exe 100 PID 4784 wrote to memory of 4420 4784 hhnnht.exe 101 PID 4784 wrote to memory of 4420 4784 hhnnht.exe 101 PID 4784 wrote to memory of 4420 4784 hhnnht.exe 101 PID 4420 wrote to memory of 2536 4420 9xllxfr.exe 102 PID 4420 wrote to memory of 2536 4420 9xllxfr.exe 102 PID 4420 wrote to memory of 2536 4420 9xllxfr.exe 102 PID 2536 wrote to memory of 4976 2536 vpvvd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe"C:\Users\Admin\AppData\Local\Temp\1f308ed69b170d54007e48160814b32b31744f5131cc8c754e2969d9714babc6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\xxrllxx.exec:\xxrllxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\htbbbh.exec:\htbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jpjvp.exec:\jpjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\1lxrlll.exec:\1lxrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\9ffrlxx.exec:\9ffrlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\bnnnhh.exec:\bnnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\nbhbtt.exec:\nbhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\pdjjj.exec:\pdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\fxrllff.exec:\fxrllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\dvddd.exec:\dvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\pdvpj.exec:\pdvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\xrfffff.exec:\xrfffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bthhnn.exec:\bthhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bhbbnn.exec:\bhbbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\dpvpj.exec:\dpvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\xxlfrrr.exec:\xxlfrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\hbnhbn.exec:\hbnhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\xrrrllf.exec:\xrrrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\hhnnht.exec:\hhnnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\9xllxfr.exec:\9xllxfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\vpvvd.exec:\vpvvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\rlrxrll.exec:\rlrxrll.exe23⤵
- Executes dropped EXE
PID:4976 -
\??\c:\fxlrlfx.exec:\fxlrlfx.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ttttnn.exec:\ttttnn.exe25⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jdvpp.exec:\jdvpp.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1xfrrrr.exec:\1xfrrrr.exe27⤵
- Executes dropped EXE
PID:4156 -
\??\c:\3fllrxf.exec:\3fllrxf.exe28⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btbbtb.exec:\btbbtb.exe29⤵
- Executes dropped EXE
PID:1364 -
\??\c:\dvvvv.exec:\dvvvv.exe30⤵
- Executes dropped EXE
PID:4928 -
\??\c:\3fllfff.exec:\3fllfff.exe31⤵
- Executes dropped EXE
PID:456 -
\??\c:\httttt.exec:\httttt.exe32⤵
- Executes dropped EXE
PID:3320 -
\??\c:\djjjj.exec:\djjjj.exe33⤵
- Executes dropped EXE
PID:1480 -
\??\c:\llxrlrr.exec:\llxrlrr.exe34⤵
- Executes dropped EXE
PID:3652 -
\??\c:\flrxxff.exec:\flrxxff.exe35⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5btttt.exec:\5btttt.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hnhhhn.exec:\hnhhhn.exe37⤵
- Executes dropped EXE
PID:3932 -
\??\c:\7vdjj.exec:\7vdjj.exe38⤵
- Executes dropped EXE
PID:3352 -
\??\c:\1llllrx.exec:\1llllrx.exe39⤵
- Executes dropped EXE
PID:4844 -
\??\c:\tntttt.exec:\tntttt.exe40⤵
- Executes dropped EXE
PID:728 -
\??\c:\vjvvj.exec:\vjvvj.exe41⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe42⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jjddd.exec:\jjddd.exe43⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pjjjv.exec:\pjjjv.exe44⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3llflff.exec:\3llflff.exe45⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nhhhhh.exec:\nhhhhh.exe46⤵
- Executes dropped EXE
PID:3112 -
\??\c:\bnnbtn.exec:\bnnbtn.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jppvp.exec:\jppvp.exe48⤵
- Executes dropped EXE
PID:220 -
\??\c:\pjjvp.exec:\pjjvp.exe49⤵
- Executes dropped EXE
PID:1456 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe50⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe51⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ttttbb.exec:\ttttbb.exe52⤵
- Executes dropped EXE
PID:3240 -
\??\c:\vpvpj.exec:\vpvpj.exe53⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vvpjd.exec:\vvpjd.exe54⤵
- Executes dropped EXE
PID:2920 -
\??\c:\1frlxxx.exec:\1frlxxx.exe55⤵
- Executes dropped EXE
PID:4000 -
\??\c:\frrrrlf.exec:\frrrrlf.exe56⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhttbb.exec:\hhttbb.exe57⤵
- Executes dropped EXE
PID:1732 -
\??\c:\tbnnhh.exec:\tbnnhh.exe58⤵
- Executes dropped EXE
PID:3916 -
\??\c:\pvpjp.exec:\pvpjp.exe59⤵
- Executes dropped EXE
PID:4152 -
\??\c:\rrfxrxx.exec:\rrfxrxx.exe60⤵
- Executes dropped EXE
PID:808 -
\??\c:\llfxrlf.exec:\llfxrlf.exe61⤵
- Executes dropped EXE
PID:3880 -
\??\c:\hbbhbb.exec:\hbbhbb.exe62⤵
- Executes dropped EXE
PID:4868 -
\??\c:\bbbttn.exec:\bbbttn.exe63⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jpvvj.exec:\jpvvj.exe64⤵
- Executes dropped EXE
PID:1060 -
\??\c:\pvpvp.exec:\pvpvp.exe65⤵PID:4804
-
\??\c:\lffrffx.exec:\lffrffx.exe66⤵
- Executes dropped EXE
PID:4504 -
\??\c:\hhttnn.exec:\hhttnn.exe67⤵PID:1504
-
\??\c:\9ntttb.exec:\9ntttb.exe68⤵PID:1192
-
\??\c:\jvvvp.exec:\jvvvp.exe69⤵PID:3780
-
\??\c:\7fllxxl.exec:\7fllxxl.exe70⤵PID:3940
-
\??\c:\thnbth.exec:\thnbth.exe71⤵PID:3488
-
\??\c:\vdppp.exec:\vdppp.exe72⤵PID:4480
-
\??\c:\1rfffll.exec:\1rfffll.exe73⤵
- System Location Discovery: System Language Discovery
PID:1296 -
\??\c:\fxxrxrx.exec:\fxxrxrx.exe74⤵PID:3664
-
\??\c:\5htttb.exec:\5htttb.exe75⤵PID:1564
-
\??\c:\jvvvp.exec:\jvvvp.exe76⤵PID:4368
-
\??\c:\vddvp.exec:\vddvp.exe77⤵PID:3500
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe78⤵PID:760
-
\??\c:\rllxrxr.exec:\rllxrxr.exe79⤵PID:3092
-
\??\c:\3pppp.exec:\3pppp.exe80⤵PID:4668
-
\??\c:\vpdvp.exec:\vpdvp.exe81⤵PID:3164
-
\??\c:\9lxrffl.exec:\9lxrffl.exe82⤵PID:320
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe83⤵PID:3048
-
\??\c:\thttnh.exec:\thttnh.exe84⤵PID:736
-
\??\c:\tbhhbh.exec:\tbhhbh.exe85⤵PID:4188
-
\??\c:\djvjj.exec:\djvjj.exe86⤵PID:3580
-
\??\c:\1jvvj.exec:\1jvvj.exe87⤵PID:4636
-
\??\c:\lrxrlrl.exec:\lrxrlrl.exe88⤵PID:5036
-
\??\c:\hnnntn.exec:\hnnntn.exe89⤵PID:4184
-
\??\c:\5bnnnn.exec:\5bnnnn.exe90⤵PID:1472
-
\??\c:\9vjpp.exec:\9vjpp.exe91⤵PID:3252
-
\??\c:\xrrrxrx.exec:\xrrrxrx.exe92⤵PID:4896
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe93⤵PID:2320
-
\??\c:\1bbntb.exec:\1bbntb.exe94⤵PID:5100
-
\??\c:\nhbtht.exec:\nhbtht.exe95⤵PID:4832
-
\??\c:\ppjdp.exec:\ppjdp.exe96⤵PID:3120
-
\??\c:\5vvdv.exec:\5vvdv.exe97⤵PID:2272
-
\??\c:\fxfrllf.exec:\fxfrllf.exe98⤵PID:2960
-
\??\c:\1hhbbb.exec:\1hhbbb.exe99⤵PID:1160
-
\??\c:\hntbbb.exec:\hntbbb.exe100⤵PID:648
-
\??\c:\jpvpj.exec:\jpvpj.exe101⤵PID:2692
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe102⤵PID:2392
-
\??\c:\flxxrrl.exec:\flxxrrl.exe103⤵PID:2644
-
\??\c:\7bhhhh.exec:\7bhhhh.exe104⤵PID:1904
-
\??\c:\3tbnhh.exec:\3tbnhh.exe105⤵PID:3684
-
\??\c:\vpjdv.exec:\vpjdv.exe106⤵PID:4476
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe107⤵PID:3680
-
\??\c:\9ffxrrl.exec:\9ffxrrl.exe108⤵PID:2432
-
\??\c:\tbbhhn.exec:\tbbhhn.exe109⤵PID:4864
-
\??\c:\bthhtt.exec:\bthhtt.exe110⤵PID:3096
-
\??\c:\3jddp.exec:\3jddp.exe111⤵PID:1480
-
\??\c:\lfllfll.exec:\lfllfll.exe112⤵PID:1940
-
\??\c:\rffffxr.exec:\rffffxr.exe113⤵PID:3256
-
\??\c:\bbbbtn.exec:\bbbbtn.exe114⤵PID:4336
-
\??\c:\pvdjp.exec:\pvdjp.exe115⤵PID:556
-
\??\c:\pjdvp.exec:\pjdvp.exe116⤵PID:3776
-
\??\c:\fxrxrrr.exec:\fxrxrrr.exe117⤵PID:1632
-
\??\c:\tthhht.exec:\tthhht.exe118⤵PID:1404
-
\??\c:\5pjdv.exec:\5pjdv.exe119⤵PID:4612
-
\??\c:\pjvvv.exec:\pjvvv.exe120⤵PID:2052
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe121⤵PID:5072
-
\??\c:\9bhhbh.exec:\9bhhbh.exe122⤵PID:4316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-