Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe
Resource
win7-20240903-en
General
-
Target
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe
-
Size
456KB
-
MD5
09c3002f31a60134be42bdb5cda62c00
-
SHA1
b53a7ec811fe4271239a32779efaa4ea342551e2
-
SHA256
40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045b
-
SHA512
7430e6994f482cfe9fb881ad992b9650d1cd64a5dcb3e11dee0dc3213cccb1ff534006d747e3e3843880dfd1a4829e41e4f6e6b1aa8d949bda2582f68d28c139
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRQ:q7Tc2NYHUrAwfMp3CDRQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4220-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3228-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2972-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/512-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1440-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1772-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3984-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2016-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/676-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3044-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/736-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-990-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-1129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-1223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-1425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-1960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4220 pvdpd.exe 4624 9rxrlfx.exe 4216 9rlxrlf.exe 5060 dddvp.exe 4920 nbnttn.exe 1768 xxfrllf.exe 2484 vjvpp.exe 2228 rlxrrrx.exe 4788 rffrlfx.exe 4392 7jjjp.exe 4256 thnhbb.exe 4348 vppjj.exe 3228 1hhnnn.exe 2972 tnttnn.exe 784 7pjpj.exe 4232 xllfxrl.exe 1360 frfffff.exe 676 rxflflf.exe 3520 thnhbb.exe 212 pjjjd.exe 4428 frrlxxr.exe 1568 fxxxxxf.exe 4664 bhnhht.exe 4484 5pvvd.exe 1628 xfrlffx.exe 5016 ttbnhn.exe 408 ttbttb.exe 4292 9dvvv.exe 512 pdjjd.exe 4488 rfrrllf.exe 5116 hnbtnh.exe 756 hbbtnh.exe 3236 9dpdp.exe 3232 rxxrrrl.exe 1548 thtnnt.exe 736 bnthbt.exe 1404 9pvpj.exe 4740 rrrlfxx.exe 1432 rxlrllf.exe 816 3bthbb.exe 1136 1pvvp.exe 1680 pvdvp.exe 3268 fxrxlll.exe 4648 btthbt.exe 3508 bnnhbt.exe 5052 jvdjv.exe 2072 xlxxxxf.exe 728 xfrlffx.exe 4072 tnbbtt.exe 4684 vddvj.exe 1736 frfxrrl.exe 1676 tnhbtt.exe 4400 pddvp.exe 1660 rlfrlfr.exe 4220 tnnhhh.exe 2176 vpvpp.exe 3716 xlrflll.exe 4120 7hnnhb.exe 5032 7dpdv.exe 228 rrxlxxr.exe 4920 1btntn.exe 3476 3pvpj.exe 1544 xrxrfxx.exe 2880 5nthhh.exe -
resource yara_rule behavioral2/memory/4624-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3228-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/512-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1440-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1772-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3984-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/676-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3044-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/736-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-986-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 4220 3896 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 83 PID 3896 wrote to memory of 4220 3896 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 83 PID 3896 wrote to memory of 4220 3896 40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe 83 PID 4220 wrote to memory of 4624 4220 pvdpd.exe 84 PID 4220 wrote to memory of 4624 4220 pvdpd.exe 84 PID 4220 wrote to memory of 4624 4220 pvdpd.exe 84 PID 4624 wrote to memory of 4216 4624 9rxrlfx.exe 85 PID 4624 wrote to memory of 4216 4624 9rxrlfx.exe 85 PID 4624 wrote to memory of 4216 4624 9rxrlfx.exe 85 PID 4216 wrote to memory of 5060 4216 9rlxrlf.exe 86 PID 4216 wrote to memory of 5060 4216 9rlxrlf.exe 86 PID 4216 wrote to memory of 5060 4216 9rlxrlf.exe 86 PID 5060 wrote to memory of 4920 5060 dddvp.exe 87 PID 5060 wrote to memory of 4920 5060 dddvp.exe 87 PID 5060 wrote to memory of 4920 5060 dddvp.exe 87 PID 4920 wrote to memory of 1768 4920 nbnttn.exe 88 PID 4920 wrote to memory of 1768 4920 nbnttn.exe 88 PID 4920 wrote to memory of 1768 4920 nbnttn.exe 88 PID 1768 wrote to memory of 2484 1768 xxfrllf.exe 89 PID 1768 wrote to memory of 2484 1768 xxfrllf.exe 89 PID 1768 wrote to memory of 2484 1768 xxfrllf.exe 89 PID 2484 wrote to memory of 2228 2484 vjvpp.exe 90 PID 2484 wrote to memory of 2228 2484 vjvpp.exe 90 PID 2484 wrote to memory of 2228 2484 vjvpp.exe 90 PID 2228 wrote to memory of 4788 2228 rlxrrrx.exe 91 PID 2228 wrote to memory of 4788 2228 rlxrrrx.exe 91 PID 2228 wrote to memory of 4788 2228 rlxrrrx.exe 91 PID 4788 wrote to memory of 4392 4788 rffrlfx.exe 92 PID 4788 wrote to memory of 4392 4788 rffrlfx.exe 92 PID 4788 wrote to memory of 4392 4788 rffrlfx.exe 92 PID 4392 wrote to memory of 4256 4392 7jjjp.exe 93 PID 4392 wrote to memory of 4256 4392 7jjjp.exe 93 PID 4392 wrote to memory of 4256 4392 7jjjp.exe 93 PID 4256 wrote to memory of 4348 4256 thnhbb.exe 94 PID 4256 wrote to memory of 4348 4256 thnhbb.exe 94 PID 4256 wrote to memory of 4348 4256 thnhbb.exe 94 PID 4348 wrote to memory of 3228 4348 vppjj.exe 95 PID 4348 wrote to memory of 3228 4348 vppjj.exe 95 PID 4348 wrote to memory of 3228 4348 vppjj.exe 95 PID 3228 wrote to memory of 2972 3228 1hhnnn.exe 96 PID 3228 wrote to memory of 2972 3228 1hhnnn.exe 96 PID 3228 wrote to memory of 2972 3228 1hhnnn.exe 96 PID 2972 wrote to memory of 784 2972 tnttnn.exe 97 PID 2972 wrote to memory of 784 2972 tnttnn.exe 97 PID 2972 wrote to memory of 784 2972 tnttnn.exe 97 PID 784 wrote to memory of 4232 784 7pjpj.exe 98 PID 784 wrote to memory of 4232 784 7pjpj.exe 98 PID 784 wrote to memory of 4232 784 7pjpj.exe 98 PID 4232 wrote to memory of 1360 4232 xllfxrl.exe 99 PID 4232 wrote to memory of 1360 4232 xllfxrl.exe 99 PID 4232 wrote to memory of 1360 4232 xllfxrl.exe 99 PID 1360 wrote to memory of 676 1360 frfffff.exe 100 PID 1360 wrote to memory of 676 1360 frfffff.exe 100 PID 1360 wrote to memory of 676 1360 frfffff.exe 100 PID 676 wrote to memory of 3520 676 rxflflf.exe 101 PID 676 wrote to memory of 3520 676 rxflflf.exe 101 PID 676 wrote to memory of 3520 676 rxflflf.exe 101 PID 3520 wrote to memory of 212 3520 thnhbb.exe 102 PID 3520 wrote to memory of 212 3520 thnhbb.exe 102 PID 3520 wrote to memory of 212 3520 thnhbb.exe 102 PID 212 wrote to memory of 4428 212 pjjjd.exe 103 PID 212 wrote to memory of 4428 212 pjjjd.exe 103 PID 212 wrote to memory of 4428 212 pjjjd.exe 103 PID 4428 wrote to memory of 1568 4428 frrlxxr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe"C:\Users\Admin\AppData\Local\Temp\40dcb466c6b031d19f6ddb73885a1ac49ee054bc1190658600a39c82b90a045bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\pvdpd.exec:\pvdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\9rxrlfx.exec:\9rxrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\9rlxrlf.exec:\9rlxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\dddvp.exec:\dddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\nbnttn.exec:\nbnttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\xxfrllf.exec:\xxfrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\vjvpp.exec:\vjvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\rffrlfx.exec:\rffrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\7jjjp.exec:\7jjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\thnhbb.exec:\thnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\vppjj.exec:\vppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\1hhnnn.exec:\1hhnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\tnttnn.exec:\tnttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\7pjpj.exec:\7pjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\xllfxrl.exec:\xllfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\frfffff.exec:\frfffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\rxflflf.exec:\rxflflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\thnhbb.exec:\thnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\pjjjd.exec:\pjjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\frrlxxr.exec:\frrlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe23⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bhnhht.exec:\bhnhht.exe24⤵
- Executes dropped EXE
PID:4664 -
\??\c:\5pvvd.exec:\5pvvd.exe25⤵
- Executes dropped EXE
PID:4484 -
\??\c:\xfrlffx.exec:\xfrlffx.exe26⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ttbnhn.exec:\ttbnhn.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ttbttb.exec:\ttbttb.exe28⤵
- Executes dropped EXE
PID:408 -
\??\c:\9dvvv.exec:\9dvvv.exe29⤵
- Executes dropped EXE
PID:4292 -
\??\c:\pdjjd.exec:\pdjjd.exe30⤵
- Executes dropped EXE
PID:512 -
\??\c:\rfrrllf.exec:\rfrrllf.exe31⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hnbtnh.exec:\hnbtnh.exe32⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hbbtnh.exec:\hbbtnh.exe33⤵
- Executes dropped EXE
PID:756 -
\??\c:\9dpdp.exec:\9dpdp.exe34⤵
- Executes dropped EXE
PID:3236 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe35⤵
- Executes dropped EXE
PID:3232 -
\??\c:\thtnnt.exec:\thtnnt.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bnthbt.exec:\bnthbt.exe37⤵
- Executes dropped EXE
PID:736 -
\??\c:\9pvpj.exec:\9pvpj.exe38⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe39⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rxlrllf.exec:\rxlrllf.exe40⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3bthbb.exec:\3bthbb.exe41⤵
- Executes dropped EXE
PID:816 -
\??\c:\1pvvp.exec:\1pvvp.exe42⤵
- Executes dropped EXE
PID:1136 -
\??\c:\pvdvp.exec:\pvdvp.exe43⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fxrxlll.exec:\fxrxlll.exe44⤵
- Executes dropped EXE
PID:3268 -
\??\c:\btthbt.exec:\btthbt.exe45⤵
- Executes dropped EXE
PID:4648 -
\??\c:\bnnhbt.exec:\bnnhbt.exe46⤵
- Executes dropped EXE
PID:3508 -
\??\c:\jvdjv.exec:\jvdjv.exe47⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe48⤵
- Executes dropped EXE
PID:2072 -
\??\c:\xfrlffx.exec:\xfrlffx.exe49⤵
- Executes dropped EXE
PID:728 -
\??\c:\tnbbtt.exec:\tnbbtt.exe50⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vddvj.exec:\vddvj.exe51⤵
- Executes dropped EXE
PID:4684 -
\??\c:\frfxrrl.exec:\frfxrrl.exe52⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tnhbtt.exec:\tnhbtt.exe53⤵
- Executes dropped EXE
PID:1676 -
\??\c:\pddvp.exec:\pddvp.exe54⤵
- Executes dropped EXE
PID:4400 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe55⤵
- Executes dropped EXE
PID:1660 -
\??\c:\tnnhhh.exec:\tnnhhh.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4220 -
\??\c:\vpvpp.exec:\vpvpp.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\xlrflll.exec:\xlrflll.exe58⤵
- Executes dropped EXE
PID:3716 -
\??\c:\7hnnhb.exec:\7hnnhb.exe59⤵
- Executes dropped EXE
PID:4120 -
\??\c:\7dpdv.exec:\7dpdv.exe60⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rrxlxxr.exec:\rrxlxxr.exe61⤵
- Executes dropped EXE
PID:228 -
\??\c:\1btntn.exec:\1btntn.exe62⤵
- Executes dropped EXE
PID:4920 -
\??\c:\3pvpj.exec:\3pvpj.exe63⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xrxrfxx.exec:\xrxrfxx.exe64⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5nthhh.exec:\5nthhh.exe65⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nthbnt.exec:\nthbnt.exe66⤵PID:2116
-
\??\c:\jddvp.exec:\jddvp.exe67⤵PID:1440
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe68⤵PID:3884
-
\??\c:\btnhbt.exec:\btnhbt.exe69⤵PID:4568
-
\??\c:\ddvpp.exec:\ddvpp.exe70⤵PID:2480
-
\??\c:\fxlrlfl.exec:\fxlrlfl.exe71⤵PID:3628
-
\??\c:\ttbttt.exec:\ttbttt.exe72⤵PID:4136
-
\??\c:\dvvjd.exec:\dvvjd.exe73⤵PID:2212
-
\??\c:\bhhhtn.exec:\bhhhtn.exe74⤵PID:2712
-
\??\c:\pvpjj.exec:\pvpjj.exe75⤵PID:3656
-
\??\c:\fxxfrfl.exec:\fxxfrfl.exe76⤵PID:4804
-
\??\c:\btttnb.exec:\btttnb.exe77⤵PID:3580
-
\??\c:\rrxxxlr.exec:\rrxxxlr.exe78⤵PID:2256
-
\??\c:\ntbthh.exec:\ntbthh.exe79⤵PID:1940
-
\??\c:\dvjdv.exec:\dvjdv.exe80⤵PID:3188
-
\??\c:\fxfffff.exec:\fxfffff.exe81⤵PID:3124
-
\??\c:\nnbthh.exec:\nnbthh.exe82⤵PID:2240
-
\??\c:\xxxrrrx.exec:\xxxrrrx.exe83⤵PID:2112
-
\??\c:\lrlfxlf.exec:\lrlfxlf.exe84⤵PID:1424
-
\??\c:\bbhbth.exec:\bbhbth.exe85⤵PID:704
-
\??\c:\pjjdd.exec:\pjjdd.exe86⤵PID:3044
-
\??\c:\lfxrrlf.exec:\lfxrrlf.exe87⤵PID:4180
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe88⤵PID:4184
-
\??\c:\nntnhn.exec:\nntnhn.exe89⤵PID:4128
-
\??\c:\pjdvd.exec:\pjdvd.exe90⤵PID:2520
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe91⤵PID:2164
-
\??\c:\hbtnhb.exec:\hbtnhb.exe92⤵PID:4676
-
\??\c:\9nhbtt.exec:\9nhbtt.exe93⤵PID:5116
-
\??\c:\7ddvp.exec:\7ddvp.exe94⤵PID:4776
-
\??\c:\lfxrxfr.exec:\lfxrxfr.exe95⤵PID:3236
-
\??\c:\nnnnhh.exec:\nnnnhh.exe96⤵PID:2452
-
\??\c:\3ppvv.exec:\3ppvv.exe97⤵PID:3524
-
\??\c:\jdppp.exec:\jdppp.exe98⤵
- System Location Discovery: System Language Discovery
PID:100 -
\??\c:\rlllfff.exec:\rlllfff.exe99⤵PID:4740
-
\??\c:\tnhbth.exec:\tnhbth.exe100⤵PID:1772
-
\??\c:\bhnhtt.exec:\bhnhtt.exe101⤵PID:1176
-
\??\c:\9ddvp.exec:\9ddvp.exe102⤵PID:2624
-
\??\c:\rrxrlll.exec:\rrxrlll.exe103⤵PID:3032
-
\??\c:\3fxrxxf.exec:\3fxrxxf.exe104⤵PID:3408
-
\??\c:\nhbtnh.exec:\nhbtnh.exe105⤵PID:4336
-
\??\c:\dvpjv.exec:\dvpjv.exe106⤵PID:4956
-
\??\c:\xllxrrf.exec:\xllxrrf.exe107⤵PID:964
-
\??\c:\rllxffx.exec:\rllxffx.exe108⤵PID:4524
-
\??\c:\btnhtn.exec:\btnhtn.exe109⤵PID:3784
-
\??\c:\vpvjd.exec:\vpvjd.exe110⤵PID:772
-
\??\c:\jjpjd.exec:\jjpjd.exe111⤵PID:1184
-
\??\c:\xrxlffx.exec:\xrxlffx.exe112⤵PID:4860
-
\??\c:\btbbtt.exec:\btbbtt.exe113⤵PID:3696
-
\??\c:\vjvpd.exec:\vjvpd.exe114⤵PID:4684
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe115⤵PID:536
-
\??\c:\htbbtt.exec:\htbbtt.exe116⤵PID:1640
-
\??\c:\ppppd.exec:\ppppd.exe117⤵PID:4400
-
\??\c:\9llfrrl.exec:\9llfrrl.exe118⤵PID:3144
-
\??\c:\hhnhbb.exec:\hhnhbb.exe119⤵PID:3984
-
\??\c:\tbhbtn.exec:\tbhbtn.exe120⤵PID:852
-
\??\c:\jpvpd.exec:\jpvpd.exe121⤵PID:2244
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe122⤵PID:244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-