Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
Resource
win7-20241010-en
General
-
Target
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe
-
Size
453KB
-
MD5
aa50a9422ef3c3e770fc6df958f6d5f6
-
SHA1
5727000564274a33e402b2132deb06520c89ea8c
-
SHA256
a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300
-
SHA512
b72a49e4e4d46fae0d981487ef985f924e7d07d79476fc0e4a74be34caf9756f52e935cd2f095e832fad9ea9fae3c5fd8a8643e8996f8c00ddd82b3106e563a4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetD:q7Tc2NYHUrAwfMp3CDtD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4892-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1236-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2492-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3948-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3492-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1156-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1776-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3592-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4408-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4616-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/576-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-1379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-1395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3964-1442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1232 djdvj.exe 1852 hbbtnb.exe 1236 7hbtnh.exe 644 626082.exe 1008 80288.exe 816 26826.exe 4588 xrxrllf.exe 4972 pjvjj.exe 1884 240604.exe 2492 602844.exe 2768 4600442.exe 4996 866648.exe 3032 64202.exe 4568 4402042.exe 4416 9bthhh.exe 4432 0684464.exe 3948 8248260.exe 2272 nttnhb.exe 4524 pdvjd.exe 4280 8620640.exe 2796 6268620.exe 4540 jppdv.exe 2736 8664048.exe 780 vjpdv.exe 3648 806460.exe 4028 llfxrlf.exe 4444 httbbt.exe 1632 e02444.exe 4760 668860.exe 984 7jjvd.exe 1340 6008282.exe 1620 0842042.exe 1568 7vdvp.exe 3492 nhbthh.exe 1804 5htnbb.exe 2884 6242604.exe 1156 lrfrlfx.exe 3192 7xxffxr.exe 4504 1ffxlxl.exe 1776 0008608.exe 2484 8626480.exe 3944 u446422.exe 3632 4488260.exe 4940 i002042.exe 2932 204864.exe 4920 a6222.exe 4420 thhtbb.exe 2880 8448282.exe 1480 rllxrxl.exe 3636 bhhthh.exe 2164 lrlxlfr.exe 4848 6286082.exe 2876 tbnbtn.exe 4980 tttnbb.exe 1944 826086.exe 3976 s0642.exe 3640 fflfxrx.exe 5072 ppvpd.exe 4588 lrfrrfr.exe 1276 e80488.exe 2908 nbbtht.exe 3592 9jdvp.exe 3448 2288042.exe 688 26604.exe -
resource yara_rule behavioral2/memory/4892-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1236-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2492-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3948-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3492-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1156-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1776-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3592-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5000-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4408-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4616-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2484-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/576-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3176-991-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-1369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-1379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-1395-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26484.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4600442.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06620.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24048.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 844860.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66028.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2826266.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c224642.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m0204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2664886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m0886.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 1232 4892 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 83 PID 4892 wrote to memory of 1232 4892 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 83 PID 4892 wrote to memory of 1232 4892 a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe 83 PID 1232 wrote to memory of 1852 1232 djdvj.exe 84 PID 1232 wrote to memory of 1852 1232 djdvj.exe 84 PID 1232 wrote to memory of 1852 1232 djdvj.exe 84 PID 1852 wrote to memory of 1236 1852 hbbtnb.exe 85 PID 1852 wrote to memory of 1236 1852 hbbtnb.exe 85 PID 1852 wrote to memory of 1236 1852 hbbtnb.exe 85 PID 1236 wrote to memory of 644 1236 7hbtnh.exe 86 PID 1236 wrote to memory of 644 1236 7hbtnh.exe 86 PID 1236 wrote to memory of 644 1236 7hbtnh.exe 86 PID 644 wrote to memory of 1008 644 626082.exe 87 PID 644 wrote to memory of 1008 644 626082.exe 87 PID 644 wrote to memory of 1008 644 626082.exe 87 PID 1008 wrote to memory of 816 1008 80288.exe 88 PID 1008 wrote to memory of 816 1008 80288.exe 88 PID 1008 wrote to memory of 816 1008 80288.exe 88 PID 816 wrote to memory of 4588 816 26826.exe 89 PID 816 wrote to memory of 4588 816 26826.exe 89 PID 816 wrote to memory of 4588 816 26826.exe 89 PID 4588 wrote to memory of 4972 4588 xrxrllf.exe 90 PID 4588 wrote to memory of 4972 4588 xrxrllf.exe 90 PID 4588 wrote to memory of 4972 4588 xrxrllf.exe 90 PID 4972 wrote to memory of 1884 4972 pjvjj.exe 91 PID 4972 wrote to memory of 1884 4972 pjvjj.exe 91 PID 4972 wrote to memory of 1884 4972 pjvjj.exe 91 PID 1884 wrote to memory of 2492 1884 240604.exe 92 PID 1884 wrote to memory of 2492 1884 240604.exe 92 PID 1884 wrote to memory of 2492 1884 240604.exe 92 PID 2492 wrote to memory of 2768 2492 602844.exe 93 PID 2492 wrote to memory of 2768 2492 602844.exe 93 PID 2492 wrote to memory of 2768 2492 602844.exe 93 PID 2768 wrote to memory of 4996 2768 4600442.exe 94 PID 2768 wrote to memory of 4996 2768 4600442.exe 94 PID 2768 wrote to memory of 4996 2768 4600442.exe 94 PID 4996 wrote to memory of 3032 4996 866648.exe 95 PID 4996 wrote to memory of 3032 4996 866648.exe 95 PID 4996 wrote to memory of 3032 4996 866648.exe 95 PID 3032 wrote to memory of 4568 3032 64202.exe 96 PID 3032 wrote to memory of 4568 3032 64202.exe 96 PID 3032 wrote to memory of 4568 3032 64202.exe 96 PID 4568 wrote to memory of 4416 4568 4402042.exe 97 PID 4568 wrote to memory of 4416 4568 4402042.exe 97 PID 4568 wrote to memory of 4416 4568 4402042.exe 97 PID 4416 wrote to memory of 4432 4416 9bthhh.exe 98 PID 4416 wrote to memory of 4432 4416 9bthhh.exe 98 PID 4416 wrote to memory of 4432 4416 9bthhh.exe 98 PID 4432 wrote to memory of 3948 4432 0684464.exe 99 PID 4432 wrote to memory of 3948 4432 0684464.exe 99 PID 4432 wrote to memory of 3948 4432 0684464.exe 99 PID 3948 wrote to memory of 2272 3948 8248260.exe 100 PID 3948 wrote to memory of 2272 3948 8248260.exe 100 PID 3948 wrote to memory of 2272 3948 8248260.exe 100 PID 2272 wrote to memory of 4524 2272 nttnhb.exe 101 PID 2272 wrote to memory of 4524 2272 nttnhb.exe 101 PID 2272 wrote to memory of 4524 2272 nttnhb.exe 101 PID 4524 wrote to memory of 4280 4524 pdvjd.exe 102 PID 4524 wrote to memory of 4280 4524 pdvjd.exe 102 PID 4524 wrote to memory of 4280 4524 pdvjd.exe 102 PID 4280 wrote to memory of 2796 4280 8620640.exe 103 PID 4280 wrote to memory of 2796 4280 8620640.exe 103 PID 4280 wrote to memory of 2796 4280 8620640.exe 103 PID 2796 wrote to memory of 4540 2796 6268620.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"C:\Users\Admin\AppData\Local\Temp\a6574ceae9ab44b1a7e6068b2b5c73c8a322d3fd0dd23b016f3d20a8bf87b300.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\djdvj.exec:\djdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\hbbtnb.exec:\hbbtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\7hbtnh.exec:\7hbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\626082.exec:\626082.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\80288.exec:\80288.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\26826.exec:\26826.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\xrxrllf.exec:\xrxrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\pjvjj.exec:\pjvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\240604.exec:\240604.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\602844.exec:\602844.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\4600442.exec:\4600442.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\866648.exec:\866648.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\64202.exec:\64202.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\4402042.exec:\4402042.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\9bthhh.exec:\9bthhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\0684464.exec:\0684464.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\8248260.exec:\8248260.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\nttnhb.exec:\nttnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\pdvjd.exec:\pdvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\8620640.exec:\8620640.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\6268620.exec:\6268620.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\jppdv.exec:\jppdv.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\8664048.exec:\8664048.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\vjpdv.exec:\vjpdv.exe25⤵
- Executes dropped EXE
PID:780 -
\??\c:\806460.exec:\806460.exe26⤵
- Executes dropped EXE
PID:3648 -
\??\c:\llfxrlf.exec:\llfxrlf.exe27⤵
- Executes dropped EXE
PID:4028 -
\??\c:\httbbt.exec:\httbbt.exe28⤵
- Executes dropped EXE
PID:4444 -
\??\c:\e02444.exec:\e02444.exe29⤵
- Executes dropped EXE
PID:1632 -
\??\c:\668860.exec:\668860.exe30⤵
- Executes dropped EXE
PID:4760 -
\??\c:\7jjvd.exec:\7jjvd.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\6008282.exec:\6008282.exe32⤵
- Executes dropped EXE
PID:1340 -
\??\c:\0842042.exec:\0842042.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\7vdvp.exec:\7vdvp.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nhbthh.exec:\nhbthh.exe35⤵
- Executes dropped EXE
PID:3492 -
\??\c:\5htnbb.exec:\5htnbb.exe36⤵
- Executes dropped EXE
PID:1804 -
\??\c:\6242604.exec:\6242604.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lrfrlfx.exec:\lrfrlfx.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7xxffxr.exec:\7xxffxr.exe39⤵
- Executes dropped EXE
PID:3192 -
\??\c:\1ffxlxl.exec:\1ffxlxl.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\0008608.exec:\0008608.exe41⤵
- Executes dropped EXE
PID:1776 -
\??\c:\8626480.exec:\8626480.exe42⤵
- Executes dropped EXE
PID:2484 -
\??\c:\u446422.exec:\u446422.exe43⤵
- Executes dropped EXE
PID:3944 -
\??\c:\4488260.exec:\4488260.exe44⤵
- Executes dropped EXE
PID:3632 -
\??\c:\i002042.exec:\i002042.exe45⤵
- Executes dropped EXE
PID:4940 -
\??\c:\204864.exec:\204864.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\a6222.exec:\a6222.exe47⤵
- Executes dropped EXE
PID:4920 -
\??\c:\thhtbb.exec:\thhtbb.exe48⤵
- Executes dropped EXE
PID:4420 -
\??\c:\8448282.exec:\8448282.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxrrllf.exec:\lxrrllf.exe50⤵PID:4824
-
\??\c:\rllxrxl.exec:\rllxrxl.exe51⤵
- Executes dropped EXE
PID:1480 -
\??\c:\bhhthh.exec:\bhhthh.exe52⤵
- Executes dropped EXE
PID:3636 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe53⤵
- Executes dropped EXE
PID:2164 -
\??\c:\6286082.exec:\6286082.exe54⤵
- Executes dropped EXE
PID:4848 -
\??\c:\tbnbtn.exec:\tbnbtn.exe55⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tttnbb.exec:\tttnbb.exe56⤵
- Executes dropped EXE
PID:4980 -
\??\c:\826086.exec:\826086.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\s0642.exec:\s0642.exe58⤵
- Executes dropped EXE
PID:3976 -
\??\c:\fflfxrx.exec:\fflfxrx.exe59⤵
- Executes dropped EXE
PID:3640 -
\??\c:\ppvpd.exec:\ppvpd.exe60⤵
- Executes dropped EXE
PID:5072 -
\??\c:\lrfrrfr.exec:\lrfrrfr.exe61⤵
- Executes dropped EXE
PID:4588 -
\??\c:\e80488.exec:\e80488.exe62⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nbbtht.exec:\nbbtht.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9jdvp.exec:\9jdvp.exe64⤵
- Executes dropped EXE
PID:3592 -
\??\c:\2288042.exec:\2288042.exe65⤵
- Executes dropped EXE
PID:3448 -
\??\c:\26604.exec:\26604.exe66⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:688 -
\??\c:\fxlfllr.exec:\fxlfllr.exe67⤵PID:3568
-
\??\c:\862662.exec:\862662.exe68⤵PID:5000
-
\??\c:\frfrfrl.exec:\frfrfrl.exe69⤵PID:116
-
\??\c:\m0082.exec:\m0082.exe70⤵PID:4896
-
\??\c:\u044220.exec:\u044220.exe71⤵PID:4408
-
\??\c:\3dddv.exec:\3dddv.exe72⤵PID:2628
-
\??\c:\7flfffx.exec:\7flfffx.exe73⤵PID:704
-
\??\c:\xfllxxx.exec:\xfllxxx.exe74⤵PID:5092
-
\??\c:\0682604.exec:\0682604.exe75⤵PID:1580
-
\??\c:\6200260.exec:\6200260.exe76⤵PID:1524
-
\??\c:\bnthtt.exec:\bnthtt.exe77⤵PID:3328
-
\??\c:\nhbtht.exec:\nhbtht.exe78⤵PID:1940
-
\??\c:\i288828.exec:\i288828.exe79⤵PID:3092
-
\??\c:\2842604.exec:\2842604.exe80⤵PID:3528
-
\??\c:\2660444.exec:\2660444.exe81⤵PID:2544
-
\??\c:\2608048.exec:\2608048.exe82⤵PID:1556
-
\??\c:\2620448.exec:\2620448.exe83⤵PID:3264
-
\??\c:\hnbbnn.exec:\hnbbnn.exe84⤵PID:2320
-
\??\c:\600048.exec:\600048.exe85⤵PID:764
-
\??\c:\q66426.exec:\q66426.exe86⤵PID:812
-
\??\c:\lffxrlf.exec:\lffxrlf.exe87⤵PID:3648
-
\??\c:\ddpjd.exec:\ddpjd.exe88⤵PID:4616
-
\??\c:\rfxfrlx.exec:\rfxfrlx.exe89⤵PID:3236
-
\??\c:\fxxllrr.exec:\fxxllrr.exe90⤵PID:4904
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe91⤵PID:3800
-
\??\c:\vddvp.exec:\vddvp.exe92⤵PID:2260
-
\??\c:\ppddp.exec:\ppddp.exe93⤵PID:5116
-
\??\c:\088604.exec:\088604.exe94⤵PID:984
-
\??\c:\480426.exec:\480426.exe95⤵PID:1564
-
\??\c:\080400.exec:\080400.exe96⤵PID:1612
-
\??\c:\4220408.exec:\4220408.exe97⤵PID:1464
-
\??\c:\tbtnnh.exec:\tbtnnh.exe98⤵PID:2248
-
\??\c:\1hbtbt.exec:\1hbtbt.exe99⤵PID:2004
-
\??\c:\1tthbt.exec:\1tthbt.exe100⤵PID:960
-
\??\c:\66242.exec:\66242.exe101⤵PID:2904
-
\??\c:\9vjvj.exec:\9vjvj.exe102⤵PID:4872
-
\??\c:\42220.exec:\42220.exe103⤵PID:3192
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe104⤵PID:3696
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe105⤵PID:4456
-
\??\c:\6622282.exec:\6622282.exe106⤵PID:2484
-
\??\c:\080442.exec:\080442.exe107⤵PID:3944
-
\??\c:\5frlxxl.exec:\5frlxxl.exe108⤵PID:3068
-
\??\c:\pddpd.exec:\pddpd.exe109⤵PID:720
-
\??\c:\662882.exec:\662882.exe110⤵PID:4868
-
\??\c:\08204.exec:\08204.exe111⤵PID:3996
-
\??\c:\440864.exec:\440864.exe112⤵PID:4368
-
\??\c:\jjpvj.exec:\jjpvj.exe113⤵
- System Location Discovery: System Language Discovery
PID:2880 -
\??\c:\0004860.exec:\0004860.exe114⤵PID:2212
-
\??\c:\66820.exec:\66820.exe115⤵PID:1480
-
\??\c:\ffxlrrl.exec:\ffxlrrl.exe116⤵PID:4056
-
\??\c:\m0204.exec:\m0204.exe117⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\3tthnh.exec:\3tthnh.exe118⤵PID:2316
-
\??\c:\a0622.exec:\a0622.exe119⤵PID:4348
-
\??\c:\ntnhnn.exec:\ntnhnn.exe120⤵PID:3408
-
\??\c:\thhhbt.exec:\thhhbt.exe121⤵PID:1576
-
\??\c:\flxfflx.exec:\flxfflx.exe122⤵PID:4928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-