Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
Resource
win7-20240729-en
General
-
Target
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe
-
Size
453KB
-
MD5
b6069f55293d90d8180456273010b670
-
SHA1
c6d4b9564ad3268bad75abcd8107e0c26e533cdf
-
SHA256
a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357
-
SHA512
7efc6d8cfbd4e49b78e3e74e1188be415a0e2cce1a189b355ea11d06970c6353feb3b5e64632125c8338b418afd0b40a3b0727c1cf0f95e8925eb297305da64e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/1652-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3468-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/900-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/716-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/936-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2620-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4228-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4484-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1436-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/788-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4536-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4448-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4568-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2292-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-859-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-998-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-1201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 376 tbthhb.exe 3468 9lrfxrr.exe 900 thnhtt.exe 2004 nbnhbt.exe 2260 djjdv.exe 3944 xllfrlf.exe 5100 pjjvv.exe 716 1ffxllf.exe 760 thhbtb.exe 396 1bhbnh.exe 1460 xfxfxrl.exe 1472 hnnhbt.exe 2292 jvvvp.exe 5112 pvpjj.exe 1056 rfxrffr.exe 4576 5bthbn.exe 3356 bttnnh.exe 4896 vdvvv.exe 1952 fllxlfl.exe 1976 bhbnhb.exe 1592 vdjdv.exe 1724 1jdpd.exe 1300 rrxrlff.exe 936 lrllfxr.exe 4696 rxlrrrl.exe 2620 bnthbn.exe 4212 pjvpd.exe 5088 htnbtn.exe 4128 jjpjd.exe 1932 9rxrlll.exe 2348 tntnhb.exe 1076 ntnbtb.exe 4708 jdvpv.exe 1060 flxrllf.exe 4992 5ffxxrr.exe 2392 bttnhh.exe 3000 fxlffxr.exe 3384 bhnbtn.exe 1656 9hthtn.exe 3532 vdjvp.exe 3092 xlrlfxr.exe 3972 bbhbtn.exe 2340 pjdvv.exe 3496 rrfrfff.exe 1052 hnttbb.exe 4456 htbtbt.exe 1540 jjjdd.exe 2300 flrfrlf.exe 4228 tnnbnb.exe 4264 tnnhbb.exe 4396 jvvvj.exe 1652 lrfrllf.exe 1824 ttthtb.exe 3228 1tnbtn.exe 4484 5ppdv.exe 4504 rrrfxrr.exe 5068 nnthbt.exe 2916 pvvpj.exe 2804 ddjdv.exe 2272 xxrlfxr.exe 3992 ntbnbt.exe 648 ppvjd.exe 3888 jdvpj.exe 404 lxfrffx.exe -
resource yara_rule behavioral2/memory/1652-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/900-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/716-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1460-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1300-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/936-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2620-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4228-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4484-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1436-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/788-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1912-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4536-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-777-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 376 1652 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 82 PID 1652 wrote to memory of 376 1652 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 82 PID 1652 wrote to memory of 376 1652 a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe 82 PID 376 wrote to memory of 3468 376 tbthhb.exe 83 PID 376 wrote to memory of 3468 376 tbthhb.exe 83 PID 376 wrote to memory of 3468 376 tbthhb.exe 83 PID 3468 wrote to memory of 900 3468 9lrfxrr.exe 84 PID 3468 wrote to memory of 900 3468 9lrfxrr.exe 84 PID 3468 wrote to memory of 900 3468 9lrfxrr.exe 84 PID 900 wrote to memory of 2004 900 thnhtt.exe 85 PID 900 wrote to memory of 2004 900 thnhtt.exe 85 PID 900 wrote to memory of 2004 900 thnhtt.exe 85 PID 2004 wrote to memory of 2260 2004 nbnhbt.exe 86 PID 2004 wrote to memory of 2260 2004 nbnhbt.exe 86 PID 2004 wrote to memory of 2260 2004 nbnhbt.exe 86 PID 2260 wrote to memory of 3944 2260 djjdv.exe 87 PID 2260 wrote to memory of 3944 2260 djjdv.exe 87 PID 2260 wrote to memory of 3944 2260 djjdv.exe 87 PID 3944 wrote to memory of 5100 3944 xllfrlf.exe 88 PID 3944 wrote to memory of 5100 3944 xllfrlf.exe 88 PID 3944 wrote to memory of 5100 3944 xllfrlf.exe 88 PID 5100 wrote to memory of 716 5100 pjjvv.exe 89 PID 5100 wrote to memory of 716 5100 pjjvv.exe 89 PID 5100 wrote to memory of 716 5100 pjjvv.exe 89 PID 716 wrote to memory of 760 716 1ffxllf.exe 90 PID 716 wrote to memory of 760 716 1ffxllf.exe 90 PID 716 wrote to memory of 760 716 1ffxllf.exe 90 PID 760 wrote to memory of 396 760 thhbtb.exe 91 PID 760 wrote to memory of 396 760 thhbtb.exe 91 PID 760 wrote to memory of 396 760 thhbtb.exe 91 PID 396 wrote to memory of 1460 396 1bhbnh.exe 92 PID 396 wrote to memory of 1460 396 1bhbnh.exe 92 PID 396 wrote to memory of 1460 396 1bhbnh.exe 92 PID 1460 wrote to memory of 1472 1460 xfxfxrl.exe 93 PID 1460 wrote to memory of 1472 1460 xfxfxrl.exe 93 PID 1460 wrote to memory of 1472 1460 xfxfxrl.exe 93 PID 1472 wrote to memory of 2292 1472 hnnhbt.exe 94 PID 1472 wrote to memory of 2292 1472 hnnhbt.exe 94 PID 1472 wrote to memory of 2292 1472 hnnhbt.exe 94 PID 2292 wrote to memory of 5112 2292 jvvvp.exe 95 PID 2292 wrote to memory of 5112 2292 jvvvp.exe 95 PID 2292 wrote to memory of 5112 2292 jvvvp.exe 95 PID 5112 wrote to memory of 1056 5112 pvpjj.exe 96 PID 5112 wrote to memory of 1056 5112 pvpjj.exe 96 PID 5112 wrote to memory of 1056 5112 pvpjj.exe 96 PID 1056 wrote to memory of 4576 1056 rfxrffr.exe 97 PID 1056 wrote to memory of 4576 1056 rfxrffr.exe 97 PID 1056 wrote to memory of 4576 1056 rfxrffr.exe 97 PID 4576 wrote to memory of 3356 4576 5bthbn.exe 98 PID 4576 wrote to memory of 3356 4576 5bthbn.exe 98 PID 4576 wrote to memory of 3356 4576 5bthbn.exe 98 PID 3356 wrote to memory of 4896 3356 bttnnh.exe 99 PID 3356 wrote to memory of 4896 3356 bttnnh.exe 99 PID 3356 wrote to memory of 4896 3356 bttnnh.exe 99 PID 4896 wrote to memory of 1952 4896 vdvvv.exe 100 PID 4896 wrote to memory of 1952 4896 vdvvv.exe 100 PID 4896 wrote to memory of 1952 4896 vdvvv.exe 100 PID 1952 wrote to memory of 1976 1952 fllxlfl.exe 101 PID 1952 wrote to memory of 1976 1952 fllxlfl.exe 101 PID 1952 wrote to memory of 1976 1952 fllxlfl.exe 101 PID 1976 wrote to memory of 1592 1976 bhbnhb.exe 102 PID 1976 wrote to memory of 1592 1976 bhbnhb.exe 102 PID 1976 wrote to memory of 1592 1976 bhbnhb.exe 102 PID 1592 wrote to memory of 1724 1592 vdjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"C:\Users\Admin\AppData\Local\Temp\a289940191a2e646c7463e1a9ccea564677fab7e0b3ec44d102984baeed0a357.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\tbthhb.exec:\tbthhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\9lrfxrr.exec:\9lrfxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\thnhtt.exec:\thnhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\nbnhbt.exec:\nbnhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\djjdv.exec:\djjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\xllfrlf.exec:\xllfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\pjjvv.exec:\pjjvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\1ffxllf.exec:\1ffxllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\thhbtb.exec:\thhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\1bhbnh.exec:\1bhbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\xfxfxrl.exec:\xfxfxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\hnnhbt.exec:\hnnhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\jvvvp.exec:\jvvvp.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pvpjj.exec:\pvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rfxrffr.exec:\rfxrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\5bthbn.exec:\5bthbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bttnnh.exec:\bttnnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\vdvvv.exec:\vdvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\fllxlfl.exec:\fllxlfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\bhbnhb.exec:\bhbnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\1jdpd.exec:\1jdpd.exe23⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rrxrlff.exec:\rrxrlff.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lrllfxr.exec:\lrllfxr.exe25⤵
- Executes dropped EXE
PID:936 -
\??\c:\rxlrrrl.exec:\rxlrrrl.exe26⤵
- Executes dropped EXE
PID:4696 -
\??\c:\bnthbn.exec:\bnthbn.exe27⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pjvpd.exec:\pjvpd.exe28⤵
- Executes dropped EXE
PID:4212 -
\??\c:\htnbtn.exec:\htnbtn.exe29⤵
- Executes dropped EXE
PID:5088 -
\??\c:\jjpjd.exec:\jjpjd.exe30⤵
- Executes dropped EXE
PID:4128 -
\??\c:\9rxrlll.exec:\9rxrlll.exe31⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tntnhb.exec:\tntnhb.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ntnbtb.exec:\ntnbtb.exe33⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdvpv.exec:\jdvpv.exe34⤵
- Executes dropped EXE
PID:4708 -
\??\c:\flxrllf.exec:\flxrllf.exe35⤵
- Executes dropped EXE
PID:1060 -
\??\c:\5ffxxrr.exec:\5ffxxrr.exe36⤵
- Executes dropped EXE
PID:4992 -
\??\c:\bttnhh.exec:\bttnhh.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\fxlffxr.exec:\fxlffxr.exe38⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bhnbtn.exec:\bhnbtn.exe39⤵
- Executes dropped EXE
PID:3384 -
\??\c:\9hthtn.exec:\9hthtn.exe40⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vdjvp.exec:\vdjvp.exe41⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe42⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bbhbtn.exec:\bbhbtn.exe43⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pjdvv.exec:\pjdvv.exe44⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrfrfff.exec:\rrfrfff.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3496 -
\??\c:\hnttbb.exec:\hnttbb.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\htbtbt.exec:\htbtbt.exe47⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jjjdd.exec:\jjjdd.exe48⤵
- Executes dropped EXE
PID:1540 -
\??\c:\flrfrlf.exec:\flrfrlf.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tnnbnb.exec:\tnnbnb.exe50⤵
- Executes dropped EXE
PID:4228 -
\??\c:\tnnhbb.exec:\tnnhbb.exe51⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jvvvj.exec:\jvvvj.exe52⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lrfrllf.exec:\lrfrllf.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ttthtb.exec:\ttthtb.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1tnbtn.exec:\1tnbtn.exe55⤵
- Executes dropped EXE
PID:3228 -
\??\c:\5ppdv.exec:\5ppdv.exe56⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rrrfxrr.exec:\rrrfxrr.exe57⤵
- Executes dropped EXE
PID:4504 -
\??\c:\nnthbt.exec:\nnthbt.exe58⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pvvpj.exec:\pvvpj.exe59⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ddjdv.exec:\ddjdv.exe60⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ntbnbt.exec:\ntbnbt.exe62⤵
- Executes dropped EXE
PID:3992 -
\??\c:\ppvjd.exec:\ppvjd.exe63⤵
- Executes dropped EXE
PID:648 -
\??\c:\jdvpj.exec:\jdvpj.exe64⤵
- Executes dropped EXE
PID:3888 -
\??\c:\lxfrffx.exec:\lxfrffx.exe65⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhbtnh.exec:\nhbtnh.exe66⤵PID:1480
-
\??\c:\jdvjd.exec:\jdvjd.exe67⤵PID:4568
-
\??\c:\vjppv.exec:\vjppv.exe68⤵PID:1116
-
\??\c:\3xfrlrl.exec:\3xfrlrl.exe69⤵PID:1436
-
\??\c:\1ttnht.exec:\1ttnht.exe70⤵PID:3108
-
\??\c:\bttnnh.exec:\bttnnh.exe71⤵PID:788
-
\??\c:\dddpp.exec:\dddpp.exe72⤵PID:1996
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe73⤵PID:2292
-
\??\c:\hbbtbb.exec:\hbbtbb.exe74⤵PID:3500
-
\??\c:\vpppj.exec:\vpppj.exe75⤵PID:2152
-
\??\c:\pjdjp.exec:\pjdjp.exe76⤵PID:4972
-
\??\c:\xlrfxrr.exec:\xlrfxrr.exe77⤵PID:4532
-
\??\c:\tbhbtt.exec:\tbhbtt.exe78⤵PID:4576
-
\??\c:\pdjjd.exec:\pdjjd.exe79⤵PID:1912
-
\??\c:\dvvpd.exec:\dvvpd.exe80⤵PID:2752
-
\??\c:\5flfffx.exec:\5flfffx.exe81⤵PID:5004
-
\??\c:\nhhhbh.exec:\nhhhbh.exe82⤵PID:3920
-
\??\c:\pvdvp.exec:\pvdvp.exe83⤵PID:1816
-
\??\c:\pjdvp.exec:\pjdvp.exe84⤵PID:4500
-
\??\c:\rfflxlf.exec:\rfflxlf.exe85⤵PID:224
-
\??\c:\hbbtnh.exec:\hbbtnh.exe86⤵PID:2772
-
\??\c:\vppjd.exec:\vppjd.exe87⤵PID:464
-
\??\c:\3ffxllf.exec:\3ffxllf.exe88⤵PID:1312
-
\??\c:\rrrlffx.exec:\rrrlffx.exe89⤵PID:3396
-
\??\c:\tnhhtt.exec:\tnhhtt.exe90⤵PID:1896
-
\??\c:\djpvp.exec:\djpvp.exe91⤵PID:3660
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe92⤵PID:1240
-
\??\c:\bntnhb.exec:\bntnhb.exe93⤵PID:1672
-
\??\c:\htbbbb.exec:\htbbbb.exe94⤵PID:4912
-
\??\c:\dpvpj.exec:\dpvpj.exe95⤵PID:4776
-
\??\c:\lxfrlxr.exec:\lxfrlxr.exe96⤵PID:1584
-
\??\c:\9fxlxrl.exec:\9fxlxrl.exe97⤵PID:2840
-
\??\c:\hthhnh.exec:\hthhnh.exe98⤵PID:4536
-
\??\c:\3jpjd.exec:\3jpjd.exe99⤵PID:2352
-
\??\c:\rrxrfxx.exec:\rrxrfxx.exe100⤵PID:228
-
\??\c:\thnhbb.exec:\thnhbb.exe101⤵PID:3408
-
\??\c:\jddjv.exec:\jddjv.exe102⤵PID:3616
-
\??\c:\dppdv.exec:\dppdv.exe103⤵PID:2036
-
\??\c:\3llxrlf.exec:\3llxrlf.exe104⤵PID:2500
-
\??\c:\tttnbb.exec:\tttnbb.exe105⤵PID:1396
-
\??\c:\jdvpd.exec:\jdvpd.exe106⤵PID:4184
-
\??\c:\9pjjd.exec:\9pjjd.exe107⤵PID:2792
-
\??\c:\1fxlfxr.exec:\1fxlfxr.exe108⤵PID:2320
-
\??\c:\nhhnnn.exec:\nhhnnn.exe109⤵PID:1656
-
\??\c:\vpdvp.exec:\vpdvp.exe110⤵PID:3532
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe111⤵PID:3092
-
\??\c:\rxfxxff.exec:\rxfxxff.exe112⤵PID:2276
-
\??\c:\bbhbtn.exec:\bbhbtn.exe113⤵PID:2340
-
\??\c:\ppjjd.exec:\ppjjd.exe114⤵PID:1184
-
\??\c:\xffxrrl.exec:\xffxrrl.exe115⤵PID:1948
-
\??\c:\9ffrffr.exec:\9ffrffr.exe116⤵PID:4456
-
\??\c:\9thbnh.exec:\9thbnh.exe117⤵PID:3472
-
\??\c:\pddpd.exec:\pddpd.exe118⤵PID:2300
-
\??\c:\jpvpd.exec:\jpvpd.exe119⤵PID:4448
-
\??\c:\xllffxx.exec:\xllffxx.exe120⤵PID:4408
-
\??\c:\ntbtnh.exec:\ntbtnh.exe121⤵PID:5044
-
\??\c:\jjpdj.exec:\jjpdj.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-