Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:28
Static task
static1
Behavioral task
behavioral1
Sample
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
Resource
win7-20240903-en
General
-
Target
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe
-
Size
453KB
-
MD5
8ed18ab56af2ed7a15f895f87fd9ba8f
-
SHA1
6d028d5984cc852029e3c0c2877ba7d50328b020
-
SHA256
57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a
-
SHA512
f8b5b14f023948fd50a6c317a535bae1c0534f162a8ddb1479ea1bbdb8491121411c6a7575a397cd03f8a604dc501602bbf3e59281bd972bd77e83ad191b9c49
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3532-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/728-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/748-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/692-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1812-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2148-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3716-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-935-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-1034-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-1113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4028-1244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-1437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2040 htnhth.exe 2532 jpvjv.exe 3772 7ttnnn.exe 4180 bhbnbn.exe 728 0608208.exe 5104 4646644.exe 4828 frrfrfx.exe 4624 ddjjd.exe 748 1pvpd.exe 2268 o044886.exe 3664 vdpjv.exe 4880 0284208.exe 3684 3fxlxrf.exe 3344 dddpd.exe 692 thhhtt.exe 4488 42860.exe 1424 06826.exe 2440 lxfrrll.exe 3052 42886.exe 3536 3htttb.exe 4288 jvvjv.exe 4044 4464264.exe 4776 bnthhb.exe 468 nbbnhh.exe 2252 pddvp.exe 4416 44086.exe 2780 k22082.exe 4132 5frlxrf.exe 5096 446246.exe 1456 vjvjp.exe 1812 2042042.exe 4912 xrxffll.exe 404 1hhtht.exe 5020 24824.exe 3092 fxxfrfx.exe 2088 bthbhb.exe 1648 4668664.exe 2720 666208.exe 1360 s2042.exe 4908 w44248.exe 4400 lxxlrlx.exe 3580 jvpjp.exe 1800 4046420.exe 2040 1hbnbn.exe 3296 s2264.exe 4748 bnntth.exe 2124 006642.exe 2064 u442086.exe 4692 80820.exe 4420 8224642.exe 384 084282.exe 1672 08864.exe 452 rfxllfr.exe 2324 bhbtht.exe 436 q48682.exe 4824 e62026.exe 2148 5pvjp.exe 2224 1lfrxlx.exe 3508 000804.exe 648 060860.exe 1624 484248.exe 2308 24880.exe 5040 2442048.exe 692 lxxfxrr.exe -
resource yara_rule behavioral2/memory/3532-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/728-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/748-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1812-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2148-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4028-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3716-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4904-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2976-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2972-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-831-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4408608.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e62026.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o288660.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a8482.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 268404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88802.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62864.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62202.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02866.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3532 wrote to memory of 2040 3532 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 85 PID 3532 wrote to memory of 2040 3532 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 85 PID 3532 wrote to memory of 2040 3532 57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe 85 PID 2040 wrote to memory of 2532 2040 htnhth.exe 86 PID 2040 wrote to memory of 2532 2040 htnhth.exe 86 PID 2040 wrote to memory of 2532 2040 htnhth.exe 86 PID 2532 wrote to memory of 3772 2532 jpvjv.exe 87 PID 2532 wrote to memory of 3772 2532 jpvjv.exe 87 PID 2532 wrote to memory of 3772 2532 jpvjv.exe 87 PID 3772 wrote to memory of 4180 3772 7ttnnn.exe 88 PID 3772 wrote to memory of 4180 3772 7ttnnn.exe 88 PID 3772 wrote to memory of 4180 3772 7ttnnn.exe 88 PID 4180 wrote to memory of 728 4180 bhbnbn.exe 89 PID 4180 wrote to memory of 728 4180 bhbnbn.exe 89 PID 4180 wrote to memory of 728 4180 bhbnbn.exe 89 PID 728 wrote to memory of 5104 728 0608208.exe 90 PID 728 wrote to memory of 5104 728 0608208.exe 90 PID 728 wrote to memory of 5104 728 0608208.exe 90 PID 5104 wrote to memory of 4828 5104 4646644.exe 91 PID 5104 wrote to memory of 4828 5104 4646644.exe 91 PID 5104 wrote to memory of 4828 5104 4646644.exe 91 PID 4828 wrote to memory of 4624 4828 frrfrfx.exe 92 PID 4828 wrote to memory of 4624 4828 frrfrfx.exe 92 PID 4828 wrote to memory of 4624 4828 frrfrfx.exe 92 PID 4624 wrote to memory of 748 4624 ddjjd.exe 93 PID 4624 wrote to memory of 748 4624 ddjjd.exe 93 PID 4624 wrote to memory of 748 4624 ddjjd.exe 93 PID 748 wrote to memory of 2268 748 1pvpd.exe 94 PID 748 wrote to memory of 2268 748 1pvpd.exe 94 PID 748 wrote to memory of 2268 748 1pvpd.exe 94 PID 2268 wrote to memory of 3664 2268 o044886.exe 95 PID 2268 wrote to memory of 3664 2268 o044886.exe 95 PID 2268 wrote to memory of 3664 2268 o044886.exe 95 PID 3664 wrote to memory of 4880 3664 vdpjv.exe 96 PID 3664 wrote to memory of 4880 3664 vdpjv.exe 96 PID 3664 wrote to memory of 4880 3664 vdpjv.exe 96 PID 4880 wrote to memory of 3684 4880 0284208.exe 97 PID 4880 wrote to memory of 3684 4880 0284208.exe 97 PID 4880 wrote to memory of 3684 4880 0284208.exe 97 PID 3684 wrote to memory of 3344 3684 3fxlxrf.exe 98 PID 3684 wrote to memory of 3344 3684 3fxlxrf.exe 98 PID 3684 wrote to memory of 3344 3684 3fxlxrf.exe 98 PID 3344 wrote to memory of 692 3344 dddpd.exe 99 PID 3344 wrote to memory of 692 3344 dddpd.exe 99 PID 3344 wrote to memory of 692 3344 dddpd.exe 99 PID 692 wrote to memory of 4488 692 thhhtt.exe 100 PID 692 wrote to memory of 4488 692 thhhtt.exe 100 PID 692 wrote to memory of 4488 692 thhhtt.exe 100 PID 4488 wrote to memory of 1424 4488 42860.exe 101 PID 4488 wrote to memory of 1424 4488 42860.exe 101 PID 4488 wrote to memory of 1424 4488 42860.exe 101 PID 1424 wrote to memory of 2440 1424 06826.exe 102 PID 1424 wrote to memory of 2440 1424 06826.exe 102 PID 1424 wrote to memory of 2440 1424 06826.exe 102 PID 2440 wrote to memory of 3052 2440 lxfrrll.exe 103 PID 2440 wrote to memory of 3052 2440 lxfrrll.exe 103 PID 2440 wrote to memory of 3052 2440 lxfrrll.exe 103 PID 3052 wrote to memory of 3536 3052 42886.exe 104 PID 3052 wrote to memory of 3536 3052 42886.exe 104 PID 3052 wrote to memory of 3536 3052 42886.exe 104 PID 3536 wrote to memory of 4288 3536 3htttb.exe 105 PID 3536 wrote to memory of 4288 3536 3htttb.exe 105 PID 3536 wrote to memory of 4288 3536 3htttb.exe 105 PID 4288 wrote to memory of 4044 4288 jvvjv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"C:\Users\Admin\AppData\Local\Temp\57929f594d0f8f3ba4ae818e0d80c5f8b031178e6b85f5b82e723615e2d8459a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\htnhth.exec:\htnhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jpvjv.exec:\jpvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\7ttnnn.exec:\7ttnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\bhbnbn.exec:\bhbnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\0608208.exec:\0608208.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\4646644.exec:\4646644.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\frrfrfx.exec:\frrfrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\ddjjd.exec:\ddjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\1pvpd.exec:\1pvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\o044886.exec:\o044886.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\vdpjv.exec:\vdpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\0284208.exec:\0284208.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\3fxlxrf.exec:\3fxlxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\dddpd.exec:\dddpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\thhhtt.exec:\thhhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\42860.exec:\42860.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\06826.exec:\06826.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\lxfrrll.exec:\lxfrrll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\42886.exec:\42886.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\3htttb.exec:\3htttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\jvvjv.exec:\jvvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\4464264.exec:\4464264.exe23⤵
- Executes dropped EXE
PID:4044 -
\??\c:\bnthhb.exec:\bnthhb.exe24⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nbbnhh.exec:\nbbnhh.exe25⤵
- Executes dropped EXE
PID:468 -
\??\c:\pddvp.exec:\pddvp.exe26⤵
- Executes dropped EXE
PID:2252 -
\??\c:\44086.exec:\44086.exe27⤵
- Executes dropped EXE
PID:4416 -
\??\c:\k22082.exec:\k22082.exe28⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5frlxrf.exec:\5frlxrf.exe29⤵
- Executes dropped EXE
PID:4132 -
\??\c:\446246.exec:\446246.exe30⤵
- Executes dropped EXE
PID:5096 -
\??\c:\vjvjp.exec:\vjvjp.exe31⤵
- Executes dropped EXE
PID:1456 -
\??\c:\2042042.exec:\2042042.exe32⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xrxffll.exec:\xrxffll.exe33⤵
- Executes dropped EXE
PID:4912 -
\??\c:\1hhtht.exec:\1hhtht.exe34⤵
- Executes dropped EXE
PID:404 -
\??\c:\24824.exec:\24824.exe35⤵
- Executes dropped EXE
PID:5020 -
\??\c:\fxxfrfx.exec:\fxxfrfx.exe36⤵
- Executes dropped EXE
PID:3092 -
\??\c:\bthbhb.exec:\bthbhb.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\4668664.exec:\4668664.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\666208.exec:\666208.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\s2042.exec:\s2042.exe40⤵
- Executes dropped EXE
PID:1360 -
\??\c:\w44248.exec:\w44248.exe41⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lxxlrlx.exec:\lxxlrlx.exe42⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jvpjp.exec:\jvpjp.exe43⤵
- Executes dropped EXE
PID:3580 -
\??\c:\4046420.exec:\4046420.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1hbnbn.exec:\1hbnbn.exe45⤵
- Executes dropped EXE
PID:2040 -
\??\c:\s2264.exec:\s2264.exe46⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bnntth.exec:\bnntth.exe47⤵
- Executes dropped EXE
PID:4748 -
\??\c:\006642.exec:\006642.exe48⤵
- Executes dropped EXE
PID:2124 -
\??\c:\u442086.exec:\u442086.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\80820.exec:\80820.exe50⤵
- Executes dropped EXE
PID:4692 -
\??\c:\8224642.exec:\8224642.exe51⤵
- Executes dropped EXE
PID:4420 -
\??\c:\084282.exec:\084282.exe52⤵
- Executes dropped EXE
PID:384 -
\??\c:\08864.exec:\08864.exe53⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rfxllfr.exec:\rfxllfr.exe54⤵
- Executes dropped EXE
PID:452 -
\??\c:\bhbtht.exec:\bhbtht.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\q48682.exec:\q48682.exe56⤵
- Executes dropped EXE
PID:436 -
\??\c:\e62026.exec:\e62026.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4824 -
\??\c:\5pvjp.exec:\5pvjp.exe58⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1lfrxlx.exec:\1lfrxlx.exe59⤵
- Executes dropped EXE
PID:2224 -
\??\c:\000804.exec:\000804.exe60⤵
- Executes dropped EXE
PID:3508 -
\??\c:\060860.exec:\060860.exe61⤵
- Executes dropped EXE
PID:648 -
\??\c:\484248.exec:\484248.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\24880.exec:\24880.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\2442048.exec:\2442048.exe64⤵
- Executes dropped EXE
PID:5040 -
\??\c:\lxxfxrr.exec:\lxxfxrr.exe65⤵
- Executes dropped EXE
PID:692 -
\??\c:\5rlfrxx.exec:\5rlfrxx.exe66⤵PID:3528
-
\??\c:\646448.exec:\646448.exe67⤵PID:3192
-
\??\c:\804420.exec:\804420.exe68⤵PID:2440
-
\??\c:\thtnbt.exec:\thtnbt.exe69⤵PID:740
-
\??\c:\8842486.exec:\8842486.exe70⤵PID:3632
-
\??\c:\88860.exec:\88860.exe71⤵PID:5032
-
\??\c:\w00864.exec:\w00864.exe72⤵PID:1104
-
\??\c:\68082.exec:\68082.exe73⤵PID:1296
-
\??\c:\e68646.exec:\e68646.exe74⤵PID:4324
-
\??\c:\nbthnt.exec:\nbthnt.exe75⤵PID:4776
-
\??\c:\xffxrlx.exec:\xffxrlx.exe76⤵PID:4108
-
\??\c:\08800.exec:\08800.exe77⤵PID:4936
-
\??\c:\62202.exec:\62202.exe78⤵
- System Location Discovery: System Language Discovery
PID:2252 -
\??\c:\482604.exec:\482604.exe79⤵PID:5092
-
\??\c:\pdjvp.exec:\pdjvp.exe80⤵PID:4028
-
\??\c:\q84604.exec:\q84604.exe81⤵PID:4864
-
\??\c:\0842044.exec:\0842044.exe82⤵PID:4132
-
\??\c:\0404040.exec:\0404040.exe83⤵PID:3476
-
\??\c:\0004864.exec:\0004864.exe84⤵PID:3320
-
\??\c:\k26644.exec:\k26644.exe85⤵PID:4344
-
\??\c:\0220864.exec:\0220864.exe86⤵PID:2376
-
\??\c:\ddpjv.exec:\ddpjv.exe87⤵PID:4432
-
\??\c:\c642420.exec:\c642420.exe88⤵PID:2284
-
\??\c:\xrxllfr.exec:\xrxllfr.exe89⤵PID:3144
-
\??\c:\dpjvd.exec:\dpjvd.exe90⤵PID:3612
-
\??\c:\hnnbhb.exec:\hnnbhb.exe91⤵PID:1884
-
\??\c:\26204.exec:\26204.exe92⤵PID:2468
-
\??\c:\2800826.exec:\2800826.exe93⤵PID:3048
-
\??\c:\28482.exec:\28482.exe94⤵PID:3256
-
\??\c:\lrrxflx.exec:\lrrxflx.exe95⤵PID:2696
-
\??\c:\btbbbb.exec:\btbbbb.exe96⤵PID:4404
-
\??\c:\88042.exec:\88042.exe97⤵PID:4332
-
\??\c:\k24660.exec:\k24660.exe98⤵PID:3716
-
\??\c:\8848660.exec:\8848660.exe99⤵PID:1804
-
\??\c:\9thbbb.exec:\9thbbb.exe100⤵PID:3772
-
\??\c:\btbtnt.exec:\btbtnt.exe101⤵PID:4524
-
\??\c:\nbbnhb.exec:\nbbnhb.exe102⤵PID:3232
-
\??\c:\g6262.exec:\g6262.exe103⤵PID:2124
-
\??\c:\c620804.exec:\c620804.exe104⤵PID:2064
-
\??\c:\ppdvv.exec:\ppdvv.exe105⤵PID:3884
-
\??\c:\64482.exec:\64482.exe106⤵PID:4940
-
\??\c:\62048.exec:\62048.exe107⤵PID:4828
-
\??\c:\a8482.exec:\a8482.exe108⤵
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\dvdpp.exec:\dvdpp.exe109⤵PID:1188
-
\??\c:\g8862.exec:\g8862.exe110⤵PID:1436
-
\??\c:\rffrfxx.exec:\rffrfxx.exe111⤵PID:3336
-
\??\c:\w06864.exec:\w06864.exe112⤵PID:4328
-
\??\c:\jjjjd.exec:\jjjjd.exe113⤵PID:4956
-
\??\c:\k66426.exec:\k66426.exe114⤵PID:4624
-
\??\c:\fllxlxl.exec:\fllxlxl.exe115⤵PID:4880
-
\??\c:\bntnnb.exec:\bntnnb.exe116⤵PID:4904
-
\??\c:\nbbthb.exec:\nbbthb.exe117⤵PID:2224
-
\??\c:\1nbnbt.exec:\1nbnbt.exe118⤵PID:2488
-
\??\c:\262082.exec:\262082.exe119⤵PID:648
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe120⤵PID:1624
-
\??\c:\4886420.exec:\4886420.exe121⤵PID:2308
-
\??\c:\488226.exec:\488226.exe122⤵PID:4564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-