Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe
Resource
win7-20241023-en
General
-
Target
2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe
-
Size
453KB
-
MD5
6f20589f4843e015d6d80577f17ff0c0
-
SHA1
e39ae26d46178ac49234197e472f5d452e2c43ae
-
SHA256
2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827
-
SHA512
e3bb0e74c57e93722f81d81bed0a8a54099e3627d3794dab67e41ff985dcd6baf7a2e45fbcf0bf34aa56f41afe60d9a6749aeba83295652e98bcfedf2eab1565
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3964-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/956-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1492-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1616-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/652-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3372-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3344-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/444-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1116-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4888-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1888-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2484-1267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-1518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3248 xrxlrlf.exe 4768 jdpjp.exe 4512 5dvpj.exe 1700 ppvpj.exe 1028 rrllfll.exe 5080 nbnnbh.exe 3612 1vvpp.exe 2536 xxxfxxx.exe 3356 hhhnhb.exe 2388 3djjp.exe 1920 9xfffll.exe 2956 nhbttt.exe 1792 dvjdd.exe 3380 rfxllll.exe 3008 nhnnnt.exe 2004 pjjdd.exe 3316 rflfffx.exe 4612 hbhbhh.exe 3112 frlxlrl.exe 1604 thnhtt.exe 956 7xxrllx.exe 3968 7vvpd.exe 1492 pjvpj.exe 696 fxxxrlf.exe 4524 vpjjd.exe 4156 lffflfl.exe 1616 lflfffr.exe 652 tnnbtt.exe 960 pjvpd.exe 4344 7hnnnn.exe 5088 xlfxrrl.exe 2940 thhhbh.exe 3484 rlrlllf.exe 2232 fxxlxlr.exe 4360 7hnbtb.exe 2020 jjdpd.exe 4560 rrlfxrl.exe 3600 ttthtn.exe 5116 vpppj.exe 1844 lrrlxxf.exe 3508 hntnhh.exe 1372 nbhbnn.exe 4324 9ppjd.exe 1996 9llfxxl.exe 1552 rlrrlfr.exe 2220 htbttn.exe 4600 jjppv.exe 1872 3rfxrrl.exe 4756 btbtnn.exe 3084 5pvpp.exe 1500 rlfxlll.exe 1028 btthbt.exe 4076 htthbt.exe 1496 jjpdd.exe 1796 fxlflfx.exe 3432 fxxrrll.exe 1956 nhhbbt.exe 3020 7jjdv.exe 816 frxlflf.exe 3592 rlxrlll.exe 2948 nhnbtn.exe 3436 3vjdp.exe 5012 1djdp.exe 3972 rlrllfx.exe -
resource yara_rule behavioral2/memory/3964-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3248-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/956-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1492-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1616-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/652-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3372-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3344-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/444-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1116-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1840-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4888-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2812-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-750-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3964 wrote to memory of 3248 3964 2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe 82 PID 3964 wrote to memory of 3248 3964 2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe 82 PID 3964 wrote to memory of 3248 3964 2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe 82 PID 3248 wrote to memory of 4768 3248 xrxlrlf.exe 83 PID 3248 wrote to memory of 4768 3248 xrxlrlf.exe 83 PID 3248 wrote to memory of 4768 3248 xrxlrlf.exe 83 PID 4768 wrote to memory of 4512 4768 jdpjp.exe 84 PID 4768 wrote to memory of 4512 4768 jdpjp.exe 84 PID 4768 wrote to memory of 4512 4768 jdpjp.exe 84 PID 4512 wrote to memory of 1700 4512 5dvpj.exe 85 PID 4512 wrote to memory of 1700 4512 5dvpj.exe 85 PID 4512 wrote to memory of 1700 4512 5dvpj.exe 85 PID 1700 wrote to memory of 1028 1700 ppvpj.exe 86 PID 1700 wrote to memory of 1028 1700 ppvpj.exe 86 PID 1700 wrote to memory of 1028 1700 ppvpj.exe 86 PID 1028 wrote to memory of 5080 1028 rrllfll.exe 87 PID 1028 wrote to memory of 5080 1028 rrllfll.exe 87 PID 1028 wrote to memory of 5080 1028 rrllfll.exe 87 PID 5080 wrote to memory of 3612 5080 nbnnbh.exe 88 PID 5080 wrote to memory of 3612 5080 nbnnbh.exe 88 PID 5080 wrote to memory of 3612 5080 nbnnbh.exe 88 PID 3612 wrote to memory of 2536 3612 1vvpp.exe 89 PID 3612 wrote to memory of 2536 3612 1vvpp.exe 89 PID 3612 wrote to memory of 2536 3612 1vvpp.exe 89 PID 2536 wrote to memory of 3356 2536 xxxfxxx.exe 90 PID 2536 wrote to memory of 3356 2536 xxxfxxx.exe 90 PID 2536 wrote to memory of 3356 2536 xxxfxxx.exe 90 PID 3356 wrote to memory of 2388 3356 hhhnhb.exe 91 PID 3356 wrote to memory of 2388 3356 hhhnhb.exe 91 PID 3356 wrote to memory of 2388 3356 hhhnhb.exe 91 PID 2388 wrote to memory of 1920 2388 3djjp.exe 92 PID 2388 wrote to memory of 1920 2388 3djjp.exe 92 PID 2388 wrote to memory of 1920 2388 3djjp.exe 92 PID 1920 wrote to memory of 2956 1920 9xfffll.exe 93 PID 1920 wrote to memory of 2956 1920 9xfffll.exe 93 PID 1920 wrote to memory of 2956 1920 9xfffll.exe 93 PID 2956 wrote to memory of 1792 2956 nhbttt.exe 94 PID 2956 wrote to memory of 1792 2956 nhbttt.exe 94 PID 2956 wrote to memory of 1792 2956 nhbttt.exe 94 PID 1792 wrote to memory of 3380 1792 dvjdd.exe 95 PID 1792 wrote to memory of 3380 1792 dvjdd.exe 95 PID 1792 wrote to memory of 3380 1792 dvjdd.exe 95 PID 3380 wrote to memory of 3008 3380 rfxllll.exe 96 PID 3380 wrote to memory of 3008 3380 rfxllll.exe 96 PID 3380 wrote to memory of 3008 3380 rfxllll.exe 96 PID 3008 wrote to memory of 2004 3008 nhnnnt.exe 97 PID 3008 wrote to memory of 2004 3008 nhnnnt.exe 97 PID 3008 wrote to memory of 2004 3008 nhnnnt.exe 97 PID 2004 wrote to memory of 3316 2004 pjjdd.exe 98 PID 2004 wrote to memory of 3316 2004 pjjdd.exe 98 PID 2004 wrote to memory of 3316 2004 pjjdd.exe 98 PID 3316 wrote to memory of 4612 3316 rflfffx.exe 99 PID 3316 wrote to memory of 4612 3316 rflfffx.exe 99 PID 3316 wrote to memory of 4612 3316 rflfffx.exe 99 PID 4612 wrote to memory of 3112 4612 hbhbhh.exe 100 PID 4612 wrote to memory of 3112 4612 hbhbhh.exe 100 PID 4612 wrote to memory of 3112 4612 hbhbhh.exe 100 PID 3112 wrote to memory of 1604 3112 frlxlrl.exe 101 PID 3112 wrote to memory of 1604 3112 frlxlrl.exe 101 PID 3112 wrote to memory of 1604 3112 frlxlrl.exe 101 PID 1604 wrote to memory of 956 1604 thnhtt.exe 102 PID 1604 wrote to memory of 956 1604 thnhtt.exe 102 PID 1604 wrote to memory of 956 1604 thnhtt.exe 102 PID 956 wrote to memory of 3968 956 7xxrllx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe"C:\Users\Admin\AppData\Local\Temp\2001530ceb7b77293eede8b85937e917665ca0986e6b39836c238572aa5d8827N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\xrxlrlf.exec:\xrxlrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\jdpjp.exec:\jdpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\5dvpj.exec:\5dvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\ppvpj.exec:\ppvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\rrllfll.exec:\rrllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\nbnnbh.exec:\nbnnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\1vvpp.exec:\1vvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\hhhnhb.exec:\hhhnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\3djjp.exec:\3djjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\9xfffll.exec:\9xfffll.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nhbttt.exec:\nhbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\dvjdd.exec:\dvjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\rfxllll.exec:\rfxllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\nhnnnt.exec:\nhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\pjjdd.exec:\pjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\rflfffx.exec:\rflfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\hbhbhh.exec:\hbhbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\frlxlrl.exec:\frlxlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\thnhtt.exec:\thnhtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\7xxrllx.exec:\7xxrllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\7vvpd.exec:\7vvpd.exe23⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\vpjjd.exec:\vpjjd.exe26⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lffflfl.exec:\lffflfl.exe27⤵
- Executes dropped EXE
PID:4156 -
\??\c:\lflfffr.exec:\lflfffr.exe28⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnnbtt.exec:\tnnbtt.exe29⤵
- Executes dropped EXE
PID:652 -
\??\c:\pjvpd.exec:\pjvpd.exe30⤵
- Executes dropped EXE
PID:960 -
\??\c:\7hnnnn.exec:\7hnnnn.exe31⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe32⤵
- Executes dropped EXE
PID:5088 -
\??\c:\thhhbh.exec:\thhhbh.exe33⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlrlllf.exec:\rlrlllf.exe34⤵
- Executes dropped EXE
PID:3484 -
\??\c:\fxxlxlr.exec:\fxxlxlr.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7hnbtb.exec:\7hnbtb.exe36⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jjdpd.exec:\jjdpd.exe37⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe38⤵
- Executes dropped EXE
PID:4560 -
\??\c:\ttthtn.exec:\ttthtn.exe39⤵
- Executes dropped EXE
PID:3600 -
\??\c:\vpppj.exec:\vpppj.exe40⤵
- Executes dropped EXE
PID:5116 -
\??\c:\lrrlxxf.exec:\lrrlxxf.exe41⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hntnhh.exec:\hntnhh.exe42⤵
- Executes dropped EXE
PID:3508 -
\??\c:\nbhbnn.exec:\nbhbnn.exe43⤵
- Executes dropped EXE
PID:1372 -
\??\c:\9ppjd.exec:\9ppjd.exe44⤵
- Executes dropped EXE
PID:4324 -
\??\c:\9llfxxl.exec:\9llfxxl.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\rlrrlfr.exec:\rlrrlfr.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\htbttn.exec:\htbttn.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jjppv.exec:\jjppv.exe48⤵
- Executes dropped EXE
PID:4600 -
\??\c:\3rfxrrl.exec:\3rfxrrl.exe49⤵
- Executes dropped EXE
PID:1872 -
\??\c:\btbtnn.exec:\btbtnn.exe50⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5pvpp.exec:\5pvpp.exe51⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rlfxlll.exec:\rlfxlll.exe52⤵
- Executes dropped EXE
PID:1500 -
\??\c:\btthbt.exec:\btthbt.exe53⤵
- Executes dropped EXE
PID:1028 -
\??\c:\htthbt.exec:\htthbt.exe54⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jjpdd.exec:\jjpdd.exe55⤵
- Executes dropped EXE
PID:1496 -
\??\c:\fxlflfx.exec:\fxlflfx.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\fxxrrll.exec:\fxxrrll.exe57⤵
- Executes dropped EXE
PID:3432 -
\??\c:\nhhbbt.exec:\nhhbbt.exe58⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7jjdv.exec:\7jjdv.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frxlflf.exec:\frxlflf.exe60⤵
- Executes dropped EXE
PID:816 -
\??\c:\rlxrlll.exec:\rlxrlll.exe61⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nhnbtn.exec:\nhnbtn.exe62⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3vjdp.exec:\3vjdp.exe63⤵
- Executes dropped EXE
PID:3436 -
\??\c:\1djdp.exec:\1djdp.exe64⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rlrllfx.exec:\rlrllfx.exe65⤵
- Executes dropped EXE
PID:3972 -
\??\c:\btnbth.exec:\btnbth.exe66⤵PID:724
-
\??\c:\djpjv.exec:\djpjv.exe67⤵PID:2004
-
\??\c:\vpjdv.exec:\vpjdv.exe68⤵PID:1568
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe69⤵PID:2440
-
\??\c:\hntnhb.exec:\hntnhb.exe70⤵PID:3372
-
\??\c:\nnnhbb.exec:\nnnhbb.exe71⤵PID:1168
-
\??\c:\jvjdp.exec:\jvjdp.exe72⤵PID:1724
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe73⤵PID:852
-
\??\c:\bnttnb.exec:\bnttnb.exe74⤵PID:5108
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:3548
-
\??\c:\rfrlllr.exec:\rfrlllr.exe76⤵PID:3896
-
\??\c:\3xrxrlx.exec:\3xrxrlx.exe77⤵PID:3968
-
\??\c:\btbnnn.exec:\btbnnn.exe78⤵PID:5028
-
\??\c:\pvvjd.exec:\pvvjd.exe79⤵PID:1068
-
\??\c:\rrffrrx.exec:\rrffrrx.exe80⤵PID:3920
-
\??\c:\9ttnhn.exec:\9ttnhn.exe81⤵PID:4392
-
\??\c:\jvdpp.exec:\jvdpp.exe82⤵PID:1144
-
\??\c:\jvdpj.exec:\jvdpj.exe83⤵PID:1616
-
\??\c:\fxxrllf.exec:\fxxrllf.exe84⤵PID:4428
-
\??\c:\bttnhh.exec:\bttnhh.exe85⤵PID:1980
-
\??\c:\pppvp.exec:\pppvp.exe86⤵PID:4252
-
\??\c:\djpjd.exec:\djpjd.exe87⤵PID:2368
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe88⤵PID:3616
-
\??\c:\bhnhbb.exec:\bhnhbb.exe89⤵PID:736
-
\??\c:\ddjdp.exec:\ddjdp.exe90⤵PID:2260
-
\??\c:\7xrrffx.exec:\7xrrffx.exe91⤵PID:4944
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe92⤵PID:1120
-
\??\c:\nhbbhh.exec:\nhbbhh.exe93⤵PID:4488
-
\??\c:\dpvpp.exec:\dpvpp.exe94⤵PID:700
-
\??\c:\lxffxxx.exec:\lxffxxx.exe95⤵PID:3016
-
\??\c:\rfllllf.exec:\rfllllf.exe96⤵PID:3344
-
\??\c:\9hhbtt.exec:\9hhbtt.exe97⤵PID:444
-
\??\c:\dpvpj.exec:\dpvpj.exe98⤵PID:3052
-
\??\c:\rflfxrl.exec:\rflfxrl.exe99⤵PID:2736
-
\??\c:\bntnnn.exec:\bntnnn.exe100⤵PID:1556
-
\??\c:\9ttnbb.exec:\9ttnbb.exe101⤵PID:4352
-
\??\c:\5djdd.exec:\5djdd.exe102⤵PID:2732
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe103⤵PID:1532
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe104⤵PID:4004
-
\??\c:\3hbttt.exec:\3hbttt.exe105⤵PID:4128
-
\??\c:\pjvpj.exec:\pjvpj.exe106⤵PID:908
-
\??\c:\jjjdv.exec:\jjjdv.exe107⤵PID:2756
-
\??\c:\xflrlfx.exec:\xflrlfx.exe108⤵PID:4600
-
\??\c:\hhtnnn.exec:\hhtnnn.exe109⤵PID:1700
-
\??\c:\jjvvd.exec:\jjvvd.exe110⤵PID:2708
-
\??\c:\vpdvp.exec:\vpdvp.exe111⤵PID:4596
-
\??\c:\xllfrlf.exec:\xllfrlf.exe112⤵PID:4024
-
\??\c:\nhhhbb.exec:\nhhhbb.exe113⤵PID:1452
-
\??\c:\nnbhhh.exec:\nnbhhh.exe114⤵PID:1116
-
\??\c:\pvdvj.exec:\pvdvj.exe115⤵PID:2296
-
\??\c:\5rxrlfx.exec:\5rxrlfx.exe116⤵PID:4188
-
\??\c:\ntbbbt.exec:\ntbbbt.exe117⤵PID:1796
-
\??\c:\bnnhbt.exec:\bnnhbt.exe118⤵
- System Location Discovery: System Language Discovery
PID:3356 -
\??\c:\pjdvp.exec:\pjdvp.exe119⤵PID:2336
-
\??\c:\fflffxf.exec:\fflffxf.exe120⤵PID:3020
-
\??\c:\bntnhh.exec:\bntnhh.exe121⤵PID:816
-
\??\c:\thhbbt.exec:\thhbbt.exe122⤵PID:4444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-