Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 04:51
Static task
static1
Behavioral task
behavioral1
Sample
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
Resource
win7-20240903-en
General
-
Target
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe
-
Size
455KB
-
MD5
99b0e89fcc039943b0e4ba46c02e3d2e
-
SHA1
14ea75bd4995909017847cf1cfbb2de046517296
-
SHA256
2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5
-
SHA512
df322442f85a58413474a6c47e53fc51dce4b086271f3f4eb73230f41b2c2fb6cb1f82ac0effe0a63dab8bde25b6a546c99d649f1031195f7ac126085ad23e6b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRI7:q7Tc2NYHUrAwfMp3CDRg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/540-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1908-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/704-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1644-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1328-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4000-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/976-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3896-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3400-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1292-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2820-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/112-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3936-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3048-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1564-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2112-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-1041-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-1111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2700-1440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3168 5pvvv.exe 2908 xxrxlxf.exe 2820 rllfllr.exe 1292 nbbnhh.exe 1916 pjvjd.exe 4576 fxrlxlf.exe 1844 llfrlfr.exe 3988 ttnnhb.exe 1928 7dvpj.exe 4572 ppddv.exe 2612 9rrrxxf.exe 3300 bhbbtt.exe 2440 jjvpj.exe 3400 xfxrrrl.exe 4344 xlfxllf.exe 1816 hbbtnt.exe 3896 vpdjv.exe 3664 7jjdv.exe 2652 xxfrllf.exe 3304 bbnhbt.exe 3412 nhhbtt.exe 4920 pjjdv.exe 4864 rlxlfxr.exe 3524 bthbbh.exe 4144 httnhh.exe 552 jdjdv.exe 976 xxxxxxf.exe 2436 xrrfrlx.exe 2360 btbtnh.exe 2232 ddjdj.exe 4220 rrxrlfx.exe 4000 9rlfxxl.exe 1992 htbtnh.exe 1592 ppvpp.exe 1328 djdvj.exe 4500 fxrlfxr.exe 4848 rxrllll.exe 112 7hbbbb.exe 3936 7vpdv.exe 944 ppjvd.exe 1284 lxffxxx.exe 3152 bhhbtn.exe 1692 vjdvp.exe 1644 7dvjd.exe 1760 xrrlfxr.exe 4836 btnhbt.exe 3208 hntnbh.exe 704 dvvpj.exe 1908 5rfrlfr.exe 2948 5llxrlf.exe 1036 bbhnbn.exe 4388 pdvdp.exe 4548 pvvvv.exe 3616 rflfrlr.exe 4752 9tnhbt.exe 3768 dddvv.exe 4896 vdjdv.exe 2680 ffrlxrf.exe 1632 tnnbtn.exe 3724 nhtbbh.exe 752 vpjvj.exe 2840 fxfxllf.exe 4576 ttthbt.exe 1856 btntnb.exe -
resource yara_rule behavioral2/memory/540-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1908-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/704-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1644-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1328-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4000-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/976-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3896-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3400-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1292-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2820-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2908-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/112-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3936-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3048-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1564-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2112-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-1199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-1440-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 540 wrote to memory of 3168 540 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 83 PID 540 wrote to memory of 3168 540 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 83 PID 540 wrote to memory of 3168 540 2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe 83 PID 3168 wrote to memory of 2908 3168 5pvvv.exe 84 PID 3168 wrote to memory of 2908 3168 5pvvv.exe 84 PID 3168 wrote to memory of 2908 3168 5pvvv.exe 84 PID 2908 wrote to memory of 2820 2908 xxrxlxf.exe 85 PID 2908 wrote to memory of 2820 2908 xxrxlxf.exe 85 PID 2908 wrote to memory of 2820 2908 xxrxlxf.exe 85 PID 2820 wrote to memory of 1292 2820 rllfllr.exe 86 PID 2820 wrote to memory of 1292 2820 rllfllr.exe 86 PID 2820 wrote to memory of 1292 2820 rllfllr.exe 86 PID 1292 wrote to memory of 1916 1292 nbbnhh.exe 87 PID 1292 wrote to memory of 1916 1292 nbbnhh.exe 87 PID 1292 wrote to memory of 1916 1292 nbbnhh.exe 87 PID 1916 wrote to memory of 4576 1916 pjvjd.exe 145 PID 1916 wrote to memory of 4576 1916 pjvjd.exe 145 PID 1916 wrote to memory of 4576 1916 pjvjd.exe 145 PID 4576 wrote to memory of 1844 4576 fxrlxlf.exe 89 PID 4576 wrote to memory of 1844 4576 fxrlxlf.exe 89 PID 4576 wrote to memory of 1844 4576 fxrlxlf.exe 89 PID 1844 wrote to memory of 3988 1844 llfrlfr.exe 90 PID 1844 wrote to memory of 3988 1844 llfrlfr.exe 90 PID 1844 wrote to memory of 3988 1844 llfrlfr.exe 90 PID 3988 wrote to memory of 1928 3988 ttnnhb.exe 91 PID 3988 wrote to memory of 1928 3988 ttnnhb.exe 91 PID 3988 wrote to memory of 1928 3988 ttnnhb.exe 91 PID 1928 wrote to memory of 4572 1928 7dvpj.exe 92 PID 1928 wrote to memory of 4572 1928 7dvpj.exe 92 PID 1928 wrote to memory of 4572 1928 7dvpj.exe 92 PID 4572 wrote to memory of 2612 4572 ppddv.exe 93 PID 4572 wrote to memory of 2612 4572 ppddv.exe 93 PID 4572 wrote to memory of 2612 4572 ppddv.exe 93 PID 2612 wrote to memory of 3300 2612 9rrrxxf.exe 94 PID 2612 wrote to memory of 3300 2612 9rrrxxf.exe 94 PID 2612 wrote to memory of 3300 2612 9rrrxxf.exe 94 PID 3300 wrote to memory of 2440 3300 bhbbtt.exe 95 PID 3300 wrote to memory of 2440 3300 bhbbtt.exe 95 PID 3300 wrote to memory of 2440 3300 bhbbtt.exe 95 PID 2440 wrote to memory of 3400 2440 jjvpj.exe 96 PID 2440 wrote to memory of 3400 2440 jjvpj.exe 96 PID 2440 wrote to memory of 3400 2440 jjvpj.exe 96 PID 3400 wrote to memory of 4344 3400 xfxrrrl.exe 97 PID 3400 wrote to memory of 4344 3400 xfxrrrl.exe 97 PID 3400 wrote to memory of 4344 3400 xfxrrrl.exe 97 PID 4344 wrote to memory of 1816 4344 xlfxllf.exe 98 PID 4344 wrote to memory of 1816 4344 xlfxllf.exe 98 PID 4344 wrote to memory of 1816 4344 xlfxllf.exe 98 PID 1816 wrote to memory of 3896 1816 hbbtnt.exe 99 PID 1816 wrote to memory of 3896 1816 hbbtnt.exe 99 PID 1816 wrote to memory of 3896 1816 hbbtnt.exe 99 PID 3896 wrote to memory of 3664 3896 vpdjv.exe 100 PID 3896 wrote to memory of 3664 3896 vpdjv.exe 100 PID 3896 wrote to memory of 3664 3896 vpdjv.exe 100 PID 3664 wrote to memory of 2652 3664 7jjdv.exe 101 PID 3664 wrote to memory of 2652 3664 7jjdv.exe 101 PID 3664 wrote to memory of 2652 3664 7jjdv.exe 101 PID 2652 wrote to memory of 3304 2652 xxfrllf.exe 102 PID 2652 wrote to memory of 3304 2652 xxfrllf.exe 102 PID 2652 wrote to memory of 3304 2652 xxfrllf.exe 102 PID 3304 wrote to memory of 3412 3304 bbnhbt.exe 103 PID 3304 wrote to memory of 3412 3304 bbnhbt.exe 103 PID 3304 wrote to memory of 3412 3304 bbnhbt.exe 103 PID 3412 wrote to memory of 4920 3412 nhhbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"C:\Users\Admin\AppData\Local\Temp\2348d17aff4fa3212dbb9231b408425dc7dd8071949438331385d06d111de1b5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\5pvvv.exec:\5pvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rllfllr.exec:\rllfllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nbbnhh.exec:\nbbnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\pjvjd.exec:\pjvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\llfrlfr.exec:\llfrlfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\ttnnhb.exec:\ttnnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\7dvpj.exec:\7dvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ppddv.exec:\ppddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9rrrxxf.exec:\9rrrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\bhbbtt.exec:\bhbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\jjvpj.exec:\jjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\xlfxllf.exec:\xlfxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\hbbtnt.exec:\hbbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\7jjdv.exec:\7jjdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\xxfrllf.exec:\xxfrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bbnhbt.exec:\bbnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\nhhbtt.exec:\nhhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\pjjdv.exec:\pjjdv.exe23⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rlxlfxr.exec:\rlxlfxr.exe24⤵
- Executes dropped EXE
PID:4864 -
\??\c:\bthbbh.exec:\bthbbh.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\httnhh.exec:\httnhh.exe26⤵
- Executes dropped EXE
PID:4144 -
\??\c:\jdjdv.exec:\jdjdv.exe27⤵
- Executes dropped EXE
PID:552 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe28⤵
- Executes dropped EXE
PID:976 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\btbtnh.exec:\btbtnh.exe30⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ddjdj.exec:\ddjdj.exe31⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe32⤵
- Executes dropped EXE
PID:4220 -
\??\c:\9rlfxxl.exec:\9rlfxxl.exe33⤵
- Executes dropped EXE
PID:4000 -
\??\c:\htbtnh.exec:\htbtnh.exe34⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ppvpp.exec:\ppvpp.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\djdvj.exec:\djdvj.exe36⤵
- Executes dropped EXE
PID:1328 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe37⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rxrllll.exec:\rxrllll.exe38⤵
- Executes dropped EXE
PID:4848 -
\??\c:\7hbbbb.exec:\7hbbbb.exe39⤵
- Executes dropped EXE
PID:112 -
\??\c:\7vpdv.exec:\7vpdv.exe40⤵
- Executes dropped EXE
PID:3936 -
\??\c:\ppjvd.exec:\ppjvd.exe41⤵
- Executes dropped EXE
PID:944 -
\??\c:\lxffxxx.exec:\lxffxxx.exe42⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bhhbtn.exec:\bhhbtn.exe43⤵
- Executes dropped EXE
PID:3152 -
\??\c:\vjdvp.exec:\vjdvp.exe44⤵
- Executes dropped EXE
PID:1692 -
\??\c:\7dvjd.exec:\7dvjd.exe45⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe46⤵
- Executes dropped EXE
PID:1760 -
\??\c:\btnhbt.exec:\btnhbt.exe47⤵
- Executes dropped EXE
PID:4836 -
\??\c:\hntnbh.exec:\hntnbh.exe48⤵
- Executes dropped EXE
PID:3208 -
\??\c:\dvvpj.exec:\dvvpj.exe49⤵
- Executes dropped EXE
PID:704 -
\??\c:\5rfrlfr.exec:\5rfrlfr.exe50⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5llxrlf.exec:\5llxrlf.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbhnbn.exec:\bbhnbn.exe52⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pdvdp.exec:\pdvdp.exe53⤵
- Executes dropped EXE
PID:4388 -
\??\c:\pvvvv.exec:\pvvvv.exe54⤵
- Executes dropped EXE
PID:4548 -
\??\c:\rflfrlr.exec:\rflfrlr.exe55⤵
- Executes dropped EXE
PID:3616 -
\??\c:\9tnhbt.exec:\9tnhbt.exe56⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dddvv.exec:\dddvv.exe57⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vdjdv.exec:\vdjdv.exe58⤵
- Executes dropped EXE
PID:4896 -
\??\c:\ffrlxrf.exec:\ffrlxrf.exe59⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tnnbtn.exec:\tnnbtn.exe60⤵
- Executes dropped EXE
PID:1632 -
\??\c:\nhtbbh.exec:\nhtbbh.exe61⤵
- Executes dropped EXE
PID:3724 -
\??\c:\vpjvj.exec:\vpjvj.exe62⤵
- Executes dropped EXE
PID:752 -
\??\c:\fxfxllf.exec:\fxfxllf.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ttthbt.exec:\ttthbt.exe64⤵
- Executes dropped EXE
PID:4576 -
\??\c:\btntnb.exec:\btntnb.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7vvjv.exec:\7vvjv.exe66⤵PID:3268
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe67⤵PID:2904
-
\??\c:\ffxrfxl.exec:\ffxrfxl.exe68⤵PID:4884
-
\??\c:\btbtnn.exec:\btbtnn.exe69⤵PID:5036
-
\??\c:\jdvjj.exec:\jdvjj.exe70⤵PID:5048
-
\??\c:\fflfrlx.exec:\fflfrlx.exe71⤵PID:2440
-
\??\c:\fffxxxl.exec:\fffxxxl.exe72⤵PID:4128
-
\??\c:\5hbtnn.exec:\5hbtnn.exe73⤵PID:1816
-
\??\c:\fxrllff.exec:\fxrllff.exe74⤵PID:4700
-
\??\c:\1nhbnn.exec:\1nhbnn.exe75⤵PID:3340
-
\??\c:\1hhbnn.exec:\1hhbnn.exe76⤵PID:760
-
\??\c:\vvvpj.exec:\vvvpj.exe77⤵PID:4668
-
\??\c:\3rlfrrf.exec:\3rlfrrf.exe78⤵PID:3624
-
\??\c:\bhbttn.exec:\bhbttn.exe79⤵PID:3524
-
\??\c:\ddvpj.exec:\ddvpj.exe80⤵PID:908
-
\??\c:\ffflffr.exec:\ffflffr.exe81⤵PID:976
-
\??\c:\tnnbtn.exec:\tnnbtn.exe82⤵PID:4100
-
\??\c:\nbbthh.exec:\nbbthh.exe83⤵PID:2300
-
\??\c:\7vdvd.exec:\7vdvd.exe84⤵PID:1068
-
\??\c:\5xfxrlx.exec:\5xfxrlx.exe85⤵PID:4084
-
\??\c:\tbhhth.exec:\tbhhth.exe86⤵PID:4020
-
\??\c:\jvvdv.exec:\jvvdv.exe87⤵PID:2036
-
\??\c:\rxrllrr.exec:\rxrllrr.exe88⤵PID:4904
-
\??\c:\fllxrrl.exec:\fllxrrl.exe89⤵PID:460
-
\??\c:\3ttttb.exec:\3ttttb.exe90⤵PID:112
-
\??\c:\1vvpj.exec:\1vvpj.exe91⤵PID:3936
-
\??\c:\tbtnht.exec:\tbtnht.exe92⤵PID:4212
-
\??\c:\pjjjj.exec:\pjjjj.exe93⤵PID:3576
-
\??\c:\xflfffx.exec:\xflfffx.exe94⤵PID:2536
-
\??\c:\5rrrrrr.exec:\5rrrrrr.exe95⤵PID:3152
-
\??\c:\ttbhbb.exec:\ttbhbb.exe96⤵PID:1644
-
\??\c:\dvpvd.exec:\dvpvd.exe97⤵PID:1760
-
\??\c:\ffllrfl.exec:\ffllrfl.exe98⤵PID:4640
-
\??\c:\jjdvp.exec:\jjdvp.exe99⤵PID:2868
-
\??\c:\5fxxxrl.exec:\5fxxxrl.exe100⤵PID:5076
-
\??\c:\pjppp.exec:\pjppp.exe101⤵PID:2948
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe102⤵PID:1036
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe103⤵PID:1984
-
\??\c:\tnhhhh.exec:\tnhhhh.exe104⤵PID:4964
-
\??\c:\jjvvj.exec:\jjvvj.exe105⤵PID:4076
-
\??\c:\rllllxx.exec:\rllllxx.exe106⤵PID:3616
-
\??\c:\rrfflrf.exec:\rrfflrf.exe107⤵PID:2020
-
\??\c:\btbttt.exec:\btbttt.exe108⤵PID:3212
-
\??\c:\1jppd.exec:\1jppd.exe109⤵PID:4968
-
\??\c:\dvjdj.exec:\dvjdj.exe110⤵PID:4764
-
\??\c:\xffxrrr.exec:\xffxrrr.exe111⤵PID:2952
-
\??\c:\nnhhhh.exec:\nnhhhh.exe112⤵PID:3724
-
\??\c:\ppdvv.exec:\ppdvv.exe113⤵PID:4120
-
\??\c:\bnbhnt.exec:\bnbhnt.exe114⤵PID:2840
-
\??\c:\pvjdd.exec:\pvjdd.exe115⤵PID:2240
-
\??\c:\xfllfll.exec:\xfllfll.exe116⤵PID:4420
-
\??\c:\7jdvj.exec:\7jdvj.exe117⤵PID:4636
-
\??\c:\xlrlrll.exec:\xlrlrll.exe118⤵PID:3268
-
\??\c:\7btnhh.exec:\7btnhh.exe119⤵PID:4572
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe120⤵PID:2612
-
\??\c:\htbtnh.exec:\htbtnh.exe121⤵PID:4712
-
\??\c:\pppjp.exec:\pppjp.exe122⤵PID:3136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-