Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:10
Static task
static1
Behavioral task
behavioral1
Sample
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe
Resource
win7-20240903-en
General
-
Target
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe
-
Size
456KB
-
MD5
46587820306ccc5ffdaaeb8d521c3f77
-
SHA1
698ccd51d7de7529f6f011a543cf4e1019b22b88
-
SHA256
1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142
-
SHA512
d41a3fb95ce5ec167583249aadc5e2eae2ea365fe27a987560395be226d1ec413c803de84562fb2691eb7fd40a107f2334b513dd66f93d9ac14fe40cffb650f1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLK:q7Tc2NYHUrAwfMp3CDLK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4296-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3628-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1820-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2072-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4036-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1012-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4128-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2004-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5104-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-907-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-1119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-1189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 552 pppjd.exe 4296 rfffffl.exe 3628 htbbtt.exe 4876 vvvpj.exe 2848 vpdvv.exe 2748 hthhbb.exe 4496 ddddd.exe 4480 jvddd.exe 1820 rxffxxr.exe 4440 hhhhhh.exe 5104 jvddd.exe 2072 3httbb.exe 3784 5jdvp.exe 4036 jdddv.exe 2408 fllxlfx.exe 3016 9jpjp.exe 5108 dpdpj.exe 3564 htbtnh.exe 1976 7dpdv.exe 4984 3djdv.exe 4760 5bhbtt.exe 1012 xrlfxxr.exe 2736 fxxxrll.exe 980 lflfxrr.exe 3004 nbhbnn.exe 5068 5jjdv.exe 5016 vpjdv.exe 4128 nhttbt.exe 3084 xfllffx.exe 2708 tnhhbb.exe 1600 fxlfllr.exe 3184 bhnnhh.exe 4724 jvjdj.exe 2380 5vdvp.exe 4636 lxrrlll.exe 2912 hntnhh.exe 3664 vdpjd.exe 2004 5xlfxfx.exe 4428 nbnnnn.exe 1948 tnnhhb.exe 3256 dpvvv.exe 468 5xfxrrl.exe 3972 htnhnn.exe 2304 vjppj.exe 3392 vppjd.exe 4536 fxlrxfl.exe 3092 nbtnnn.exe 2196 dvddv.exe 4920 pdddd.exe 4444 ffxrllf.exe 2108 7ntnnn.exe 3284 vvvvv.exe 4868 lxfxrrx.exe 3828 xlrxrrr.exe 1096 btbbbb.exe 4880 3vvjd.exe 1676 9xffrrr.exe 668 lflfffx.exe 1484 nthbhh.exe 3040 lxffrrl.exe 232 xfxrrrl.exe 3700 tntnbt.exe 4480 vppjd.exe 3348 lrxrlll.exe -
resource yara_rule behavioral2/memory/4296-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3628-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/552-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1820-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2072-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4036-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1012-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4128-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2004-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3256-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4712-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-1189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-1295-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 552 2224 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 83 PID 2224 wrote to memory of 552 2224 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 83 PID 2224 wrote to memory of 552 2224 1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe 83 PID 552 wrote to memory of 4296 552 pppjd.exe 84 PID 552 wrote to memory of 4296 552 pppjd.exe 84 PID 552 wrote to memory of 4296 552 pppjd.exe 84 PID 4296 wrote to memory of 3628 4296 rfffffl.exe 85 PID 4296 wrote to memory of 3628 4296 rfffffl.exe 85 PID 4296 wrote to memory of 3628 4296 rfffffl.exe 85 PID 3628 wrote to memory of 4876 3628 htbbtt.exe 86 PID 3628 wrote to memory of 4876 3628 htbbtt.exe 86 PID 3628 wrote to memory of 4876 3628 htbbtt.exe 86 PID 4876 wrote to memory of 2848 4876 vvvpj.exe 87 PID 4876 wrote to memory of 2848 4876 vvvpj.exe 87 PID 4876 wrote to memory of 2848 4876 vvvpj.exe 87 PID 2848 wrote to memory of 2748 2848 vpdvv.exe 88 PID 2848 wrote to memory of 2748 2848 vpdvv.exe 88 PID 2848 wrote to memory of 2748 2848 vpdvv.exe 88 PID 2748 wrote to memory of 4496 2748 hthhbb.exe 89 PID 2748 wrote to memory of 4496 2748 hthhbb.exe 89 PID 2748 wrote to memory of 4496 2748 hthhbb.exe 89 PID 4496 wrote to memory of 4480 4496 ddddd.exe 90 PID 4496 wrote to memory of 4480 4496 ddddd.exe 90 PID 4496 wrote to memory of 4480 4496 ddddd.exe 90 PID 4480 wrote to memory of 1820 4480 jvddd.exe 91 PID 4480 wrote to memory of 1820 4480 jvddd.exe 91 PID 4480 wrote to memory of 1820 4480 jvddd.exe 91 PID 1820 wrote to memory of 4440 1820 rxffxxr.exe 92 PID 1820 wrote to memory of 4440 1820 rxffxxr.exe 92 PID 1820 wrote to memory of 4440 1820 rxffxxr.exe 92 PID 4440 wrote to memory of 5104 4440 hhhhhh.exe 93 PID 4440 wrote to memory of 5104 4440 hhhhhh.exe 93 PID 4440 wrote to memory of 5104 4440 hhhhhh.exe 93 PID 5104 wrote to memory of 2072 5104 jvddd.exe 94 PID 5104 wrote to memory of 2072 5104 jvddd.exe 94 PID 5104 wrote to memory of 2072 5104 jvddd.exe 94 PID 2072 wrote to memory of 3784 2072 3httbb.exe 95 PID 2072 wrote to memory of 3784 2072 3httbb.exe 95 PID 2072 wrote to memory of 3784 2072 3httbb.exe 95 PID 3784 wrote to memory of 4036 3784 5jdvp.exe 96 PID 3784 wrote to memory of 4036 3784 5jdvp.exe 96 PID 3784 wrote to memory of 4036 3784 5jdvp.exe 96 PID 4036 wrote to memory of 2408 4036 jdddv.exe 97 PID 4036 wrote to memory of 2408 4036 jdddv.exe 97 PID 4036 wrote to memory of 2408 4036 jdddv.exe 97 PID 2408 wrote to memory of 3016 2408 fllxlfx.exe 98 PID 2408 wrote to memory of 3016 2408 fllxlfx.exe 98 PID 2408 wrote to memory of 3016 2408 fllxlfx.exe 98 PID 3016 wrote to memory of 5108 3016 9jpjp.exe 99 PID 3016 wrote to memory of 5108 3016 9jpjp.exe 99 PID 3016 wrote to memory of 5108 3016 9jpjp.exe 99 PID 5108 wrote to memory of 3564 5108 dpdpj.exe 100 PID 5108 wrote to memory of 3564 5108 dpdpj.exe 100 PID 5108 wrote to memory of 3564 5108 dpdpj.exe 100 PID 3564 wrote to memory of 1976 3564 htbtnh.exe 101 PID 3564 wrote to memory of 1976 3564 htbtnh.exe 101 PID 3564 wrote to memory of 1976 3564 htbtnh.exe 101 PID 1976 wrote to memory of 4984 1976 7dpdv.exe 102 PID 1976 wrote to memory of 4984 1976 7dpdv.exe 102 PID 1976 wrote to memory of 4984 1976 7dpdv.exe 102 PID 4984 wrote to memory of 4760 4984 3djdv.exe 103 PID 4984 wrote to memory of 4760 4984 3djdv.exe 103 PID 4984 wrote to memory of 4760 4984 3djdv.exe 103 PID 4760 wrote to memory of 1012 4760 5bhbtt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe"C:\Users\Admin\AppData\Local\Temp\1736376b090e6f3776955926d598c0a025649d5d0f8872601d55e9c1780bb142.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\pppjd.exec:\pppjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\rfffffl.exec:\rfffffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\htbbtt.exec:\htbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\vvvpj.exec:\vvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vpdvv.exec:\vpdvv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\hthhbb.exec:\hthhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\ddddd.exec:\ddddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jvddd.exec:\jvddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rxffxxr.exec:\rxffxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\hhhhhh.exec:\hhhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\jvddd.exec:\jvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\3httbb.exec:\3httbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\5jdvp.exec:\5jdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\jdddv.exec:\jdddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\fllxlfx.exec:\fllxlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\9jpjp.exec:\9jpjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\dpdpj.exec:\dpdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\htbtnh.exec:\htbtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\7dpdv.exec:\7dpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3djdv.exec:\3djdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\5bhbtt.exec:\5bhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fxxxrll.exec:\fxxxrll.exe24⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lflfxrr.exec:\lflfxrr.exe25⤵
- Executes dropped EXE
PID:980 -
\??\c:\nbhbnn.exec:\nbhbnn.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5jjdv.exec:\5jjdv.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068 -
\??\c:\vpjdv.exec:\vpjdv.exe28⤵
- Executes dropped EXE
PID:5016 -
\??\c:\nhttbt.exec:\nhttbt.exe29⤵
- Executes dropped EXE
PID:4128 -
\??\c:\xfllffx.exec:\xfllffx.exe30⤵
- Executes dropped EXE
PID:3084 -
\??\c:\tnhhbb.exec:\tnhhbb.exe31⤵
- Executes dropped EXE
PID:2708 -
\??\c:\fxlfllr.exec:\fxlfllr.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bhnnhh.exec:\bhnnhh.exe33⤵
- Executes dropped EXE
PID:3184 -
\??\c:\jvjdj.exec:\jvjdj.exe34⤵
- Executes dropped EXE
PID:4724 -
\??\c:\5vdvp.exec:\5vdvp.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxrrlll.exec:\lxrrlll.exe36⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hntnhh.exec:\hntnhh.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vdpjd.exec:\vdpjd.exe38⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5xlfxfx.exec:\5xlfxfx.exe39⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nbnnnn.exec:\nbnnnn.exe40⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tnnhhb.exec:\tnnhhb.exe41⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dpvvv.exec:\dpvvv.exe42⤵
- Executes dropped EXE
PID:3256 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe43⤵
- Executes dropped EXE
PID:468 -
\??\c:\htnhnn.exec:\htnhnn.exe44⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vjppj.exec:\vjppj.exe45⤵
- Executes dropped EXE
PID:2304 -
\??\c:\vppjd.exec:\vppjd.exe46⤵
- Executes dropped EXE
PID:3392 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe47⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nbtnnn.exec:\nbtnnn.exe48⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dvddv.exec:\dvddv.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pdddd.exec:\pdddd.exe50⤵
- Executes dropped EXE
PID:4920 -
\??\c:\ffxrllf.exec:\ffxrllf.exe51⤵
- Executes dropped EXE
PID:4444 -
\??\c:\7ntnnn.exec:\7ntnnn.exe52⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vvvvv.exec:\vvvvv.exe53⤵
- Executes dropped EXE
PID:3284 -
\??\c:\lxfxrrx.exec:\lxfxrrx.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe55⤵
- Executes dropped EXE
PID:3828 -
\??\c:\btbbbb.exec:\btbbbb.exe56⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3vvjd.exec:\3vvjd.exe57⤵
- Executes dropped EXE
PID:4880 -
\??\c:\9xffrrr.exec:\9xffrrr.exe58⤵
- Executes dropped EXE
PID:1676 -
\??\c:\lflfffx.exec:\lflfffx.exe59⤵
- Executes dropped EXE
PID:668 -
\??\c:\nthbhh.exec:\nthbhh.exe60⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lxffrrl.exec:\lxffrrl.exe61⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe62⤵
- Executes dropped EXE
PID:232 -
\??\c:\tntnbt.exec:\tntnbt.exe63⤵
- Executes dropped EXE
PID:3700 -
\??\c:\vppjd.exec:\vppjd.exe64⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lrxrlll.exec:\lrxrlll.exe65⤵
- Executes dropped EXE
PID:3348 -
\??\c:\fxxlrrr.exec:\fxxlrrr.exe66⤵PID:1228
-
\??\c:\bnttht.exec:\bnttht.exe67⤵PID:3624
-
\??\c:\jdvvd.exec:\jdvvd.exe68⤵PID:548
-
\??\c:\rflffff.exec:\rflffff.exe69⤵PID:5104
-
\??\c:\hbnhnh.exec:\hbnhnh.exe70⤵PID:2036
-
\??\c:\vppvv.exec:\vppvv.exe71⤵PID:4788
-
\??\c:\vddvp.exec:\vddvp.exe72⤵PID:4072
-
\??\c:\rrfflll.exec:\rrfflll.exe73⤵PID:1680
-
\??\c:\tttttb.exec:\tttttb.exe74⤵PID:2292
-
\??\c:\1ppjd.exec:\1ppjd.exe75⤵PID:2648
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe76⤵PID:1648
-
\??\c:\flrxxrr.exec:\flrxxrr.exe77⤵PID:932
-
\??\c:\btbbhb.exec:\btbbhb.exe78⤵PID:644
-
\??\c:\9jdvd.exec:\9jdvd.exe79⤵PID:2308
-
\??\c:\rfllfff.exec:\rfllfff.exe80⤵PID:4816
-
\??\c:\lfrrrrr.exec:\lfrrrrr.exe81⤵PID:2268
-
\??\c:\nnnnhh.exec:\nnnnhh.exe82⤵PID:4760
-
\??\c:\ppppj.exec:\ppppj.exe83⤵PID:1012
-
\??\c:\pdjdv.exec:\pdjdv.exe84⤵PID:1120
-
\??\c:\lllfxxr.exec:\lllfxxr.exe85⤵PID:980
-
\??\c:\nbtnhh.exec:\nbtnhh.exe86⤵PID:4420
-
\??\c:\5jvpj.exec:\5jvpj.exe87⤵PID:3004
-
\??\c:\xlrlrll.exec:\xlrlrll.exe88⤵PID:4464
-
\??\c:\5bhbhh.exec:\5bhbhh.exe89⤵PID:3076
-
\??\c:\hhttnn.exec:\hhttnn.exe90⤵PID:2064
-
\??\c:\jdpvv.exec:\jdpvv.exe91⤵PID:2608
-
\??\c:\rxlrlrl.exec:\rxlrlrl.exe92⤵PID:4224
-
\??\c:\tnhbbb.exec:\tnhbbb.exe93⤵PID:3168
-
\??\c:\nbhbtt.exec:\nbhbtt.exe94⤵PID:2708
-
\??\c:\vppjd.exec:\vppjd.exe95⤵PID:2012
-
\??\c:\xrrlfff.exec:\xrrlfff.exe96⤵PID:4936
-
\??\c:\flllffl.exec:\flllffl.exe97⤵PID:4828
-
\??\c:\tnbttt.exec:\tnbttt.exe98⤵PID:1880
-
\??\c:\1vvpj.exec:\1vvpj.exe99⤵PID:3632
-
\??\c:\xxlfrxr.exec:\xxlfrxr.exe100⤵PID:4100
-
\??\c:\rfxlrlr.exec:\rfxlrlr.exe101⤵PID:3872
-
\??\c:\bhnhtt.exec:\bhnhtt.exe102⤵PID:2132
-
\??\c:\5jjdv.exec:\5jjdv.exe103⤵PID:3200
-
\??\c:\vvdvp.exec:\vvdvp.exe104⤵PID:3640
-
\??\c:\tnnnhh.exec:\tnnnhh.exe105⤵PID:4144
-
\??\c:\nhhtnt.exec:\nhhtnt.exe106⤵PID:4080
-
\??\c:\pjjdv.exec:\pjjdv.exe107⤵PID:4576
-
\??\c:\lflffrl.exec:\lflffrl.exe108⤵PID:2900
-
\??\c:\5tthbh.exec:\5tthbh.exe109⤵PID:4728
-
\??\c:\1vpjj.exec:\1vpjj.exe110⤵PID:1744
-
\??\c:\vjpdv.exec:\vjpdv.exe111⤵PID:4780
-
\??\c:\rxffrrl.exec:\rxffrrl.exe112⤵PID:4620
-
\??\c:\tntnhh.exec:\tntnhh.exe113⤵PID:1452
-
\??\c:\jdjdd.exec:\jdjdd.exe114⤵PID:2764
-
\??\c:\jdvvd.exec:\jdvvd.exe115⤵PID:4920
-
\??\c:\rrffxrr.exec:\rrffxrr.exe116⤵PID:632
-
\??\c:\3nnbth.exec:\3nnbth.exe117⤵PID:4032
-
\??\c:\9vvvp.exec:\9vvvp.exe118⤵PID:4296
-
\??\c:\jpdvp.exec:\jpdvp.exe119⤵PID:4868
-
\??\c:\fxrrlff.exec:\fxrrlff.exe120⤵PID:3868
-
\??\c:\nhhhbb.exec:\nhhhbb.exe121⤵PID:1408
-
\??\c:\vjvpp.exec:\vjvpp.exe122⤵PID:2556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-