Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe
Resource
win7-20241010-en
General
-
Target
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe
-
Size
456KB
-
MD5
cdb1e57bdfa00fa8b9fc12c3c5331be1
-
SHA1
e31f2af6c65a1ae7640715749da46332f412374c
-
SHA256
a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b
-
SHA512
715fbb0bbcd12cca42fe8ab941c25d341d2d2cee7578e5545bedfc121411987838afce16d4e7d75beb4961df4f596ba6e2a937b271427415649c83a11ca604c9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRk:q7Tc2NYHUrAwfMp3CDRk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4716-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3560-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1612-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1408-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3836-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1348-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2852-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1872-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2560-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1844-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4132-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3820-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4812-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1304-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-707-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-759-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-941-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-994-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-1804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3560 9tthtn.exe 3600 flrfxrl.exe 4572 hnbnbn.exe 2632 1nbtnh.exe 4584 llrfrxl.exe 1356 pdjvd.exe 4332 frxllxx.exe 1612 5ppdv.exe 920 fxxlffx.exe 220 rffrfrl.exe 3188 lxrfxlf.exe 1408 1hbthh.exe 3980 lxrfrfx.exe 3440 bnnhtn.exe 3836 dpjvj.exe 4052 xllfrlf.exe 5096 7nhbnn.exe 4900 pdpdv.exe 1348 7hhthb.exe 2320 pjpdp.exe 1792 fllxllf.exe 4960 3tthtn.exe 1704 dpvjj.exe 3820 xllffxr.exe 4636 7nnhbt.exe 2592 vjjvj.exe 1360 7lxlxfr.exe 3132 bthtnh.exe 2916 bntttt.exe 2712 9rrfxrl.exe 876 ffrlxrl.exe 2676 bnhhbb.exe 2852 1hhnbt.exe 648 jjjdp.exe 4200 flrfrfr.exe 3116 3nnhtt.exe 4080 vjpdd.exe 1872 rlrlfxr.exe 3176 5hhthb.exe 2348 nhnhbb.exe 3028 rllfrll.exe 1312 xrxrrll.exe 4736 bbnhtn.exe 2560 vpppj.exe 4696 7xrlxxr.exe 732 7ffllfr.exe 4188 5tthbt.exe 1208 7ddvj.exe 4484 jjjvj.exe 3596 rxfxllf.exe 4160 3hbthh.exe 3196 vjpjd.exe 2168 frxlfxx.exe 1068 hthhnh.exe 1444 pjvpv.exe 2892 rxlxlxr.exe 4812 llfxrlf.exe 2040 5tnhbh.exe 5040 vppjp.exe 1844 7lrlfxr.exe 3144 hbhbhb.exe 4684 ddddd.exe 348 5fxrfxr.exe 3056 lxxrllx.exe -
resource yara_rule behavioral2/memory/4716-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3560-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1612-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1408-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3836-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1348-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2852-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1872-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2560-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1844-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4132-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3820-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4812-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1304-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-994-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4716 wrote to memory of 3560 4716 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 82 PID 4716 wrote to memory of 3560 4716 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 82 PID 4716 wrote to memory of 3560 4716 a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe 82 PID 3560 wrote to memory of 3600 3560 9tthtn.exe 83 PID 3560 wrote to memory of 3600 3560 9tthtn.exe 83 PID 3560 wrote to memory of 3600 3560 9tthtn.exe 83 PID 3600 wrote to memory of 4572 3600 flrfxrl.exe 84 PID 3600 wrote to memory of 4572 3600 flrfxrl.exe 84 PID 3600 wrote to memory of 4572 3600 flrfxrl.exe 84 PID 4572 wrote to memory of 2632 4572 hnbnbn.exe 85 PID 4572 wrote to memory of 2632 4572 hnbnbn.exe 85 PID 4572 wrote to memory of 2632 4572 hnbnbn.exe 85 PID 2632 wrote to memory of 4584 2632 1nbtnh.exe 86 PID 2632 wrote to memory of 4584 2632 1nbtnh.exe 86 PID 2632 wrote to memory of 4584 2632 1nbtnh.exe 86 PID 4584 wrote to memory of 1356 4584 llrfrxl.exe 87 PID 4584 wrote to memory of 1356 4584 llrfrxl.exe 87 PID 4584 wrote to memory of 1356 4584 llrfrxl.exe 87 PID 1356 wrote to memory of 4332 1356 pdjvd.exe 88 PID 1356 wrote to memory of 4332 1356 pdjvd.exe 88 PID 1356 wrote to memory of 4332 1356 pdjvd.exe 88 PID 4332 wrote to memory of 1612 4332 frxllxx.exe 89 PID 4332 wrote to memory of 1612 4332 frxllxx.exe 89 PID 4332 wrote to memory of 1612 4332 frxllxx.exe 89 PID 1612 wrote to memory of 920 1612 5ppdv.exe 90 PID 1612 wrote to memory of 920 1612 5ppdv.exe 90 PID 1612 wrote to memory of 920 1612 5ppdv.exe 90 PID 920 wrote to memory of 220 920 fxxlffx.exe 91 PID 920 wrote to memory of 220 920 fxxlffx.exe 91 PID 920 wrote to memory of 220 920 fxxlffx.exe 91 PID 220 wrote to memory of 3188 220 rffrfrl.exe 92 PID 220 wrote to memory of 3188 220 rffrfrl.exe 92 PID 220 wrote to memory of 3188 220 rffrfrl.exe 92 PID 3188 wrote to memory of 1408 3188 lxrfxlf.exe 93 PID 3188 wrote to memory of 1408 3188 lxrfxlf.exe 93 PID 3188 wrote to memory of 1408 3188 lxrfxlf.exe 93 PID 1408 wrote to memory of 3980 1408 1hbthh.exe 94 PID 1408 wrote to memory of 3980 1408 1hbthh.exe 94 PID 1408 wrote to memory of 3980 1408 1hbthh.exe 94 PID 3980 wrote to memory of 3440 3980 lxrfrfx.exe 95 PID 3980 wrote to memory of 3440 3980 lxrfrfx.exe 95 PID 3980 wrote to memory of 3440 3980 lxrfrfx.exe 95 PID 3440 wrote to memory of 3836 3440 bnnhtn.exe 96 PID 3440 wrote to memory of 3836 3440 bnnhtn.exe 96 PID 3440 wrote to memory of 3836 3440 bnnhtn.exe 96 PID 3836 wrote to memory of 4052 3836 dpjvj.exe 97 PID 3836 wrote to memory of 4052 3836 dpjvj.exe 97 PID 3836 wrote to memory of 4052 3836 dpjvj.exe 97 PID 4052 wrote to memory of 5096 4052 xllfrlf.exe 98 PID 4052 wrote to memory of 5096 4052 xllfrlf.exe 98 PID 4052 wrote to memory of 5096 4052 xllfrlf.exe 98 PID 5096 wrote to memory of 4900 5096 7nhbnn.exe 99 PID 5096 wrote to memory of 4900 5096 7nhbnn.exe 99 PID 5096 wrote to memory of 4900 5096 7nhbnn.exe 99 PID 4900 wrote to memory of 1348 4900 pdpdv.exe 100 PID 4900 wrote to memory of 1348 4900 pdpdv.exe 100 PID 4900 wrote to memory of 1348 4900 pdpdv.exe 100 PID 1348 wrote to memory of 2320 1348 7hhthb.exe 101 PID 1348 wrote to memory of 2320 1348 7hhthb.exe 101 PID 1348 wrote to memory of 2320 1348 7hhthb.exe 101 PID 2320 wrote to memory of 1792 2320 pjpdp.exe 102 PID 2320 wrote to memory of 1792 2320 pjpdp.exe 102 PID 2320 wrote to memory of 1792 2320 pjpdp.exe 102 PID 1792 wrote to memory of 4960 1792 fllxllf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe"C:\Users\Admin\AppData\Local\Temp\a1e3115b51159f4d0d67bfa92d8365d7730daeb7ca58476800f77df021770e4b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\9tthtn.exec:\9tthtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\flrfxrl.exec:\flrfxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hnbnbn.exec:\hnbnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\1nbtnh.exec:\1nbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\llrfrxl.exec:\llrfrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\pdjvd.exec:\pdjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\frxllxx.exec:\frxllxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\5ppdv.exec:\5ppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\fxxlffx.exec:\fxxlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\rffrfrl.exec:\rffrfrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\lxrfxlf.exec:\lxrfxlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\1hbthh.exec:\1hbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\lxrfrfx.exec:\lxrfrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\bnnhtn.exec:\bnnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\dpjvj.exec:\dpjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\xllfrlf.exec:\xllfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\7nhbnn.exec:\7nhbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\pdpdv.exec:\pdpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\7hhthb.exec:\7hhthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\pjpdp.exec:\pjpdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\fllxllf.exec:\fllxllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\3tthtn.exec:\3tthtn.exe23⤵
- Executes dropped EXE
PID:4960 -
\??\c:\dpvjj.exec:\dpvjj.exe24⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xllffxr.exec:\xllffxr.exe25⤵
- Executes dropped EXE
PID:3820 -
\??\c:\7nnhbt.exec:\7nnhbt.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vjjvj.exec:\vjjvj.exe27⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7lxlxfr.exec:\7lxlxfr.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bthtnh.exec:\bthtnh.exe29⤵
- Executes dropped EXE
PID:3132 -
\??\c:\bntttt.exec:\bntttt.exe30⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9rrfxrl.exec:\9rrfxrl.exe31⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\bnhhbb.exec:\bnhhbb.exe33⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1hhnbt.exec:\1hhnbt.exe34⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjjdp.exec:\jjjdp.exe35⤵
- Executes dropped EXE
PID:648 -
\??\c:\flrfrfr.exec:\flrfrfr.exe36⤵
- Executes dropped EXE
PID:4200 -
\??\c:\3nnhtt.exec:\3nnhtt.exe37⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vjpdd.exec:\vjpdd.exe38⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1872 -
\??\c:\5hhthb.exec:\5hhthb.exe40⤵
- Executes dropped EXE
PID:3176 -
\??\c:\nhnhbb.exec:\nhnhbb.exe41⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rllfrll.exec:\rllfrll.exe42⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xrxrrll.exec:\xrxrrll.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bbnhtn.exec:\bbnhtn.exe44⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vpppj.exec:\vpppj.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\7xrlxxr.exec:\7xrlxxr.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\7ffllfr.exec:\7ffllfr.exe47⤵
- Executes dropped EXE
PID:732 -
\??\c:\5tthbt.exec:\5tthbt.exe48⤵
- Executes dropped EXE
PID:4188 -
\??\c:\7ddvj.exec:\7ddvj.exe49⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jjjvj.exec:\jjjvj.exe50⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rxfxllf.exec:\rxfxllf.exe51⤵
- Executes dropped EXE
PID:3596 -
\??\c:\3hbthh.exec:\3hbthh.exe52⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vjpjd.exec:\vjpjd.exe53⤵
- Executes dropped EXE
PID:3196 -
\??\c:\frxlfxx.exec:\frxlfxx.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hthhnh.exec:\hthhnh.exe55⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pjvpv.exec:\pjvpv.exe56⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rxlxlxr.exec:\rxlxlxr.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\llfxrlf.exec:\llfxrlf.exe58⤵
- Executes dropped EXE
PID:4812 -
\??\c:\5tnhbh.exec:\5tnhbh.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vppjp.exec:\vppjp.exe60⤵
- Executes dropped EXE
PID:5040 -
\??\c:\7lrlfxr.exec:\7lrlfxr.exe61⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbhbhb.exec:\hbhbhb.exe62⤵
- Executes dropped EXE
PID:3144 -
\??\c:\ddddd.exec:\ddddd.exe63⤵
- Executes dropped EXE
PID:4684 -
\??\c:\5fxrfxr.exec:\5fxrfxr.exe64⤵
- Executes dropped EXE
PID:348 -
\??\c:\lxxrllx.exec:\lxxrllx.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5ttntt.exec:\5ttntt.exe66⤵PID:3000
-
\??\c:\9ddpv.exec:\9ddpv.exe67⤵PID:2192
-
\??\c:\llrfrlx.exec:\llrfrlx.exe68⤵PID:2912
-
\??\c:\5nnnnn.exec:\5nnnnn.exe69⤵
- System Location Discovery: System Language Discovery
PID:4132 -
\??\c:\jvdvj.exec:\jvdvj.exe70⤵PID:212
-
\??\c:\1ddvp.exec:\1ddvp.exe71⤵PID:4924
-
\??\c:\llfrlfx.exec:\llfrlfx.exe72⤵PID:4056
-
\??\c:\nhnhtt.exec:\nhnhtt.exe73⤵PID:5064
-
\??\c:\lffrfxx.exec:\lffrfxx.exe74⤵PID:2936
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe75⤵PID:2744
-
\??\c:\bbbnbt.exec:\bbbnbt.exe76⤵PID:964
-
\??\c:\dvpjv.exec:\dvpjv.exe77⤵PID:4052
-
\??\c:\5rlfrxr.exec:\5rlfrxr.exe78⤵PID:2248
-
\??\c:\tnthhb.exec:\tnthhb.exe79⤵PID:2664
-
\??\c:\bbbnbb.exec:\bbbnbb.exe80⤵PID:5084
-
\??\c:\5vpdp.exec:\5vpdp.exe81⤵PID:3728
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe82⤵PID:4908
-
\??\c:\nttnbb.exec:\nttnbb.exe83⤵PID:4752
-
\??\c:\ppdpd.exec:\ppdpd.exe84⤵PID:632
-
\??\c:\5xxlxrl.exec:\5xxlxrl.exe85⤵PID:644
-
\??\c:\btbttt.exec:\btbttt.exe86⤵PID:2212
-
\??\c:\1vpdp.exec:\1vpdp.exe87⤵PID:3820
-
\??\c:\pjjvj.exec:\pjjvj.exe88⤵PID:1516
-
\??\c:\llrfxrf.exec:\llrfxrf.exe89⤵PID:3696
-
\??\c:\bbtbtb.exec:\bbtbtb.exe90⤵PID:1320
-
\??\c:\3tnhhh.exec:\3tnhhh.exe91⤵PID:3668
-
\??\c:\5vjvv.exec:\5vjvv.exe92⤵PID:5116
-
\??\c:\lxfrfxl.exec:\lxfrfxl.exe93⤵PID:2916
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe94⤵PID:1036
-
\??\c:\ntnbnh.exec:\ntnbnh.exe95⤵PID:1760
-
\??\c:\bbhthb.exec:\bbhthb.exe96⤵PID:3212
-
\??\c:\ddjdd.exec:\ddjdd.exe97⤵PID:2720
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe98⤵PID:4856
-
\??\c:\bttnhb.exec:\bttnhb.exe99⤵
- System Location Discovery: System Language Discovery
PID:4968 -
\??\c:\dvvpd.exec:\dvvpd.exe100⤵PID:2852
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe101⤵PID:1292
-
\??\c:\9rrllll.exec:\9rrllll.exe102⤵PID:4200
-
\??\c:\1bbtnn.exec:\1bbtnn.exe103⤵PID:3116
-
\??\c:\pdjvp.exec:\pdjvp.exe104⤵PID:4864
-
\??\c:\xxxlxlr.exec:\xxxlxlr.exe105⤵PID:4356
-
\??\c:\fxxrffx.exec:\fxxrffx.exe106⤵PID:2216
-
\??\c:\9vvpp.exec:\9vvpp.exe107⤵PID:3552
-
\??\c:\lflxlxl.exec:\lflxlxl.exe108⤵PID:4140
-
\??\c:\1xxrfxl.exec:\1xxrfxl.exe109⤵PID:976
-
\??\c:\thtbtn.exec:\thtbtn.exe110⤵PID:3932
-
\??\c:\9ddpj.exec:\9ddpj.exe111⤵PID:4736
-
\??\c:\llfxllf.exec:\llfxllf.exe112⤵PID:3516
-
\??\c:\5flflrl.exec:\5flflrl.exe113⤵PID:4696
-
\??\c:\hhnhbt.exec:\hhnhbt.exe114⤵PID:628
-
\??\c:\jdvpd.exec:\jdvpd.exe115⤵PID:4428
-
\??\c:\xflrlxl.exec:\xflrlxl.exe116⤵PID:4440
-
\??\c:\rrxlxrf.exec:\rrxlxrf.exe117⤵PID:4444
-
\??\c:\hnnhtn.exec:\hnnhtn.exe118⤵PID:4616
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:4596
-
\??\c:\lxxlxrl.exec:\lxxlxrl.exe120⤵PID:1052
-
\??\c:\thnhtn.exec:\thnhtn.exe121⤵PID:1144
-
\??\c:\hntnbn.exec:\hntnbn.exe122⤵PID:1296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-