Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 06:57
Static task
static1
Behavioral task
behavioral1
Sample
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe
Resource
win7-20241010-en
General
-
Target
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe
-
Size
453KB
-
MD5
10f95a9f43eed76f708d4d64d0d60c1a
-
SHA1
848bcaf4e6f0c4c831b3ef4d59e3b9797fc9adc0
-
SHA256
9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d
-
SHA512
5519c53a29f9d83bdf06ce3f8d47229cf57dea9b30c7d70d6d01ef48ce0d452b084e3137291d490d9d1194af76ab7f2e2ac78e5ec0fedfa27e7ebad88a772552
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1644-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1788-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4232-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3968-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2408-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1932-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1404-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2228-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4716-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3796-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1740-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-831-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-893-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2908-912-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-1702-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 9vpvj.exe 532 lrlfxrf.exe 2236 ntnbht.exe 4992 flfrrll.exe 1788 rxxxrrr.exe 1552 nbtnbt.exe 4824 fllfrfx.exe 4232 5ttnbb.exe 4456 jvpvd.exe 1580 1nbnbt.exe 928 rfffrrl.exe 940 vdpjd.exe 3968 flrlxxr.exe 2408 ppvpv.exe 1932 ddjdp.exe 3752 tthhth.exe 4688 jpppj.exe 4348 xlfrlfr.exe 1960 dvvvp.exe 4692 nnntnt.exe 4576 7pjdd.exe 3988 xlrlffx.exe 3628 tnnnhh.exe 4924 jddjv.exe 648 xfxlfrf.exe 1596 5nhbnb.exe 3280 bbtthb.exe 2928 7vpjv.exe 3856 3rrfxfr.exe 2336 nbttht.exe 2724 vdpdj.exe 1664 hnnnbb.exe 2856 tnnbth.exe 4284 dpjpp.exe 2876 fffrxrf.exe 3632 rxfxlxl.exe 2536 1hthtn.exe 4868 lrrfrlx.exe 1404 htnhtn.exe 2228 jjjvd.exe 1460 rffrfxl.exe 2612 9xxllfx.exe 4552 nhnbnh.exe 224 1ffrfrf.exe 4732 dppjv.exe 2912 xfxlxrx.exe 532 5tnbbn.exe 4564 pddpd.exe 2264 pjpdp.exe 4588 xfxlrfr.exe 1132 nbnhth.exe 1692 5dpdv.exe 4760 fxrrxll.exe 4548 9hhtnh.exe 1256 nbthtn.exe 4456 pvvdp.exe 3940 5ddpd.exe 5092 xxffrlf.exe 3532 ntbnbt.exe 2688 9jpvv.exe 1780 7fxlxrf.exe 4860 nbthth.exe 1584 thnhth.exe 4716 jppvj.exe -
resource yara_rule behavioral2/memory/1644-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1788-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4824-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4232-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3968-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2408-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1932-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1960-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2228-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4716-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1404-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3796-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1740-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-831-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1644 wrote to memory of 2696 1644 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 83 PID 1644 wrote to memory of 2696 1644 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 83 PID 1644 wrote to memory of 2696 1644 9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe 83 PID 2696 wrote to memory of 532 2696 9vpvj.exe 84 PID 2696 wrote to memory of 532 2696 9vpvj.exe 84 PID 2696 wrote to memory of 532 2696 9vpvj.exe 84 PID 532 wrote to memory of 2236 532 lrlfxrf.exe 85 PID 532 wrote to memory of 2236 532 lrlfxrf.exe 85 PID 532 wrote to memory of 2236 532 lrlfxrf.exe 85 PID 2236 wrote to memory of 4992 2236 ntnbht.exe 86 PID 2236 wrote to memory of 4992 2236 ntnbht.exe 86 PID 2236 wrote to memory of 4992 2236 ntnbht.exe 86 PID 4992 wrote to memory of 1788 4992 flfrrll.exe 87 PID 4992 wrote to memory of 1788 4992 flfrrll.exe 87 PID 4992 wrote to memory of 1788 4992 flfrrll.exe 87 PID 1788 wrote to memory of 1552 1788 rxxxrrr.exe 88 PID 1788 wrote to memory of 1552 1788 rxxxrrr.exe 88 PID 1788 wrote to memory of 1552 1788 rxxxrrr.exe 88 PID 1552 wrote to memory of 4824 1552 nbtnbt.exe 89 PID 1552 wrote to memory of 4824 1552 nbtnbt.exe 89 PID 1552 wrote to memory of 4824 1552 nbtnbt.exe 89 PID 4824 wrote to memory of 4232 4824 fllfrfx.exe 90 PID 4824 wrote to memory of 4232 4824 fllfrfx.exe 90 PID 4824 wrote to memory of 4232 4824 fllfrfx.exe 90 PID 4232 wrote to memory of 4456 4232 5ttnbb.exe 91 PID 4232 wrote to memory of 4456 4232 5ttnbb.exe 91 PID 4232 wrote to memory of 4456 4232 5ttnbb.exe 91 PID 4456 wrote to memory of 1580 4456 jvpvd.exe 92 PID 4456 wrote to memory of 1580 4456 jvpvd.exe 92 PID 4456 wrote to memory of 1580 4456 jvpvd.exe 92 PID 1580 wrote to memory of 928 1580 1nbnbt.exe 93 PID 1580 wrote to memory of 928 1580 1nbnbt.exe 93 PID 1580 wrote to memory of 928 1580 1nbnbt.exe 93 PID 928 wrote to memory of 940 928 rfffrrl.exe 94 PID 928 wrote to memory of 940 928 rfffrrl.exe 94 PID 928 wrote to memory of 940 928 rfffrrl.exe 94 PID 940 wrote to memory of 3968 940 vdpjd.exe 95 PID 940 wrote to memory of 3968 940 vdpjd.exe 95 PID 940 wrote to memory of 3968 940 vdpjd.exe 95 PID 3968 wrote to memory of 2408 3968 flrlxxr.exe 96 PID 3968 wrote to memory of 2408 3968 flrlxxr.exe 96 PID 3968 wrote to memory of 2408 3968 flrlxxr.exe 96 PID 2408 wrote to memory of 1932 2408 ppvpv.exe 97 PID 2408 wrote to memory of 1932 2408 ppvpv.exe 97 PID 2408 wrote to memory of 1932 2408 ppvpv.exe 97 PID 1932 wrote to memory of 3752 1932 ddjdp.exe 98 PID 1932 wrote to memory of 3752 1932 ddjdp.exe 98 PID 1932 wrote to memory of 3752 1932 ddjdp.exe 98 PID 3752 wrote to memory of 4688 3752 tthhth.exe 99 PID 3752 wrote to memory of 4688 3752 tthhth.exe 99 PID 3752 wrote to memory of 4688 3752 tthhth.exe 99 PID 4688 wrote to memory of 4348 4688 jpppj.exe 100 PID 4688 wrote to memory of 4348 4688 jpppj.exe 100 PID 4688 wrote to memory of 4348 4688 jpppj.exe 100 PID 4348 wrote to memory of 1960 4348 xlfrlfr.exe 101 PID 4348 wrote to memory of 1960 4348 xlfrlfr.exe 101 PID 4348 wrote to memory of 1960 4348 xlfrlfr.exe 101 PID 1960 wrote to memory of 4692 1960 dvvvp.exe 102 PID 1960 wrote to memory of 4692 1960 dvvvp.exe 102 PID 1960 wrote to memory of 4692 1960 dvvvp.exe 102 PID 4692 wrote to memory of 4576 4692 nnntnt.exe 103 PID 4692 wrote to memory of 4576 4692 nnntnt.exe 103 PID 4692 wrote to memory of 4576 4692 nnntnt.exe 103 PID 4576 wrote to memory of 3988 4576 7pjdd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe"C:\Users\Admin\AppData\Local\Temp\9e9ecdfa61274a25ae56e40793842b137771f10041115a202e37c691d603312d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\9vpvj.exec:\9vpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lrlfxrf.exec:\lrlfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\ntnbht.exec:\ntnbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\flfrrll.exec:\flfrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\nbtnbt.exec:\nbtnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\fllfrfx.exec:\fllfrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\5ttnbb.exec:\5ttnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\jvpvd.exec:\jvpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\1nbnbt.exec:\1nbnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\rfffrrl.exec:\rfffrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\vdpjd.exec:\vdpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\flrlxxr.exec:\flrlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\ppvpv.exec:\ppvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\ddjdp.exec:\ddjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tthhth.exec:\tthhth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\jpppj.exec:\jpppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\xlfrlfr.exec:\xlfrlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\dvvvp.exec:\dvvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\nnntnt.exec:\nnntnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\7pjdd.exec:\7pjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\xlrlffx.exec:\xlrlffx.exe23⤵
- Executes dropped EXE
PID:3988 -
\??\c:\tnnnhh.exec:\tnnnhh.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jddjv.exec:\jddjv.exe25⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\5nhbnb.exec:\5nhbnb.exe27⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bbtthb.exec:\bbtthb.exe28⤵
- Executes dropped EXE
PID:3280 -
\??\c:\7vpjv.exec:\7vpjv.exe29⤵
- Executes dropped EXE
PID:2928 -
\??\c:\3rrfxfr.exec:\3rrfxfr.exe30⤵
- Executes dropped EXE
PID:3856 -
\??\c:\nbttht.exec:\nbttht.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vdpdj.exec:\vdpdj.exe32⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hnnnbb.exec:\hnnnbb.exe33⤵
- Executes dropped EXE
PID:1664 -
\??\c:\tnnbth.exec:\tnnbth.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dpjpp.exec:\dpjpp.exe35⤵
- Executes dropped EXE
PID:4284 -
\??\c:\fffrxrf.exec:\fffrxrf.exe36⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rxfxlxl.exec:\rxfxlxl.exe37⤵
- Executes dropped EXE
PID:3632 -
\??\c:\1hthtn.exec:\1hthtn.exe38⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lrrfrlx.exec:\lrrfrlx.exe39⤵
- Executes dropped EXE
PID:4868 -
\??\c:\htnhtn.exec:\htnhtn.exe40⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jjjvd.exec:\jjjvd.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rffrfxl.exec:\rffrfxl.exe42⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9xxllfx.exec:\9xxllfx.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nhnbnh.exec:\nhnbnh.exe44⤵
- Executes dropped EXE
PID:4552 -
\??\c:\1ffrfrf.exec:\1ffrfrf.exe45⤵
- Executes dropped EXE
PID:224 -
\??\c:\dppjv.exec:\dppjv.exe46⤵
- Executes dropped EXE
PID:4732 -
\??\c:\xfxlxrx.exec:\xfxlxrx.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5tnbbn.exec:\5tnbbn.exe48⤵
- Executes dropped EXE
PID:532 -
\??\c:\pddpd.exec:\pddpd.exe49⤵
- Executes dropped EXE
PID:4564 -
\??\c:\pjpdp.exec:\pjpdp.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xfxlrfr.exec:\xfxlrfr.exe51⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nbnhth.exec:\nbnhth.exe52⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5dpdv.exec:\5dpdv.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\fxrrxll.exec:\fxrrxll.exe54⤵
- Executes dropped EXE
PID:4760 -
\??\c:\9hhtnh.exec:\9hhtnh.exe55⤵
- Executes dropped EXE
PID:4548 -
\??\c:\nbthtn.exec:\nbthtn.exe56⤵
- Executes dropped EXE
PID:1256 -
\??\c:\pvvdp.exec:\pvvdp.exe57⤵
- Executes dropped EXE
PID:4456 -
\??\c:\5ddpd.exec:\5ddpd.exe58⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xxffrlf.exec:\xxffrlf.exe59⤵
- Executes dropped EXE
PID:5092 -
\??\c:\ntbnbt.exec:\ntbnbt.exe60⤵
- Executes dropped EXE
PID:3532 -
\??\c:\9jpvv.exec:\9jpvv.exe61⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7fxlxrf.exec:\7fxlxrf.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nbthth.exec:\nbthth.exe63⤵
- Executes dropped EXE
PID:4860 -
\??\c:\thnhth.exec:\thnhth.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jppvj.exec:\jppvj.exe65⤵
- Executes dropped EXE
PID:4716 -
\??\c:\frlxlxl.exec:\frlxlxl.exe66⤵PID:436
-
\??\c:\lffrfxl.exec:\lffrfxl.exe67⤵PID:2340
-
\??\c:\ttnbth.exec:\ttnbth.exe68⤵PID:2800
-
\??\c:\1vjvj.exec:\1vjvj.exe69⤵PID:960
-
\??\c:\xffxfxx.exec:\xffxfxx.exe70⤵PID:4608
-
\??\c:\bnhbtn.exec:\bnhbtn.exe71⤵PID:1960
-
\??\c:\nbbtbt.exec:\nbbtbt.exe72⤵PID:4684
-
\??\c:\pvvjp.exec:\pvvjp.exe73⤵PID:1824
-
\??\c:\fxrxxll.exec:\fxrxxll.exe74⤵PID:5012
-
\??\c:\bthbnh.exec:\bthbnh.exe75⤵PID:2432
-
\??\c:\tntbhb.exec:\tntbhb.exe76⤵PID:1548
-
\??\c:\pvvdp.exec:\pvvdp.exe77⤵PID:4072
-
\??\c:\7xxllfr.exec:\7xxllfr.exe78⤵PID:1628
-
\??\c:\bhhthb.exec:\bhhthb.exe79⤵PID:648
-
\??\c:\jpvjv.exec:\jpvjv.exe80⤵PID:1596
-
\??\c:\flrxfxl.exec:\flrxfxl.exe81⤵PID:2120
-
\??\c:\5lfrfrf.exec:\5lfrfrf.exe82⤵PID:4756
-
\??\c:\5bthtn.exec:\5bthtn.exe83⤵PID:4416
-
\??\c:\dpvjv.exec:\dpvjv.exe84⤵PID:4476
-
\??\c:\rfxxlrf.exec:\rfxxlrf.exe85⤵PID:4344
-
\??\c:\3bthth.exec:\3bthth.exe86⤵PID:1924
-
\??\c:\ntnbnh.exec:\ntnbnh.exe87⤵PID:2724
-
\??\c:\vvdjp.exec:\vvdjp.exe88⤵PID:2496
-
\??\c:\3jdpd.exec:\3jdpd.exe89⤵PID:4932
-
\??\c:\rxlfrxl.exec:\rxlfrxl.exe90⤵PID:1252
-
\??\c:\ttbhth.exec:\ttbhth.exe91⤵PID:4648
-
\??\c:\1pjvd.exec:\1pjvd.exe92⤵PID:2500
-
\??\c:\xxfrrff.exec:\xxfrrff.exe93⤵PID:3052
-
\??\c:\rxrlxlx.exec:\rxrlxlx.exe94⤵PID:2536
-
\??\c:\bnhthb.exec:\bnhthb.exe95⤵PID:460
-
\??\c:\1vpdp.exec:\1vpdp.exe96⤵PID:4288
-
\??\c:\lfrfxlf.exec:\lfrfxlf.exe97⤵
- System Location Discovery: System Language Discovery
PID:4204 -
\??\c:\lrlxfrf.exec:\lrlxfrf.exe98⤵PID:4340
-
\??\c:\1hbnbb.exec:\1hbnbb.exe99⤵PID:4392
-
\??\c:\bbbnbb.exec:\bbbnbb.exe100⤵PID:364
-
\??\c:\pdvjp.exec:\pdvjp.exe101⤵PID:2976
-
\??\c:\rrrflfr.exec:\rrrflfr.exe102⤵PID:2696
-
\??\c:\htnhth.exec:\htnhth.exe103⤵PID:2320
-
\??\c:\vjdpj.exec:\vjdpj.exe104⤵PID:2912
-
\??\c:\3djdp.exec:\3djdp.exe105⤵PID:3436
-
\??\c:\xxllffl.exec:\xxllffl.exe106⤵PID:1176
-
\??\c:\9bthhb.exec:\9bthhb.exe107⤵PID:1124
-
\??\c:\jppjv.exec:\jppjv.exe108⤵PID:4316
-
\??\c:\pdpjv.exec:\pdpjv.exe109⤵PID:2708
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe110⤵PID:2636
-
\??\c:\5bnhhb.exec:\5bnhhb.exe111⤵PID:4664
-
\??\c:\5dpjp.exec:\5dpjp.exe112⤵PID:2112
-
\??\c:\lfllxrr.exec:\lfllxrr.exe113⤵PID:4880
-
\??\c:\nbthtt.exec:\nbthtt.exe114⤵PID:1464
-
\??\c:\hbbhtt.exec:\hbbhtt.exe115⤵PID:4600
-
\??\c:\5vpjv.exec:\5vpjv.exe116⤵PID:1012
-
\??\c:\fxxrlll.exec:\fxxrlll.exe117⤵PID:1880
-
\??\c:\rxlfxxf.exec:\rxlfxxf.exe118⤵PID:1272
-
\??\c:\bbhthb.exec:\bbhthb.exe119⤵PID:2648
-
\??\c:\xflfrrl.exec:\xflfrrl.exe120⤵PID:220
-
\??\c:\hhnbbb.exec:\hhnbbb.exe121⤵PID:4860
-
\??\c:\hbhbbt.exec:\hbhbbt.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-