Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 07:06
Static task
static1
Behavioral task
behavioral1
Sample
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe
Resource
win7-20240903-en
General
-
Target
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe
-
Size
454KB
-
MD5
869e18d4e4bfaff7bf890f739191ffa0
-
SHA1
94a9de2ba4ffd9d5a7bf596e9ee714cbb7e65b31
-
SHA256
61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5
-
SHA512
2660b96410abd94b20a6dd156be3c945f140796f0bb99a68b19287cf9f138927b0cc2ebc732a1fa1419b07591ad2be7cb7bbe084220c64efcaf9b3ba394c5b38
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/32-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3392-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5092-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/312-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3572-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/940-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1360-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1296-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4788-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4748-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3652-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3404-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/32-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-678-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/832-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-844-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-964-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-1007-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1192-1206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-1237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3572 3hhbhn.exe 1000 vjjjd.exe 4380 dpvpj.exe 3392 rrrrlll.exe 3168 ddppp.exe 4376 btbttt.exe 1476 vjjdd.exe 1116 xlrrrrl.exe 4744 bttnbt.exe 4416 htbhbt.exe 4100 btttnn.exe 4928 1bbttb.exe 2952 vpjdd.exe 2748 ddddd.exe 4732 nhbtnh.exe 2184 vdjvp.exe 4572 vjjjd.exe 2160 xrfrfxf.exe 4980 5bnhbh.exe 836 rfllffx.exe 4488 frrrlfx.exe 4404 1dpjj.exe 3576 xrlffxx.exe 1932 jpjvd.exe 5088 nnbttt.exe 1412 3bttnt.exe 4632 rllllff.exe 1784 nntnnn.exe 3264 dvjdv.exe 432 frxrllx.exe 5092 nnbtnh.exe 3996 nhnhtt.exe 4168 7flfxfx.exe 2008 tttnnh.exe 2608 hhhbbb.exe 4788 dpjjj.exe 4300 llxrxxf.exe 312 3tbtbh.exe 4556 nbhbnn.exe 2584 1vvpd.exe 4496 lllfxrl.exe 4708 hbhbtt.exe 2848 jddjd.exe 2788 lffxffx.exe 1924 9llxrrf.exe 2868 9btbtt.exe 5012 9pjpj.exe 372 rxfrffx.exe 3444 hbnhnn.exe 3540 bhnnbn.exe 4296 dvjdd.exe 4192 xrxfrrl.exe 2572 bttnnn.exe 3572 7nhbtt.exe 2352 7djvd.exe 3080 9flfxfr.exe 3060 bnbbtn.exe 3696 vppjj.exe 3776 1lrllll.exe 4108 xxxxrlf.exe 3744 tnbtbt.exe 1160 jpvvp.exe 1092 vppvp.exe 2036 xlrlflf.exe -
resource yara_rule behavioral2/memory/32-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5092-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/312-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3572-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/940-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2736-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1360-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1296-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4788-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4748-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3652-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3404-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/32-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/832-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-912-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 32 wrote to memory of 3572 32 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 82 PID 32 wrote to memory of 3572 32 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 82 PID 32 wrote to memory of 3572 32 61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe 82 PID 3572 wrote to memory of 1000 3572 3hhbhn.exe 83 PID 3572 wrote to memory of 1000 3572 3hhbhn.exe 83 PID 3572 wrote to memory of 1000 3572 3hhbhn.exe 83 PID 1000 wrote to memory of 4380 1000 vjjjd.exe 84 PID 1000 wrote to memory of 4380 1000 vjjjd.exe 84 PID 1000 wrote to memory of 4380 1000 vjjjd.exe 84 PID 4380 wrote to memory of 3392 4380 dpvpj.exe 85 PID 4380 wrote to memory of 3392 4380 dpvpj.exe 85 PID 4380 wrote to memory of 3392 4380 dpvpj.exe 85 PID 3392 wrote to memory of 3168 3392 rrrrlll.exe 86 PID 3392 wrote to memory of 3168 3392 rrrrlll.exe 86 PID 3392 wrote to memory of 3168 3392 rrrrlll.exe 86 PID 3168 wrote to memory of 4376 3168 ddppp.exe 87 PID 3168 wrote to memory of 4376 3168 ddppp.exe 87 PID 3168 wrote to memory of 4376 3168 ddppp.exe 87 PID 4376 wrote to memory of 1476 4376 btbttt.exe 88 PID 4376 wrote to memory of 1476 4376 btbttt.exe 88 PID 4376 wrote to memory of 1476 4376 btbttt.exe 88 PID 1476 wrote to memory of 1116 1476 vjjdd.exe 89 PID 1476 wrote to memory of 1116 1476 vjjdd.exe 89 PID 1476 wrote to memory of 1116 1476 vjjdd.exe 89 PID 1116 wrote to memory of 4744 1116 xlrrrrl.exe 90 PID 1116 wrote to memory of 4744 1116 xlrrrrl.exe 90 PID 1116 wrote to memory of 4744 1116 xlrrrrl.exe 90 PID 4744 wrote to memory of 4416 4744 bttnbt.exe 91 PID 4744 wrote to memory of 4416 4744 bttnbt.exe 91 PID 4744 wrote to memory of 4416 4744 bttnbt.exe 91 PID 4416 wrote to memory of 4100 4416 htbhbt.exe 92 PID 4416 wrote to memory of 4100 4416 htbhbt.exe 92 PID 4416 wrote to memory of 4100 4416 htbhbt.exe 92 PID 4100 wrote to memory of 4928 4100 btttnn.exe 93 PID 4100 wrote to memory of 4928 4100 btttnn.exe 93 PID 4100 wrote to memory of 4928 4100 btttnn.exe 93 PID 4928 wrote to memory of 2952 4928 1bbttb.exe 94 PID 4928 wrote to memory of 2952 4928 1bbttb.exe 94 PID 4928 wrote to memory of 2952 4928 1bbttb.exe 94 PID 2952 wrote to memory of 2748 2952 vpjdd.exe 95 PID 2952 wrote to memory of 2748 2952 vpjdd.exe 95 PID 2952 wrote to memory of 2748 2952 vpjdd.exe 95 PID 2748 wrote to memory of 4732 2748 ddddd.exe 96 PID 2748 wrote to memory of 4732 2748 ddddd.exe 96 PID 2748 wrote to memory of 4732 2748 ddddd.exe 96 PID 4732 wrote to memory of 2184 4732 nhbtnh.exe 97 PID 4732 wrote to memory of 2184 4732 nhbtnh.exe 97 PID 4732 wrote to memory of 2184 4732 nhbtnh.exe 97 PID 2184 wrote to memory of 4572 2184 vdjvp.exe 98 PID 2184 wrote to memory of 4572 2184 vdjvp.exe 98 PID 2184 wrote to memory of 4572 2184 vdjvp.exe 98 PID 4572 wrote to memory of 2160 4572 vjjjd.exe 99 PID 4572 wrote to memory of 2160 4572 vjjjd.exe 99 PID 4572 wrote to memory of 2160 4572 vjjjd.exe 99 PID 2160 wrote to memory of 4980 2160 xrfrfxf.exe 100 PID 2160 wrote to memory of 4980 2160 xrfrfxf.exe 100 PID 2160 wrote to memory of 4980 2160 xrfrfxf.exe 100 PID 4980 wrote to memory of 836 4980 5bnhbh.exe 101 PID 4980 wrote to memory of 836 4980 5bnhbh.exe 101 PID 4980 wrote to memory of 836 4980 5bnhbh.exe 101 PID 836 wrote to memory of 4488 836 rfllffx.exe 102 PID 836 wrote to memory of 4488 836 rfllffx.exe 102 PID 836 wrote to memory of 4488 836 rfllffx.exe 102 PID 4488 wrote to memory of 4404 4488 frrrlfx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe"C:\Users\Admin\AppData\Local\Temp\61eb459df28a7d8c922209d1f11702ae443fa9583cd310c283926d831492e4c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\3hhbhn.exec:\3hhbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\vjjjd.exec:\vjjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\dpvpj.exec:\dpvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\rrrrlll.exec:\rrrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\ddppp.exec:\ddppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\btbttt.exec:\btbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\vjjdd.exec:\vjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\bttnbt.exec:\bttnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\htbhbt.exec:\htbhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\btttnn.exec:\btttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\1bbttb.exec:\1bbttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\vpjdd.exec:\vpjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ddddd.exec:\ddddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nhbtnh.exec:\nhbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\vdjvp.exec:\vdjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vjjjd.exec:\vjjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\xrfrfxf.exec:\xrfrfxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\5bnhbh.exec:\5bnhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\rfllffx.exec:\rfllffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\frrrlfx.exec:\frrrlfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\1dpjj.exec:\1dpjj.exe23⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xrlffxx.exec:\xrlffxx.exe24⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jpjvd.exec:\jpjvd.exe25⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnbttt.exec:\nnbttt.exe26⤵
- Executes dropped EXE
PID:5088 -
\??\c:\3bttnt.exec:\3bttnt.exe27⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rllllff.exec:\rllllff.exe28⤵
- Executes dropped EXE
PID:4632 -
\??\c:\nntnnn.exec:\nntnnn.exe29⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvjdv.exec:\dvjdv.exe30⤵
- Executes dropped EXE
PID:3264 -
\??\c:\frxrllx.exec:\frxrllx.exe31⤵
- Executes dropped EXE
PID:432 -
\??\c:\nnbtnh.exec:\nnbtnh.exe32⤵
- Executes dropped EXE
PID:5092 -
\??\c:\nhnhtt.exec:\nhnhtt.exe33⤵
- Executes dropped EXE
PID:3996 -
\??\c:\7flfxfx.exec:\7flfxfx.exe34⤵
- Executes dropped EXE
PID:4168 -
\??\c:\tttnnh.exec:\tttnnh.exe35⤵
- Executes dropped EXE
PID:2008 -
\??\c:\hhhbbb.exec:\hhhbbb.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dpjjj.exec:\dpjjj.exe37⤵
- Executes dropped EXE
PID:4788 -
\??\c:\llxrxxf.exec:\llxrxxf.exe38⤵
- Executes dropped EXE
PID:4300 -
\??\c:\3tbtbh.exec:\3tbtbh.exe39⤵
- Executes dropped EXE
PID:312 -
\??\c:\nbhbnn.exec:\nbhbnn.exe40⤵
- Executes dropped EXE
PID:4556 -
\??\c:\1vvpd.exec:\1vvpd.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lllfxrl.exec:\lllfxrl.exe42⤵
- Executes dropped EXE
PID:4496 -
\??\c:\hbhbtt.exec:\hbhbtt.exe43⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jddjd.exec:\jddjd.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lffxffx.exec:\lffxffx.exe45⤵
- Executes dropped EXE
PID:2788 -
\??\c:\9llxrrf.exec:\9llxrrf.exe46⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9btbtt.exec:\9btbtt.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9pjpj.exec:\9pjpj.exe48⤵
- Executes dropped EXE
PID:5012 -
\??\c:\rxfrffx.exec:\rxfrffx.exe49⤵
- Executes dropped EXE
PID:372 -
\??\c:\hbnhnn.exec:\hbnhnn.exe50⤵
- Executes dropped EXE
PID:3444 -
\??\c:\bhnnbn.exec:\bhnnbn.exe51⤵
- Executes dropped EXE
PID:3540 -
\??\c:\dvjdd.exec:\dvjdd.exe52⤵
- Executes dropped EXE
PID:4296 -
\??\c:\xrxfrrl.exec:\xrxfrrl.exe53⤵
- Executes dropped EXE
PID:4192 -
\??\c:\bttnnn.exec:\bttnnn.exe54⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7nhbtt.exec:\7nhbtt.exe55⤵
- Executes dropped EXE
PID:3572 -
\??\c:\7djvd.exec:\7djvd.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9flfxfr.exec:\9flfxfr.exe57⤵
- Executes dropped EXE
PID:3080 -
\??\c:\bnbbtn.exec:\bnbbtn.exe58⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vppjj.exec:\vppjj.exe59⤵
- Executes dropped EXE
PID:3696 -
\??\c:\1lrllll.exec:\1lrllll.exe60⤵
- Executes dropped EXE
PID:3776 -
\??\c:\xxxxrlf.exec:\xxxxrlf.exe61⤵
- Executes dropped EXE
PID:4108 -
\??\c:\tnbtbt.exec:\tnbtbt.exe62⤵
- Executes dropped EXE
PID:3744 -
\??\c:\jpvvp.exec:\jpvvp.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vppvp.exec:\vppvp.exe64⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xlrlflf.exec:\xlrlflf.exe65⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bnttbb.exec:\bnttbb.exe66⤵PID:2332
-
\??\c:\vpddp.exec:\vpddp.exe67⤵PID:3564
-
\??\c:\3vvpj.exec:\3vvpj.exe68⤵PID:940
-
\??\c:\rllflfl.exec:\rllflfl.exe69⤵PID:3928
-
\??\c:\1bbbtt.exec:\1bbbtt.exe70⤵PID:3700
-
\??\c:\nhhhbb.exec:\nhhhbb.exe71⤵PID:4528
-
\??\c:\vdjjd.exec:\vdjjd.exe72⤵PID:4948
-
\??\c:\xrxrllf.exec:\xrxrllf.exe73⤵PID:1576
-
\??\c:\tttnnb.exec:\tttnnb.exe74⤵PID:2736
-
\??\c:\dvddv.exec:\dvddv.exe75⤵PID:3852
-
\??\c:\pvvjv.exec:\pvvjv.exe76⤵PID:5076
-
\??\c:\llfffff.exec:\llfffff.exe77⤵PID:3240
-
\??\c:\hntnbb.exec:\hntnbb.exe78⤵PID:4572
-
\??\c:\jvpjd.exec:\jvpjd.exe79⤵PID:2200
-
\??\c:\jdjdv.exec:\jdjdv.exe80⤵PID:4176
-
\??\c:\llrllll.exec:\llrllll.exe81⤵PID:4980
-
\??\c:\hbhbbt.exec:\hbhbbt.exe82⤵PID:4700
-
\??\c:\3nnhbt.exec:\3nnhbt.exe83⤵PID:1324
-
\??\c:\vdjjj.exec:\vdjjj.exe84⤵PID:2076
-
\??\c:\vpppj.exec:\vpppj.exe85⤵PID:3304
-
\??\c:\llfxrlf.exec:\llfxrlf.exe86⤵PID:4536
-
\??\c:\bnthhb.exec:\bnthhb.exe87⤵PID:3268
-
\??\c:\nhhbtn.exec:\nhhbtn.exe88⤵PID:1416
-
\??\c:\pvvpj.exec:\pvvpj.exe89⤵PID:2932
-
\??\c:\7rlffff.exec:\7rlffff.exe90⤵PID:1412
-
\??\c:\thnbtn.exec:\thnbtn.exe91⤵PID:1360
-
\??\c:\bhnhbb.exec:\bhnhbb.exe92⤵PID:4048
-
\??\c:\9pvpj.exec:\9pvpj.exe93⤵PID:1296
-
\??\c:\7llxrrl.exec:\7llxrrl.exe94⤵PID:864
-
\??\c:\hhhhbb.exec:\hhhhbb.exe95⤵PID:1856
-
\??\c:\vpvvp.exec:\vpvvp.exe96⤵PID:1124
-
\??\c:\jjjdp.exec:\jjjdp.exe97⤵PID:1456
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe98⤵PID:2520
-
\??\c:\tbnnhh.exec:\tbnnhh.exe99⤵PID:2356
-
\??\c:\bttnhb.exec:\bttnhb.exe100⤵PID:4964
-
\??\c:\pppvv.exec:\pppvv.exe101⤵PID:2608
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe102⤵PID:4788
-
\??\c:\htttnh.exec:\htttnh.exe103⤵PID:5016
-
\??\c:\vjpdv.exec:\vjpdv.exe104⤵PID:3404
-
\??\c:\7rrfxrl.exec:\7rrfxrl.exe105⤵PID:4648
-
\??\c:\rllfllf.exec:\rllfllf.exe106⤵PID:4696
-
\??\c:\7bnhbb.exec:\7bnhbb.exe107⤵PID:2556
-
\??\c:\5jpjv.exec:\5jpjv.exe108⤵PID:3040
-
\??\c:\rrfffxr.exec:\rrfffxr.exe109⤵PID:2980
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe110⤵PID:3756
-
\??\c:\thtttn.exec:\thtttn.exe111⤵PID:2836
-
\??\c:\7vvpd.exec:\7vvpd.exe112⤵PID:2500
-
\??\c:\jjjvp.exec:\jjjvp.exe113⤵PID:2424
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe114⤵PID:2456
-
\??\c:\btbtnn.exec:\btbtnn.exe115⤵PID:3444
-
\??\c:\3jdvp.exec:\3jdvp.exe116⤵PID:3224
-
\??\c:\1lfxxxx.exec:\1lfxxxx.exe117⤵PID:4824
-
\??\c:\hbbtnh.exec:\hbbtnh.exe118⤵PID:4384
-
\??\c:\7vvdv.exec:\7vvdv.exe119⤵PID:3832
-
\??\c:\3vdpj.exec:\3vdpj.exe120⤵PID:1012
-
\??\c:\lffrxrx.exec:\lffrxrx.exe121⤵PID:2336
-
\??\c:\nhhhbb.exec:\nhhhbb.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-