Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 07:10
Static task
static1
Behavioral task
behavioral1
Sample
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe
Resource
win7-20240903-en
General
-
Target
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe
-
Size
456KB
-
MD5
26d5d0ea547b437de81ba971119e7730
-
SHA1
62839337d6cf894670b9d943469fb7f1cd9f82e0
-
SHA256
6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895
-
SHA512
dd38ecd7690be37e2bbda483f11e0dad051027af57fc6c25433e5794801ae4efbce64aef3bf24ed6314130c06cdcf348b9d4e868121cb807418dbf050aaef772
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRR:q7Tc2NYHUrAwfMp3CDRR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4232-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1160-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4332-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2532-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3940-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3668-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1224-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4520-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3552-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1312-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/924-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4708-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-1267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1900-1596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3600 hbtnnn.exe 4804 1pvpd.exe 1160 nbhbtb.exe 2012 nhbtnh.exe 3156 7pjdp.exe 4332 xxxrfxr.exe 2192 djpdp.exe 4504 7hhbth.exe 348 xlrfxrl.exe 5012 nhnnnh.exe 64 9pppj.exe 3052 rllffxr.exe 1884 xrllrlx.exe 1560 dpjdp.exe 4052 3hbtnn.exe 1900 dpdvv.exe 964 xrrlfxx.exe 1744 7nnbth.exe 2320 dpppv.exe 1220 5lrlxfr.exe 4992 tbtnnn.exe 1704 nbhbtt.exe 4256 nbthhn.exe 3352 djpjd.exe 2532 9xxffxf.exe 3496 7bbtnt.exe 3940 bhhtnt.exe 3668 5ddvp.exe 3704 djpjd.exe 1972 1jjdj.exe 4280 fxxrflx.exe 2476 3jpjd.exe 3444 fxrxxfx.exe 1276 1tbbbb.exe 1224 jdjvp.exe 1864 lfrlxxr.exe 4904 hbnttt.exe 1796 djppj.exe 2372 fxlfxxr.exe 4520 5nnhbt.exe 3552 9vvjv.exe 1312 pdjdv.exe 4940 9lffxrl.exe 1484 nbtttt.exe 924 jvvvd.exe 2280 jdvpj.exe 4872 frlfxrl.exe 4456 ththnh.exe 4160 djvjd.exe 3316 vjjdv.exe 1144 rrfxllf.exe 3296 5tnhbb.exe 3472 jpvpd.exe 1080 lfrlffx.exe 4580 7llxxrr.exe 1444 hhnhnh.exe 4716 jjpjv.exe 1356 rllfxxr.exe 3144 hbhttn.exe 2588 tnnnhh.exe 2364 jjdvj.exe 184 5llxrlx.exe 2192 3nnbnh.exe 2988 tnnhhh.exe -
resource yara_rule behavioral2/memory/4232-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1160-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4332-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1900-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3940-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3668-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1224-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4520-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3552-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1312-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/924-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4708-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5104-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-1267-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4232 wrote to memory of 3600 4232 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 82 PID 4232 wrote to memory of 3600 4232 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 82 PID 4232 wrote to memory of 3600 4232 6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe 82 PID 3600 wrote to memory of 4804 3600 hbtnnn.exe 83 PID 3600 wrote to memory of 4804 3600 hbtnnn.exe 83 PID 3600 wrote to memory of 4804 3600 hbtnnn.exe 83 PID 4804 wrote to memory of 1160 4804 1pvpd.exe 84 PID 4804 wrote to memory of 1160 4804 1pvpd.exe 84 PID 4804 wrote to memory of 1160 4804 1pvpd.exe 84 PID 1160 wrote to memory of 2012 1160 nbhbtb.exe 85 PID 1160 wrote to memory of 2012 1160 nbhbtb.exe 85 PID 1160 wrote to memory of 2012 1160 nbhbtb.exe 85 PID 2012 wrote to memory of 3156 2012 nhbtnh.exe 86 PID 2012 wrote to memory of 3156 2012 nhbtnh.exe 86 PID 2012 wrote to memory of 3156 2012 nhbtnh.exe 86 PID 3156 wrote to memory of 4332 3156 7pjdp.exe 87 PID 3156 wrote to memory of 4332 3156 7pjdp.exe 87 PID 3156 wrote to memory of 4332 3156 7pjdp.exe 87 PID 4332 wrote to memory of 2192 4332 xxxrfxr.exe 88 PID 4332 wrote to memory of 2192 4332 xxxrfxr.exe 88 PID 4332 wrote to memory of 2192 4332 xxxrfxr.exe 88 PID 2192 wrote to memory of 4504 2192 djpdp.exe 89 PID 2192 wrote to memory of 4504 2192 djpdp.exe 89 PID 2192 wrote to memory of 4504 2192 djpdp.exe 89 PID 4504 wrote to memory of 348 4504 7hhbth.exe 90 PID 4504 wrote to memory of 348 4504 7hhbth.exe 90 PID 4504 wrote to memory of 348 4504 7hhbth.exe 90 PID 348 wrote to memory of 5012 348 xlrfxrl.exe 91 PID 348 wrote to memory of 5012 348 xlrfxrl.exe 91 PID 348 wrote to memory of 5012 348 xlrfxrl.exe 91 PID 5012 wrote to memory of 64 5012 nhnnnh.exe 92 PID 5012 wrote to memory of 64 5012 nhnnnh.exe 92 PID 5012 wrote to memory of 64 5012 nhnnnh.exe 92 PID 64 wrote to memory of 3052 64 9pppj.exe 93 PID 64 wrote to memory of 3052 64 9pppj.exe 93 PID 64 wrote to memory of 3052 64 9pppj.exe 93 PID 3052 wrote to memory of 1884 3052 rllffxr.exe 94 PID 3052 wrote to memory of 1884 3052 rllffxr.exe 94 PID 3052 wrote to memory of 1884 3052 rllffxr.exe 94 PID 1884 wrote to memory of 1560 1884 xrllrlx.exe 95 PID 1884 wrote to memory of 1560 1884 xrllrlx.exe 95 PID 1884 wrote to memory of 1560 1884 xrllrlx.exe 95 PID 1560 wrote to memory of 4052 1560 dpjdp.exe 96 PID 1560 wrote to memory of 4052 1560 dpjdp.exe 96 PID 1560 wrote to memory of 4052 1560 dpjdp.exe 96 PID 4052 wrote to memory of 1900 4052 3hbtnn.exe 97 PID 4052 wrote to memory of 1900 4052 3hbtnn.exe 97 PID 4052 wrote to memory of 1900 4052 3hbtnn.exe 97 PID 1900 wrote to memory of 964 1900 dpdvv.exe 98 PID 1900 wrote to memory of 964 1900 dpdvv.exe 98 PID 1900 wrote to memory of 964 1900 dpdvv.exe 98 PID 964 wrote to memory of 1744 964 xrrlfxx.exe 99 PID 964 wrote to memory of 1744 964 xrrlfxx.exe 99 PID 964 wrote to memory of 1744 964 xrrlfxx.exe 99 PID 1744 wrote to memory of 2320 1744 7nnbth.exe 100 PID 1744 wrote to memory of 2320 1744 7nnbth.exe 100 PID 1744 wrote to memory of 2320 1744 7nnbth.exe 100 PID 2320 wrote to memory of 1220 2320 dpppv.exe 101 PID 2320 wrote to memory of 1220 2320 dpppv.exe 101 PID 2320 wrote to memory of 1220 2320 dpppv.exe 101 PID 1220 wrote to memory of 4992 1220 5lrlxfr.exe 102 PID 1220 wrote to memory of 4992 1220 5lrlxfr.exe 102 PID 1220 wrote to memory of 4992 1220 5lrlxfr.exe 102 PID 4992 wrote to memory of 1704 4992 tbtnnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe"C:\Users\Admin\AppData\Local\Temp\6e89ed4ef7793df91f487a672afa0a31ea20ef60565a5ff790b28a83b0794895N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\hbtnnn.exec:\hbtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\1pvpd.exec:\1pvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\nbhbtb.exec:\nbhbtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\nhbtnh.exec:\nhbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\7pjdp.exec:\7pjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\xxxrfxr.exec:\xxxrfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\djpdp.exec:\djpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\7hhbth.exec:\7hhbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\nhnnnh.exec:\nhnnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\9pppj.exec:\9pppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\rllffxr.exec:\rllffxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\xrllrlx.exec:\xrllrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\dpjdp.exec:\dpjdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\3hbtnn.exec:\3hbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\dpdvv.exec:\dpdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\7nnbth.exec:\7nnbth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\dpppv.exec:\dpppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\5lrlxfr.exec:\5lrlxfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\tbtnnn.exec:\tbtnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\nbhbtt.exec:\nbhbtt.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\nbthhn.exec:\nbthhn.exe24⤵
- Executes dropped EXE
PID:4256 -
\??\c:\djpjd.exec:\djpjd.exe25⤵
- Executes dropped EXE
PID:3352 -
\??\c:\9xxffxf.exec:\9xxffxf.exe26⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7bbtnt.exec:\7bbtnt.exe27⤵
- Executes dropped EXE
PID:3496 -
\??\c:\bhhtnt.exec:\bhhtnt.exe28⤵
- Executes dropped EXE
PID:3940 -
\??\c:\5ddvp.exec:\5ddvp.exe29⤵
- Executes dropped EXE
PID:3668 -
\??\c:\djpjd.exec:\djpjd.exe30⤵
- Executes dropped EXE
PID:3704 -
\??\c:\1jjdj.exec:\1jjdj.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\fxxrflx.exec:\fxxrflx.exe32⤵
- Executes dropped EXE
PID:4280 -
\??\c:\3jpjd.exec:\3jpjd.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\fxrxxfx.exec:\fxrxxfx.exe34⤵
- Executes dropped EXE
PID:3444 -
\??\c:\1tbbbb.exec:\1tbbbb.exe35⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jdjvp.exec:\jdjvp.exe36⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe37⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbnttt.exec:\hbnttt.exe38⤵
- Executes dropped EXE
PID:4904 -
\??\c:\djppj.exec:\djppj.exe39⤵
- Executes dropped EXE
PID:1796 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5nnhbt.exec:\5nnhbt.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\9vvjv.exec:\9vvjv.exe42⤵
- Executes dropped EXE
PID:3552 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9lffxrl.exec:\9lffxrl.exe44⤵
- Executes dropped EXE
PID:4940 -
\??\c:\nbtttt.exec:\nbtttt.exe45⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jvvvd.exec:\jvvvd.exe46⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdvpj.exec:\jdvpj.exe47⤵
- Executes dropped EXE
PID:2280 -
\??\c:\frlfxrl.exec:\frlfxrl.exe48⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ththnh.exec:\ththnh.exe49⤵
- Executes dropped EXE
PID:4456 -
\??\c:\djvjd.exec:\djvjd.exe50⤵
- Executes dropped EXE
PID:4160 -
\??\c:\vjjdv.exec:\vjjdv.exe51⤵
- Executes dropped EXE
PID:3316 -
\??\c:\rrfxllf.exec:\rrfxllf.exe52⤵
- Executes dropped EXE
PID:1144 -
\??\c:\5tnhbb.exec:\5tnhbb.exe53⤵
- Executes dropped EXE
PID:3296 -
\??\c:\jpvpd.exec:\jpvpd.exe54⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lfrlffx.exec:\lfrlffx.exe55⤵
- Executes dropped EXE
PID:1080 -
\??\c:\7llxxrr.exec:\7llxxrr.exe56⤵
- Executes dropped EXE
PID:4580 -
\??\c:\hhnhnh.exec:\hhnhnh.exe57⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jjpjv.exec:\jjpjv.exe58⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllfxxr.exec:\rllfxxr.exe59⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbhttn.exec:\hbhttn.exe60⤵
- Executes dropped EXE
PID:3144 -
\??\c:\tnnnhh.exec:\tnnnhh.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjdvj.exec:\jjdvj.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5llxrlx.exec:\5llxrlx.exe63⤵
- Executes dropped EXE
PID:184 -
\??\c:\3nnbnh.exec:\3nnbnh.exe64⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tnnhhh.exec:\tnnhhh.exe65⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jddvj.exec:\jddvj.exe66⤵PID:220
-
\??\c:\vppjv.exec:\vppjv.exe67⤵PID:348
-
\??\c:\1rlfrrr.exec:\1rlfrrr.exe68⤵PID:3188
-
\??\c:\3ttnbb.exec:\3ttnbb.exe69⤵PID:224
-
\??\c:\3pvpj.exec:\3pvpj.exe70⤵PID:3548
-
\??\c:\jpdpj.exec:\jpdpj.exe71⤵PID:4056
-
\??\c:\rflfxrl.exec:\rflfxrl.exe72⤵PID:3104
-
\??\c:\pvddp.exec:\pvddp.exe73⤵PID:4816
-
\??\c:\pjppp.exec:\pjppp.exe74⤵PID:4680
-
\??\c:\1fxxrrr.exec:\1fxxrrr.exe75⤵PID:3220
-
\??\c:\9hbtnn.exec:\9hbtnn.exe76⤵PID:5096
-
\??\c:\vjppj.exec:\vjppj.exe77⤵PID:1648
-
\??\c:\vppjp.exec:\vppjp.exe78⤵PID:964
-
\??\c:\9xrrlll.exec:\9xrrlll.exe79⤵PID:4084
-
\??\c:\7hhbtt.exec:\7hhbtt.exe80⤵PID:1744
-
\??\c:\pjvpp.exec:\pjvpp.exe81⤵PID:3872
-
\??\c:\vppjv.exec:\vppjv.exe82⤵PID:1220
-
\??\c:\5flfxxx.exec:\5flfxxx.exe83⤵PID:644
-
\??\c:\9bbbnn.exec:\9bbbnn.exe84⤵PID:4780
-
\??\c:\pjpjj.exec:\pjpjj.exe85⤵PID:1704
-
\??\c:\rfllflr.exec:\rfllflr.exe86⤵PID:1680
-
\??\c:\5nnhtt.exec:\5nnhtt.exe87⤵PID:3716
-
\??\c:\nbhttn.exec:\nbhttn.exe88⤵PID:1252
-
\??\c:\3ddvj.exec:\3ddvj.exe89⤵PID:4744
-
\??\c:\lrfrxxr.exec:\lrfrxxr.exe90⤵PID:2612
-
\??\c:\bnnhbb.exec:\bnnhbb.exe91⤵PID:316
-
\??\c:\7ddvp.exec:\7ddvp.exe92⤵PID:3940
-
\??\c:\5ddvp.exec:\5ddvp.exe93⤵PID:2416
-
\??\c:\lxrfflf.exec:\lxrfflf.exe94⤵PID:1956
-
\??\c:\bhtntb.exec:\bhtntb.exe95⤵PID:2360
-
\??\c:\5vdvv.exec:\5vdvv.exe96⤵PID:3776
-
\??\c:\pvjdp.exec:\pvjdp.exe97⤵PID:4280
-
\??\c:\lxlrlff.exec:\lxlrlff.exe98⤵PID:2428
-
\??\c:\nhnhhh.exec:\nhnhhh.exe99⤵
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\dvddp.exec:\dvddp.exe100⤵PID:2388
-
\??\c:\1pvpj.exec:\1pvpj.exe101⤵PID:400
-
\??\c:\rffxrrr.exec:\rffxrrr.exe102⤵PID:1572
-
\??\c:\9hbnhh.exec:\9hbnhh.exe103⤵PID:2096
-
\??\c:\9thbtt.exec:\9thbtt.exe104⤵PID:1952
-
\??\c:\jvpjj.exec:\jvpjj.exe105⤵PID:1796
-
\??\c:\flxrlfr.exec:\flxrlfr.exe106⤵PID:1948
-
\??\c:\5hhbtt.exec:\5hhbtt.exe107⤵PID:2700
-
\??\c:\vvjjv.exec:\vvjjv.exe108⤵PID:3528
-
\??\c:\5llfffx.exec:\5llfffx.exe109⤵PID:928
-
\??\c:\htbthh.exec:\htbthh.exe110⤵PID:2816
-
\??\c:\vdpjp.exec:\vdpjp.exe111⤵PID:4964
-
\??\c:\jddpd.exec:\jddpd.exe112⤵PID:4188
-
\??\c:\rffxllf.exec:\rffxllf.exe113⤵PID:1576
-
\??\c:\hbhhbb.exec:\hbhhbb.exe114⤵PID:1556
-
\??\c:\9jvvp.exec:\9jvvp.exe115⤵PID:4912
-
\??\c:\lxxlxll.exec:\lxxlxll.exe116⤵PID:3264
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe117⤵PID:4408
-
\??\c:\7bhbtt.exec:\7bhbtt.exe118⤵PID:2056
-
\??\c:\dvpjd.exec:\dvpjd.exe119⤵PID:4804
-
\??\c:\fxlfllr.exec:\fxlfllr.exe120⤵PID:4420
-
\??\c:\lrlfrrr.exec:\lrlfrrr.exe121⤵PID:4808
-
\??\c:\ttntnh.exec:\ttntnh.exe122⤵PID:3712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-