Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:12
Static task
static1
Behavioral task
behavioral1
Sample
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe
Resource
win7-20240903-en
General
-
Target
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe
-
Size
454KB
-
MD5
79179c0b8d6fd4fa975ff44d5267fab0
-
SHA1
a5f148c7d8423c017ae21250b938802bb1249916
-
SHA256
bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2c
-
SHA512
c04a5e7d63132e3718106b25d01313d882666fb4e7f4d0699bb840ab6680319485c973ab144b7a05911647aba26700686c5efef0d037ead2ee83a5ab66d93b11
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3584-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2160-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3080-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1420-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4632-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4676-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/904-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4760-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3752-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5100-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/392-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-633-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-1062-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-1108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-1175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3584 ppjjp.exe 4828 ffrrffr.exe 4452 ntttbh.exe 4212 vjdvv.exe 3732 pvpjv.exe 1972 nnnttb.exe 5016 pppvp.exe 4272 dddvv.exe 1964 xffrrrr.exe 5116 bntbbn.exe 3024 9dddd.exe 2160 hhbhhn.exe 456 pjjdv.exe 3300 pdjpv.exe 3212 xlxxfff.exe 3712 jjppv.exe 3796 rflrxfx.exe 2768 bbhbbb.exe 4376 rlrrxxx.exe 3772 hhhtth.exe 912 jjvvj.exe 3080 frffffx.exe 2960 nbnhbb.exe 436 vpvvv.exe 4260 lfffxfl.exe 5064 rrrrxfl.exe 2688 9rffffl.exe 4656 1rrxrrr.exe 4820 xxllfrr.exe 3352 btbtnn.exe 2708 jppjp.exe 3160 ddjdd.exe 2304 rrfxllf.exe 1688 pjvvp.exe 3968 thbtbb.exe 3508 7vpjj.exe 4316 htbbtn.exe 1648 tbbtht.exe 4640 1jpjd.exe 3544 5flfxxr.exe 3140 tttnhh.exe 5112 dvvdd.exe 3632 xfrrffr.exe 1420 thtthb.exe 1576 vpdvj.exe 4632 xlxxxxx.exe 1120 ntnnnb.exe 1732 jdvpd.exe 1000 fxfxrrr.exe 4348 7hhbbb.exe 4432 tbnhnn.exe 928 jpjjd.exe 4828 rfrxfxr.exe 2004 xlllfxx.exe 1244 vppdd.exe 4372 jpvdv.exe 3112 flrrxxr.exe 868 1tnhbb.exe 3380 vpvpj.exe 776 fflfrrl.exe 5096 5ttnhn.exe 3624 bbbnhh.exe 3332 pjpjd.exe 2884 llrrlll.exe -
resource yara_rule behavioral2/memory/3584-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2160-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3080-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1420-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4632-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4676-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/904-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4760-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3752-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5100-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/392-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 3584 928 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 83 PID 928 wrote to memory of 3584 928 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 83 PID 928 wrote to memory of 3584 928 bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe 83 PID 3584 wrote to memory of 4828 3584 ppjjp.exe 84 PID 3584 wrote to memory of 4828 3584 ppjjp.exe 84 PID 3584 wrote to memory of 4828 3584 ppjjp.exe 84 PID 4828 wrote to memory of 4452 4828 ffrrffr.exe 85 PID 4828 wrote to memory of 4452 4828 ffrrffr.exe 85 PID 4828 wrote to memory of 4452 4828 ffrrffr.exe 85 PID 4452 wrote to memory of 4212 4452 ntttbh.exe 86 PID 4452 wrote to memory of 4212 4452 ntttbh.exe 86 PID 4452 wrote to memory of 4212 4452 ntttbh.exe 86 PID 4212 wrote to memory of 3732 4212 vjdvv.exe 87 PID 4212 wrote to memory of 3732 4212 vjdvv.exe 87 PID 4212 wrote to memory of 3732 4212 vjdvv.exe 87 PID 3732 wrote to memory of 1972 3732 pvpjv.exe 88 PID 3732 wrote to memory of 1972 3732 pvpjv.exe 88 PID 3732 wrote to memory of 1972 3732 pvpjv.exe 88 PID 1972 wrote to memory of 5016 1972 nnnttb.exe 89 PID 1972 wrote to memory of 5016 1972 nnnttb.exe 89 PID 1972 wrote to memory of 5016 1972 nnnttb.exe 89 PID 5016 wrote to memory of 4272 5016 pppvp.exe 90 PID 5016 wrote to memory of 4272 5016 pppvp.exe 90 PID 5016 wrote to memory of 4272 5016 pppvp.exe 90 PID 4272 wrote to memory of 1964 4272 dddvv.exe 91 PID 4272 wrote to memory of 1964 4272 dddvv.exe 91 PID 4272 wrote to memory of 1964 4272 dddvv.exe 91 PID 1964 wrote to memory of 5116 1964 xffrrrr.exe 92 PID 1964 wrote to memory of 5116 1964 xffrrrr.exe 92 PID 1964 wrote to memory of 5116 1964 xffrrrr.exe 92 PID 5116 wrote to memory of 3024 5116 bntbbn.exe 93 PID 5116 wrote to memory of 3024 5116 bntbbn.exe 93 PID 5116 wrote to memory of 3024 5116 bntbbn.exe 93 PID 3024 wrote to memory of 2160 3024 9dddd.exe 94 PID 3024 wrote to memory of 2160 3024 9dddd.exe 94 PID 3024 wrote to memory of 2160 3024 9dddd.exe 94 PID 2160 wrote to memory of 456 2160 hhbhhn.exe 95 PID 2160 wrote to memory of 456 2160 hhbhhn.exe 95 PID 2160 wrote to memory of 456 2160 hhbhhn.exe 95 PID 456 wrote to memory of 3300 456 pjjdv.exe 96 PID 456 wrote to memory of 3300 456 pjjdv.exe 96 PID 456 wrote to memory of 3300 456 pjjdv.exe 96 PID 3300 wrote to memory of 3212 3300 pdjpv.exe 97 PID 3300 wrote to memory of 3212 3300 pdjpv.exe 97 PID 3300 wrote to memory of 3212 3300 pdjpv.exe 97 PID 3212 wrote to memory of 3712 3212 xlxxfff.exe 98 PID 3212 wrote to memory of 3712 3212 xlxxfff.exe 98 PID 3212 wrote to memory of 3712 3212 xlxxfff.exe 98 PID 3712 wrote to memory of 3796 3712 jjppv.exe 99 PID 3712 wrote to memory of 3796 3712 jjppv.exe 99 PID 3712 wrote to memory of 3796 3712 jjppv.exe 99 PID 3796 wrote to memory of 2768 3796 rflrxfx.exe 100 PID 3796 wrote to memory of 2768 3796 rflrxfx.exe 100 PID 3796 wrote to memory of 2768 3796 rflrxfx.exe 100 PID 2768 wrote to memory of 4376 2768 bbhbbb.exe 101 PID 2768 wrote to memory of 4376 2768 bbhbbb.exe 101 PID 2768 wrote to memory of 4376 2768 bbhbbb.exe 101 PID 4376 wrote to memory of 3772 4376 rlrrxxx.exe 102 PID 4376 wrote to memory of 3772 4376 rlrrxxx.exe 102 PID 4376 wrote to memory of 3772 4376 rlrrxxx.exe 102 PID 3772 wrote to memory of 912 3772 hhhtth.exe 103 PID 3772 wrote to memory of 912 3772 hhhtth.exe 103 PID 3772 wrote to memory of 912 3772 hhhtth.exe 103 PID 912 wrote to memory of 3080 912 jjvvj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe"C:\Users\Admin\AppData\Local\Temp\bfbebac50086680680391327b996cb5a5a79d8df77bc27c87cada44035761d2cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\ppjjp.exec:\ppjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\ffrrffr.exec:\ffrrffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\ntttbh.exec:\ntttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\vjdvv.exec:\vjdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\pvpjv.exec:\pvpjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\nnnttb.exec:\nnnttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pppvp.exec:\pppvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\dddvv.exec:\dddvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\xffrrrr.exec:\xffrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bntbbn.exec:\bntbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\9dddd.exec:\9dddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\hhbhhn.exec:\hhbhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\pjjdv.exec:\pjjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\pdjpv.exec:\pdjpv.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\xlxxfff.exec:\xlxxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\jjppv.exec:\jjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\rflrxfx.exec:\rflrxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\bbhbbb.exec:\bbhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rlrrxxx.exec:\rlrrxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\hhhtth.exec:\hhhtth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\jjvvj.exec:\jjvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\frffffx.exec:\frffffx.exe23⤵
- Executes dropped EXE
PID:3080 -
\??\c:\nbnhbb.exec:\nbnhbb.exe24⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpvvv.exec:\vpvvv.exe25⤵
- Executes dropped EXE
PID:436 -
\??\c:\lfffxfl.exec:\lfffxfl.exe26⤵
- Executes dropped EXE
PID:4260 -
\??\c:\rrrrxfl.exec:\rrrrxfl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5064 -
\??\c:\9rffffl.exec:\9rffffl.exe28⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1rrxrrr.exec:\1rrxrrr.exe29⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xxllfrr.exec:\xxllfrr.exe30⤵
- Executes dropped EXE
PID:4820 -
\??\c:\btbtnn.exec:\btbtnn.exe31⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jppjp.exec:\jppjp.exe32⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ddjdd.exec:\ddjdd.exe33⤵
- Executes dropped EXE
PID:3160 -
\??\c:\rrfxllf.exec:\rrfxllf.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pjvvp.exec:\pjvvp.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\thbtbb.exec:\thbtbb.exe36⤵
- Executes dropped EXE
PID:3968 -
\??\c:\7vpjj.exec:\7vpjj.exe37⤵
- Executes dropped EXE
PID:3508 -
\??\c:\htbbtn.exec:\htbbtn.exe38⤵
- Executes dropped EXE
PID:4316 -
\??\c:\tbbtht.exec:\tbbtht.exe39⤵
- Executes dropped EXE
PID:1648 -
\??\c:\1jpjd.exec:\1jpjd.exe40⤵
- Executes dropped EXE
PID:4640 -
\??\c:\5flfxxr.exec:\5flfxxr.exe41⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tttnhh.exec:\tttnhh.exe42⤵
- Executes dropped EXE
PID:3140 -
\??\c:\dvvdd.exec:\dvvdd.exe43⤵
- Executes dropped EXE
PID:5112 -
\??\c:\xfrrffr.exec:\xfrrffr.exe44⤵
- Executes dropped EXE
PID:3632 -
\??\c:\thtthb.exec:\thtthb.exe45⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpdvj.exec:\vpdvj.exe46⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe47⤵
- Executes dropped EXE
PID:4632 -
\??\c:\ntnnnb.exec:\ntnnnb.exe48⤵
- Executes dropped EXE
PID:1120 -
\??\c:\jdvpd.exec:\jdvpd.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe50⤵
- Executes dropped EXE
PID:1000 -
\??\c:\7hhbbb.exec:\7hhbbb.exe51⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tbnhnn.exec:\tbnhnn.exe52⤵
- Executes dropped EXE
PID:4432 -
\??\c:\jpjjd.exec:\jpjjd.exe53⤵
- Executes dropped EXE
PID:928 -
\??\c:\rfrxfxr.exec:\rfrxfxr.exe54⤵
- Executes dropped EXE
PID:4828 -
\??\c:\xlllfxx.exec:\xlllfxx.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vppdd.exec:\vppdd.exe56⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jpvdv.exec:\jpvdv.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\flrrxxr.exec:\flrrxxr.exe58⤵
- Executes dropped EXE
PID:3112 -
\??\c:\1tnhbb.exec:\1tnhbb.exe59⤵
- Executes dropped EXE
PID:868 -
\??\c:\vpvpj.exec:\vpvpj.exe60⤵
- Executes dropped EXE
PID:3380 -
\??\c:\fflfrrl.exec:\fflfrrl.exe61⤵
- Executes dropped EXE
PID:776 -
\??\c:\5ttnhn.exec:\5ttnhn.exe62⤵
- Executes dropped EXE
PID:5096 -
\??\c:\bbbnhh.exec:\bbbnhh.exe63⤵
- Executes dropped EXE
PID:3624 -
\??\c:\pjpjd.exec:\pjpjd.exe64⤵
- Executes dropped EXE
PID:3332 -
\??\c:\llrrlll.exec:\llrrlll.exe65⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3llfxfx.exec:\3llfxfx.exe66⤵PID:4956
-
\??\c:\thnhbt.exec:\thnhbt.exe67⤵PID:3436
-
\??\c:\pdjjp.exec:\pdjjp.exe68⤵PID:2320
-
\??\c:\5ppjd.exec:\5ppjd.exe69⤵PID:4852
-
\??\c:\1lrllrf.exec:\1lrllrf.exe70⤵PID:2752
-
\??\c:\5bbbtt.exec:\5bbbtt.exe71⤵PID:908
-
\??\c:\pjvvv.exec:\pjvvv.exe72⤵PID:456
-
\??\c:\pvjjd.exec:\pvjjd.exe73⤵PID:4980
-
\??\c:\fxfxlff.exec:\fxfxlff.exe74⤵PID:2300
-
\??\c:\tthbtt.exec:\tthbtt.exe75⤵PID:3588
-
\??\c:\vpdvp.exec:\vpdvp.exe76⤵PID:4600
-
\??\c:\xxxxrxl.exec:\xxxxrxl.exe77⤵PID:2404
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe78⤵PID:4376
-
\??\c:\tntnhh.exec:\tntnhh.exe79⤵PID:1752
-
\??\c:\5vvpp.exec:\5vvpp.exe80⤵PID:1696
-
\??\c:\xlrlffx.exec:\xlrlffx.exe81⤵PID:4184
-
\??\c:\hhtttt.exec:\hhtttt.exe82⤵PID:4296
-
\??\c:\ddvvp.exec:\ddvvp.exe83⤵PID:1540
-
\??\c:\1lfxrrr.exec:\1lfxrrr.exe84⤵PID:2720
-
\??\c:\lfrfllx.exec:\lfrfllx.exe85⤵
- System Location Discovery: System Language Discovery
PID:3472 -
\??\c:\1bhbbb.exec:\1bhbbb.exe86⤵PID:4676
-
\??\c:\pvjdd.exec:\pvjdd.exe87⤵PID:3592
-
\??\c:\9rxrflr.exec:\9rxrflr.exe88⤵PID:3384
-
\??\c:\nnttnt.exec:\nnttnt.exe89⤵PID:2268
-
\??\c:\bhbbth.exec:\bhbbth.exe90⤵PID:4692
-
\??\c:\ddvvv.exec:\ddvvv.exe91⤵PID:972
-
\??\c:\lxxrlfl.exec:\lxxrlfl.exe92⤵PID:904
-
\??\c:\bbntnh.exec:\bbntnh.exe93⤵PID:3100
-
\??\c:\pjpjj.exec:\pjpjj.exe94⤵PID:4548
-
\??\c:\vjjdd.exec:\vjjdd.exe95⤵PID:2708
-
\??\c:\frrlffx.exec:\frrlffx.exe96⤵PID:1876
-
\??\c:\btbtnn.exec:\btbtnn.exe97⤵PID:2564
-
\??\c:\vvpjj.exec:\vvpjj.exe98⤵PID:4760
-
\??\c:\jvjjp.exec:\jvjjp.exe99⤵PID:3596
-
\??\c:\rxxxrll.exec:\rxxxrll.exe100⤵PID:3828
-
\??\c:\bthbnn.exec:\bthbnn.exe101⤵PID:4932
-
\??\c:\jvjjd.exec:\jvjjd.exe102⤵PID:3564
-
\??\c:\fflfffx.exec:\fflfffx.exe103⤵PID:4572
-
\??\c:\xrfxrlr.exec:\xrfxrlr.exe104⤵PID:2364
-
\??\c:\bbbbtt.exec:\bbbbtt.exe105⤵PID:3568
-
\??\c:\jvddv.exec:\jvddv.exe106⤵PID:3820
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe107⤵PID:3640
-
\??\c:\ffxfxrl.exec:\ffxfxrl.exe108⤵PID:1944
-
\??\c:\3htnnn.exec:\3htnnn.exe109⤵PID:1480
-
\??\c:\dvjpv.exec:\dvjpv.exe110⤵PID:1576
-
\??\c:\pjjjd.exec:\pjjjd.exe111⤵PID:2888
-
\??\c:\xrfxfff.exec:\xrfxfff.exe112⤵PID:4264
-
\??\c:\bbbnbt.exec:\bbbnbt.exe113⤵PID:4604
-
\??\c:\pdjjd.exec:\pdjjd.exe114⤵PID:1000
-
\??\c:\5rrllrl.exec:\5rrllrl.exe115⤵PID:2432
-
\??\c:\flrllfx.exec:\flrllfx.exe116⤵PID:4944
-
\??\c:\9nnhhh.exec:\9nnhhh.exe117⤵PID:3584
-
\??\c:\vpddd.exec:\vpddd.exe118⤵PID:2108
-
\??\c:\3xxrlrr.exec:\3xxrlrr.exe119⤵PID:3036
-
\??\c:\rxllffr.exec:\rxllffr.exe120⤵PID:4908
-
\??\c:\hhtnnh.exec:\hhtnnh.exe121⤵PID:3252
-
\??\c:\9vvpj.exec:\9vvpj.exe122⤵PID:1740
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-