Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:15
Static task
static1
Behavioral task
behavioral1
Sample
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe
Resource
win7-20240903-en
General
-
Target
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe
-
Size
456KB
-
MD5
63c005bc062c54647df612c09595795e
-
SHA1
7f0920edca14fb167111d0c74164bf7f15a65d24
-
SHA256
bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e
-
SHA512
0f04ed064aaa49d0b69d618e600945928a679468b20256fc4b87ec65088cbd080fa01cdd1e224aad49eea3b3bdd197dccb1d05d90809cf1dfc1e33d099c6b74a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRx:q7Tc2NYHUrAwfMp3CDRx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4616-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1288-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1576-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3772-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1344-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3348-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/784-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3148-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3868-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/928-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3708-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4072-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4192-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3336-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4944-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2660-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2200-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3096-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2564-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/616-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-944-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-1700-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1288 nnnnhn.exe 1624 httbtn.exe 3708 nnbtbb.exe 960 jjpjj.exe 4100 ntbbbb.exe 2308 bntnhh.exe 1560 llxxxff.exe 1084 hhnhhh.exe 3096 9djjp.exe 2880 7lrllrr.exe 1576 hbnnnt.exe 732 dvdjd.exe 3560 xrxxxxf.exe 1284 ntnnnh.exe 3772 djvvd.exe 1796 pdvpd.exe 4192 xfrfxxl.exe 2324 3tbnth.exe 1072 jpvpp.exe 2496 fxffffl.exe 428 jpppj.exe 2264 xxrlffx.exe 1344 pdpvj.exe 3992 hhttnt.exe 4588 tbhbnn.exe 3348 bbbbbb.exe 752 xfrxlxf.exe 4208 rffllrr.exe 4384 9ttnhh.exe 4532 rrxxxff.exe 784 jppjj.exe 3148 hthhtb.exe 4344 nhnnnn.exe 3868 hhtntt.exe 2992 7llffll.exe 3032 htnhhh.exe 516 rxrrrxr.exe 4308 hbhbbb.exe 2244 djppj.exe 4860 3lllfll.exe 1292 3bnnhb.exe 4928 jvpjj.exe 3872 llffflx.exe 4316 nttnth.exe 3240 vjppp.exe 3712 rrrlfff.exe 452 nbnttt.exe 928 jpdvp.exe 3432 lfxfxxr.exe 3708 9ntnnn.exe 4364 5jjpj.exe 2864 7ffxrxr.exe 4100 3ttttb.exe 2296 dvddv.exe 1880 lrrlfxr.exe 4872 bbbhhn.exe 1516 jjvpd.exe 3836 pdjdd.exe 2056 xxfxxxr.exe 1652 ttnbbh.exe 732 jjdpd.exe 3752 rflfxrx.exe 232 bbhbtt.exe 1284 tnnntb.exe -
resource yara_rule behavioral2/memory/4616-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1288-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1576-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3772-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1344-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3348-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/784-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3148-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3868-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/928-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3708-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4072-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4192-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3336-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4944-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2660-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2200-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3096-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-717-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 1288 4616 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 83 PID 4616 wrote to memory of 1288 4616 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 83 PID 4616 wrote to memory of 1288 4616 bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe 83 PID 1288 wrote to memory of 1624 1288 nnnnhn.exe 84 PID 1288 wrote to memory of 1624 1288 nnnnhn.exe 84 PID 1288 wrote to memory of 1624 1288 nnnnhn.exe 84 PID 1624 wrote to memory of 3708 1624 httbtn.exe 85 PID 1624 wrote to memory of 3708 1624 httbtn.exe 85 PID 1624 wrote to memory of 3708 1624 httbtn.exe 85 PID 3708 wrote to memory of 960 3708 nnbtbb.exe 86 PID 3708 wrote to memory of 960 3708 nnbtbb.exe 86 PID 3708 wrote to memory of 960 3708 nnbtbb.exe 86 PID 960 wrote to memory of 4100 960 jjpjj.exe 87 PID 960 wrote to memory of 4100 960 jjpjj.exe 87 PID 960 wrote to memory of 4100 960 jjpjj.exe 87 PID 4100 wrote to memory of 2308 4100 ntbbbb.exe 88 PID 4100 wrote to memory of 2308 4100 ntbbbb.exe 88 PID 4100 wrote to memory of 2308 4100 ntbbbb.exe 88 PID 2308 wrote to memory of 1560 2308 bntnhh.exe 89 PID 2308 wrote to memory of 1560 2308 bntnhh.exe 89 PID 2308 wrote to memory of 1560 2308 bntnhh.exe 89 PID 1560 wrote to memory of 1084 1560 llxxxff.exe 90 PID 1560 wrote to memory of 1084 1560 llxxxff.exe 90 PID 1560 wrote to memory of 1084 1560 llxxxff.exe 90 PID 1084 wrote to memory of 3096 1084 hhnhhh.exe 91 PID 1084 wrote to memory of 3096 1084 hhnhhh.exe 91 PID 1084 wrote to memory of 3096 1084 hhnhhh.exe 91 PID 3096 wrote to memory of 2880 3096 9djjp.exe 92 PID 3096 wrote to memory of 2880 3096 9djjp.exe 92 PID 3096 wrote to memory of 2880 3096 9djjp.exe 92 PID 2880 wrote to memory of 1576 2880 7lrllrr.exe 93 PID 2880 wrote to memory of 1576 2880 7lrllrr.exe 93 PID 2880 wrote to memory of 1576 2880 7lrllrr.exe 93 PID 1576 wrote to memory of 732 1576 hbnnnt.exe 94 PID 1576 wrote to memory of 732 1576 hbnnnt.exe 94 PID 1576 wrote to memory of 732 1576 hbnnnt.exe 94 PID 732 wrote to memory of 3560 732 dvdjd.exe 95 PID 732 wrote to memory of 3560 732 dvdjd.exe 95 PID 732 wrote to memory of 3560 732 dvdjd.exe 95 PID 3560 wrote to memory of 1284 3560 xrxxxxf.exe 96 PID 3560 wrote to memory of 1284 3560 xrxxxxf.exe 96 PID 3560 wrote to memory of 1284 3560 xrxxxxf.exe 96 PID 1284 wrote to memory of 3772 1284 ntnnnh.exe 97 PID 1284 wrote to memory of 3772 1284 ntnnnh.exe 97 PID 1284 wrote to memory of 3772 1284 ntnnnh.exe 97 PID 3772 wrote to memory of 1796 3772 djvvd.exe 98 PID 3772 wrote to memory of 1796 3772 djvvd.exe 98 PID 3772 wrote to memory of 1796 3772 djvvd.exe 98 PID 1796 wrote to memory of 4192 1796 pdvpd.exe 99 PID 1796 wrote to memory of 4192 1796 pdvpd.exe 99 PID 1796 wrote to memory of 4192 1796 pdvpd.exe 99 PID 4192 wrote to memory of 2324 4192 xfrfxxl.exe 100 PID 4192 wrote to memory of 2324 4192 xfrfxxl.exe 100 PID 4192 wrote to memory of 2324 4192 xfrfxxl.exe 100 PID 2324 wrote to memory of 1072 2324 3tbnth.exe 101 PID 2324 wrote to memory of 1072 2324 3tbnth.exe 101 PID 2324 wrote to memory of 1072 2324 3tbnth.exe 101 PID 1072 wrote to memory of 2496 1072 jpvpp.exe 102 PID 1072 wrote to memory of 2496 1072 jpvpp.exe 102 PID 1072 wrote to memory of 2496 1072 jpvpp.exe 102 PID 2496 wrote to memory of 428 2496 fxffffl.exe 103 PID 2496 wrote to memory of 428 2496 fxffffl.exe 103 PID 2496 wrote to memory of 428 2496 fxffffl.exe 103 PID 428 wrote to memory of 2264 428 jpppj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe"C:\Users\Admin\AppData\Local\Temp\bfba856744cbfe007829ce46304859db32e45494f2a94a68dcabd9a244dd996e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\nnnnhn.exec:\nnnnhn.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\httbtn.exec:\httbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\nnbtbb.exec:\nnbtbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jjpjj.exec:\jjpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\ntbbbb.exec:\ntbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\bntnhh.exec:\bntnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\llxxxff.exec:\llxxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\hhnhhh.exec:\hhnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\9djjp.exec:\9djjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\7lrllrr.exec:\7lrllrr.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hbnnnt.exec:\hbnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\dvdjd.exec:\dvdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\ntnnnh.exec:\ntnnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\djvvd.exec:\djvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\pdvpd.exec:\pdvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xfrfxxl.exec:\xfrfxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\3tbnth.exec:\3tbnth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jpvpp.exec:\jpvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\fxffffl.exec:\fxffffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\jpppj.exec:\jpppj.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\xxrlffx.exec:\xxrlffx.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pdpvj.exec:\pdpvj.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hhttnt.exec:\hhttnt.exe25⤵
- Executes dropped EXE
PID:3992 -
\??\c:\tbhbnn.exec:\tbhbnn.exe26⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bbbbbb.exec:\bbbbbb.exe27⤵
- Executes dropped EXE
PID:3348 -
\??\c:\xfrxlxf.exec:\xfrxlxf.exe28⤵
- Executes dropped EXE
PID:752 -
\??\c:\rffllrr.exec:\rffllrr.exe29⤵
- Executes dropped EXE
PID:4208 -
\??\c:\9ttnhh.exec:\9ttnhh.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\rrxxxff.exec:\rrxxxff.exe31⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jppjj.exec:\jppjj.exe32⤵
- Executes dropped EXE
PID:784 -
\??\c:\hthhtb.exec:\hthhtb.exe33⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nhnnnn.exec:\nhnnnn.exe34⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hhtntt.exec:\hhtntt.exe35⤵
- Executes dropped EXE
PID:3868 -
\??\c:\7llffll.exec:\7llffll.exe36⤵
- Executes dropped EXE
PID:2992 -
\??\c:\htnhhh.exec:\htnhhh.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rxrrrxr.exec:\rxrrrxr.exe38⤵
- Executes dropped EXE
PID:516 -
\??\c:\hbhbbb.exec:\hbhbbb.exe39⤵
- Executes dropped EXE
PID:4308 -
\??\c:\djppj.exec:\djppj.exe40⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3lllfll.exec:\3lllfll.exe41⤵
- Executes dropped EXE
PID:4860 -
\??\c:\3bnnhb.exec:\3bnnhb.exe42⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jvpjj.exec:\jvpjj.exe43⤵
- Executes dropped EXE
PID:4928 -
\??\c:\llffflx.exec:\llffflx.exe44⤵
- Executes dropped EXE
PID:3872 -
\??\c:\nttnth.exec:\nttnth.exe45⤵
- Executes dropped EXE
PID:4316 -
\??\c:\vjppp.exec:\vjppp.exe46⤵
- Executes dropped EXE
PID:3240 -
\??\c:\rrrlfff.exec:\rrrlfff.exe47⤵
- Executes dropped EXE
PID:3712 -
\??\c:\nbnttt.exec:\nbnttt.exe48⤵
- Executes dropped EXE
PID:452 -
\??\c:\jpdvp.exec:\jpdvp.exe49⤵
- Executes dropped EXE
PID:928 -
\??\c:\lfxfxxr.exec:\lfxfxxr.exe50⤵
- Executes dropped EXE
PID:3432 -
\??\c:\9ntnnn.exec:\9ntnnn.exe51⤵
- Executes dropped EXE
PID:3708 -
\??\c:\5jjpj.exec:\5jjpj.exe52⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7ffxrxr.exec:\7ffxrxr.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3ttttb.exec:\3ttttb.exe54⤵
- Executes dropped EXE
PID:4100 -
\??\c:\dvddv.exec:\dvddv.exe55⤵
- Executes dropped EXE
PID:2296 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe56⤵
- Executes dropped EXE
PID:1880 -
\??\c:\bbbhhn.exec:\bbbhhn.exe57⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jjvpd.exec:\jjvpd.exe58⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pdjdd.exec:\pdjdd.exe59⤵
- Executes dropped EXE
PID:3836 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe60⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ttnbbh.exec:\ttnbbh.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jjdpd.exec:\jjdpd.exe62⤵
- Executes dropped EXE
PID:732 -
\??\c:\rflfxrx.exec:\rflfxrx.exe63⤵
- Executes dropped EXE
PID:3752 -
\??\c:\bbhbtt.exec:\bbhbtt.exe64⤵
- Executes dropped EXE
PID:232 -
\??\c:\tnnntb.exec:\tnnntb.exe65⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pppjj.exec:\pppjj.exe66⤵PID:3772
-
\??\c:\ththth.exec:\ththth.exe67⤵PID:4072
-
\??\c:\htnhbt.exec:\htnhbt.exe68⤵PID:4192
-
\??\c:\vdjjd.exec:\vdjjd.exe69⤵PID:636
-
\??\c:\lrlrlrl.exec:\lrlrlrl.exe70⤵PID:4468
-
\??\c:\hhnhbb.exec:\hhnhbb.exe71⤵PID:2692
-
\??\c:\7vvdd.exec:\7vvdd.exe72⤵PID:2940
-
\??\c:\lflrfxx.exec:\lflrfxx.exe73⤵PID:1220
-
\??\c:\1nntnh.exec:\1nntnh.exe74⤵PID:3928
-
\??\c:\pvdvv.exec:\pvdvv.exe75⤵PID:4040
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe76⤵PID:1176
-
\??\c:\xflflll.exec:\xflflll.exe77⤵PID:4012
-
\??\c:\tbhbtt.exec:\tbhbtt.exe78⤵PID:1344
-
\??\c:\3djdd.exec:\3djdd.exe79⤵PID:2948
-
\??\c:\xflrlff.exec:\xflrlff.exe80⤵PID:384
-
\??\c:\tthbtb.exec:\tthbtb.exe81⤵PID:2220
-
\??\c:\jdpjd.exec:\jdpjd.exe82⤵PID:740
-
\??\c:\xfllxfx.exec:\xfllxfx.exe83⤵PID:3460
-
\??\c:\1bbhhb.exec:\1bbhhb.exe84⤵PID:3336
-
\??\c:\9vddd.exec:\9vddd.exe85⤵PID:4352
-
\??\c:\rrflfxx.exec:\rrflfxx.exe86⤵PID:2356
-
\??\c:\7hnhtt.exec:\7hnhtt.exe87⤵PID:4144
-
\??\c:\dddjj.exec:\dddjj.exe88⤵PID:2480
-
\??\c:\lflfrrf.exec:\lflfrrf.exe89⤵PID:4856
-
\??\c:\3xxxxfx.exec:\3xxxxfx.exe90⤵PID:4876
-
\??\c:\dppvj.exec:\dppvj.exe91⤵PID:3164
-
\??\c:\jjppp.exec:\jjppp.exe92⤵PID:3512
-
\??\c:\thbhnn.exec:\thbhnn.exe93⤵PID:2904
-
\??\c:\tbnhbb.exec:\tbnhbb.exe94⤵PID:2640
-
\??\c:\vpppd.exec:\vpppd.exe95⤵PID:2656
-
\??\c:\5llllrr.exec:\5llllrr.exe96⤵PID:3556
-
\??\c:\7bhbtt.exec:\7bhbtt.exe97⤵PID:1792
-
\??\c:\jjjdd.exec:\jjjdd.exe98⤵PID:4444
-
\??\c:\1fxlffx.exec:\1fxlffx.exe99⤵PID:4740
-
\??\c:\llrrlrr.exec:\llrrlrr.exe100⤵PID:4792
-
\??\c:\btthbt.exec:\btthbt.exe101⤵PID:4328
-
\??\c:\jdjjd.exec:\jdjjd.exe102⤵PID:4412
-
\??\c:\xfllrrx.exec:\xfllrrx.exe103⤵PID:4316
-
\??\c:\nhhhbb.exec:\nhhhbb.exe104⤵PID:2944
-
\??\c:\ppvvj.exec:\ppvvj.exe105⤵PID:3712
-
\??\c:\3vdvp.exec:\3vdvp.exe106⤵PID:452
-
\??\c:\frxxrff.exec:\frxxrff.exe107⤵PID:2224
-
\??\c:\bhhhnn.exec:\bhhhnn.exe108⤵PID:3604
-
\??\c:\pdjpj.exec:\pdjpj.exe109⤵PID:2176
-
\??\c:\xxrxrrr.exec:\xxrxrrr.exe110⤵PID:4624
-
\??\c:\hnbhbb.exec:\hnbhbb.exe111⤵PID:4584
-
\??\c:\xrlrxff.exec:\xrlrxff.exe112⤵PID:4564
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe113⤵PID:2116
-
\??\c:\thbhht.exec:\thbhht.exe114⤵PID:4872
-
\??\c:\jjvdp.exec:\jjvdp.exe115⤵PID:1500
-
\??\c:\bhnhht.exec:\bhnhht.exe116⤵PID:4644
-
\??\c:\3dvpj.exec:\3dvpj.exe117⤵PID:2252
-
\??\c:\7pvvp.exec:\7pvvp.exe118⤵PID:1540
-
\??\c:\rflfrrr.exec:\rflfrrr.exe119⤵PID:3408
-
\??\c:\1nhhbh.exec:\1nhhbh.exe120⤵PID:1700
-
\??\c:\5jpjd.exec:\5jpjd.exe121⤵PID:3092
-
\??\c:\5jpjj.exec:\5jpjj.exe122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-