Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe
Resource
win7-20240903-en
General
-
Target
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe
-
Size
454KB
-
MD5
28ffd168dc361117a5cc00a7ae7036b0
-
SHA1
f151211d4dd3daba03dda797da4e7b0d5c5bdff1
-
SHA256
aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6f
-
SHA512
7c8ef09479c85625468c6f784dfd1b7fb26087f9f1187b963c5886c069488ec492dee3ced5557fa4f3a72a399bd380e97e27b925ea5c2ed53ea4f3aa9ccc877d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT2:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4700-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3620-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4976-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1668-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2348-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3648-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1248-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2656-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4912-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2436-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/216-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-650-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4504-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1960-1015-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2324-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1332-1688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3620 jjvpp.exe 2044 bbnhhb.exe 968 vvvvp.exe 2728 vpddv.exe 3864 hhntbb.exe 3216 jdjdd.exe 1188 pvvvv.exe 2272 pvjpv.exe 4988 rrrlrrf.exe 208 ttbthn.exe 2036 tthtnh.exe 1092 xrxrllf.exe 4500 pdpjd.exe 3888 7xrrrxr.exe 4976 ttbbbb.exe 3036 vppdv.exe 3156 lxffxxx.exe 4984 htbbbb.exe 3312 jpddp.exe 2064 rflffff.exe 3192 nbhbbt.exe 4316 pjjdd.exe 4964 xxffrrl.exe 1768 1rrlfff.exe 4012 bbnnnb.exe 1152 hhtnnn.exe 1668 pdjdv.exe 2324 htbbtt.exe 3504 tbhnnn.exe 2788 ppvvj.exe 3540 rrlxrll.exe 2348 nhnhhb.exe 3648 xxfxxll.exe 2996 tbnnhn.exe 1268 vvvjv.exe 1660 rxxfxxr.exe 4652 htttnn.exe 1792 7jdpj.exe 3636 fxxxllf.exe 4640 djpjj.exe 816 lxlflfx.exe 1248 rxlxxxr.exe 4784 bnhnnh.exe 760 vpppj.exe 4312 rffxllf.exe 2900 nbnttn.exe 2656 pdddd.exe 2352 dvjdp.exe 2404 rllfrxr.exe 1712 1hnttb.exe 2912 vvjdd.exe 1544 jpdvj.exe 4912 lfrlllx.exe 2272 nbnhbh.exe 1492 djppj.exe 1840 lrrrrrr.exe 1088 lrxrrrl.exe 4988 tbhhnn.exe 640 5bbttb.exe 3204 1vdvp.exe 3980 9llfrfx.exe 232 btnhbb.exe 1464 bnbtnh.exe 2408 jdpjj.exe -
resource yara_rule behavioral2/memory/4700-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3620-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4976-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3192-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1768-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1668-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2324-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2348-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3648-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1268-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/816-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1248-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2656-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4912-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4140-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2436-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/216-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-711-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4504-764-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3620 4700 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 83 PID 4700 wrote to memory of 3620 4700 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 83 PID 4700 wrote to memory of 3620 4700 aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe 83 PID 3620 wrote to memory of 2044 3620 jjvpp.exe 84 PID 3620 wrote to memory of 2044 3620 jjvpp.exe 84 PID 3620 wrote to memory of 2044 3620 jjvpp.exe 84 PID 2044 wrote to memory of 968 2044 bbnhhb.exe 85 PID 2044 wrote to memory of 968 2044 bbnhhb.exe 85 PID 2044 wrote to memory of 968 2044 bbnhhb.exe 85 PID 968 wrote to memory of 2728 968 vvvvp.exe 86 PID 968 wrote to memory of 2728 968 vvvvp.exe 86 PID 968 wrote to memory of 2728 968 vvvvp.exe 86 PID 2728 wrote to memory of 3864 2728 vpddv.exe 87 PID 2728 wrote to memory of 3864 2728 vpddv.exe 87 PID 2728 wrote to memory of 3864 2728 vpddv.exe 87 PID 3864 wrote to memory of 3216 3864 hhntbb.exe 88 PID 3864 wrote to memory of 3216 3864 hhntbb.exe 88 PID 3864 wrote to memory of 3216 3864 hhntbb.exe 88 PID 3216 wrote to memory of 1188 3216 jdjdd.exe 89 PID 3216 wrote to memory of 1188 3216 jdjdd.exe 89 PID 3216 wrote to memory of 1188 3216 jdjdd.exe 89 PID 1188 wrote to memory of 2272 1188 pvvvv.exe 90 PID 1188 wrote to memory of 2272 1188 pvvvv.exe 90 PID 1188 wrote to memory of 2272 1188 pvvvv.exe 90 PID 2272 wrote to memory of 4988 2272 pvjpv.exe 91 PID 2272 wrote to memory of 4988 2272 pvjpv.exe 91 PID 2272 wrote to memory of 4988 2272 pvjpv.exe 91 PID 4988 wrote to memory of 208 4988 rrrlrrf.exe 92 PID 4988 wrote to memory of 208 4988 rrrlrrf.exe 92 PID 4988 wrote to memory of 208 4988 rrrlrrf.exe 92 PID 208 wrote to memory of 2036 208 ttbthn.exe 93 PID 208 wrote to memory of 2036 208 ttbthn.exe 93 PID 208 wrote to memory of 2036 208 ttbthn.exe 93 PID 2036 wrote to memory of 1092 2036 tthtnh.exe 94 PID 2036 wrote to memory of 1092 2036 tthtnh.exe 94 PID 2036 wrote to memory of 1092 2036 tthtnh.exe 94 PID 1092 wrote to memory of 4500 1092 xrxrllf.exe 95 PID 1092 wrote to memory of 4500 1092 xrxrllf.exe 95 PID 1092 wrote to memory of 4500 1092 xrxrllf.exe 95 PID 4500 wrote to memory of 3888 4500 pdpjd.exe 96 PID 4500 wrote to memory of 3888 4500 pdpjd.exe 96 PID 4500 wrote to memory of 3888 4500 pdpjd.exe 96 PID 3888 wrote to memory of 4976 3888 7xrrrxr.exe 97 PID 3888 wrote to memory of 4976 3888 7xrrrxr.exe 97 PID 3888 wrote to memory of 4976 3888 7xrrrxr.exe 97 PID 4976 wrote to memory of 3036 4976 ttbbbb.exe 98 PID 4976 wrote to memory of 3036 4976 ttbbbb.exe 98 PID 4976 wrote to memory of 3036 4976 ttbbbb.exe 98 PID 3036 wrote to memory of 3156 3036 vppdv.exe 99 PID 3036 wrote to memory of 3156 3036 vppdv.exe 99 PID 3036 wrote to memory of 3156 3036 vppdv.exe 99 PID 3156 wrote to memory of 4984 3156 lxffxxx.exe 100 PID 3156 wrote to memory of 4984 3156 lxffxxx.exe 100 PID 3156 wrote to memory of 4984 3156 lxffxxx.exe 100 PID 4984 wrote to memory of 3312 4984 htbbbb.exe 101 PID 4984 wrote to memory of 3312 4984 htbbbb.exe 101 PID 4984 wrote to memory of 3312 4984 htbbbb.exe 101 PID 3312 wrote to memory of 2064 3312 jpddp.exe 102 PID 3312 wrote to memory of 2064 3312 jpddp.exe 102 PID 3312 wrote to memory of 2064 3312 jpddp.exe 102 PID 2064 wrote to memory of 3192 2064 rflffff.exe 103 PID 2064 wrote to memory of 3192 2064 rflffff.exe 103 PID 2064 wrote to memory of 3192 2064 rflffff.exe 103 PID 3192 wrote to memory of 4316 3192 nbhbbt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe"C:\Users\Admin\AppData\Local\Temp\aeca2e05f234db7d199493fc3e1d03ddcc65039870ddff25f15f54e382b25c6fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\jjvpp.exec:\jjvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\bbnhhb.exec:\bbnhhb.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\vvvvp.exec:\vvvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\vpddv.exec:\vpddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hhntbb.exec:\hhntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\jdjdd.exec:\jdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\pvvvv.exec:\pvvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\pvjpv.exec:\pvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rrrlrrf.exec:\rrrlrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\ttbthn.exec:\ttbthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\tthtnh.exec:\tthtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xrxrllf.exec:\xrxrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\pdpjd.exec:\pdpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\7xrrrxr.exec:\7xrrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\ttbbbb.exec:\ttbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vppdv.exec:\vppdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lxffxxx.exec:\lxffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\htbbbb.exec:\htbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\jpddp.exec:\jpddp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\rflffff.exec:\rflffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nbhbbt.exec:\nbhbbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\pjjdd.exec:\pjjdd.exe23⤵
- Executes dropped EXE
PID:4316 -
\??\c:\xxffrrl.exec:\xxffrrl.exe24⤵
- Executes dropped EXE
PID:4964 -
\??\c:\1rrlfff.exec:\1rrlfff.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bbnnnb.exec:\bbnnnb.exe26⤵
- Executes dropped EXE
PID:4012 -
\??\c:\hhtnnn.exec:\hhtnnn.exe27⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdjdv.exec:\pdjdv.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\htbbtt.exec:\htbbtt.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\tbhnnn.exec:\tbhnnn.exe30⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ppvvj.exec:\ppvvj.exe31⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrlxrll.exec:\rrlxrll.exe32⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nhnhhb.exec:\nhnhhb.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxfxxll.exec:\xxfxxll.exe34⤵
- Executes dropped EXE
PID:3648 -
\??\c:\tbnnhn.exec:\tbnnhn.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\vvvjv.exec:\vvvjv.exe36⤵
- Executes dropped EXE
PID:1268 -
\??\c:\rxxfxxr.exec:\rxxfxxr.exe37⤵
- Executes dropped EXE
PID:1660 -
\??\c:\htttnn.exec:\htttnn.exe38⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7jdpj.exec:\7jdpj.exe39⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fxxxllf.exec:\fxxxllf.exe40⤵
- Executes dropped EXE
PID:3636 -
\??\c:\bbhbhn.exec:\bbhbhn.exe41⤵PID:1436
-
\??\c:\djpjj.exec:\djpjj.exe42⤵
- Executes dropped EXE
PID:4640 -
\??\c:\lxlflfx.exec:\lxlflfx.exe43⤵
- Executes dropped EXE
PID:816 -
\??\c:\rxlxxxr.exec:\rxlxxxr.exe44⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bnhnnh.exec:\bnhnnh.exe45⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vpppj.exec:\vpppj.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\rffxllf.exec:\rffxllf.exe47⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nbnttn.exec:\nbnttn.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\pdddd.exec:\pdddd.exe49⤵
- Executes dropped EXE
PID:2656 -
\??\c:\dvjdp.exec:\dvjdp.exe50⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rllfrxr.exec:\rllfrxr.exe51⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1hnttb.exec:\1hnttb.exe52⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvjdd.exec:\vvjdd.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jpdvj.exec:\jpdvj.exe54⤵
- Executes dropped EXE
PID:1544 -
\??\c:\lfrlllx.exec:\lfrlllx.exe55⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nbnhbh.exec:\nbnhbh.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djppj.exec:\djppj.exe57⤵
- Executes dropped EXE
PID:1492 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe58⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tbhhnn.exec:\tbhhnn.exe60⤵
- Executes dropped EXE
PID:4988 -
\??\c:\5bbttb.exec:\5bbttb.exe61⤵
- Executes dropped EXE
PID:640 -
\??\c:\1vdvp.exec:\1vdvp.exe62⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9llfrfx.exec:\9llfrfx.exe63⤵
- Executes dropped EXE
PID:3980 -
\??\c:\btnhbb.exec:\btnhbb.exe64⤵
- Executes dropped EXE
PID:232 -
\??\c:\bnbtnh.exec:\bnbtnh.exe65⤵
- Executes dropped EXE
PID:1464 -
\??\c:\jdpjj.exec:\jdpjj.exe66⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lflxfxl.exec:\lflxfxl.exe67⤵PID:4500
-
\??\c:\tnbbht.exec:\tnbbht.exe68⤵PID:1132
-
\??\c:\btbthh.exec:\btbthh.exe69⤵PID:1340
-
\??\c:\jdvvp.exec:\jdvvp.exe70⤵PID:3004
-
\??\c:\3fxrxxf.exec:\3fxrxxf.exe71⤵PID:3064
-
\??\c:\frrrlll.exec:\frrrlll.exe72⤵PID:868
-
\??\c:\3nhbbt.exec:\3nhbbt.exe73⤵PID:3376
-
\??\c:\pdpjd.exec:\pdpjd.exe74⤵PID:4984
-
\??\c:\rrxrllx.exec:\rrxrllx.exe75⤵PID:4008
-
\??\c:\nbnnnn.exec:\nbnnnn.exe76⤵PID:1304
-
\??\c:\5jvpp.exec:\5jvpp.exe77⤵PID:1456
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe78⤵PID:3192
-
\??\c:\thhbhn.exec:\thhbhn.exe79⤵PID:4064
-
\??\c:\pjvpd.exec:\pjvpd.exe80⤵PID:2876
-
\??\c:\pvjdv.exec:\pvjdv.exe81⤵PID:3600
-
\??\c:\9fxrllf.exec:\9fxrllf.exe82⤵PID:4908
-
\??\c:\nbnhbt.exec:\nbnhbt.exe83⤵PID:748
-
\??\c:\djppp.exec:\djppp.exe84⤵PID:916
-
\??\c:\jpvjv.exec:\jpvjv.exe85⤵PID:4580
-
\??\c:\7llfxxr.exec:\7llfxxr.exe86⤵PID:3432
-
\??\c:\bbnbtt.exec:\bbnbtt.exe87⤵PID:4140
-
\??\c:\1tbtnn.exec:\1tbtnn.exe88⤵PID:1600
-
\??\c:\jvvjv.exec:\jvvjv.exe89⤵PID:2924
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe90⤵PID:956
-
\??\c:\hbhnhh.exec:\hbhnhh.exe91⤵PID:2236
-
\??\c:\bttnhb.exec:\bttnhb.exe92⤵PID:3540
-
\??\c:\dddjd.exec:\dddjd.exe93⤵PID:3056
-
\??\c:\xflxllf.exec:\xflxllf.exe94⤵PID:2716
-
\??\c:\tntnbb.exec:\tntnbb.exe95⤵PID:2436
-
\??\c:\nntnbb.exec:\nntnbb.exe96⤵PID:2996
-
\??\c:\vpvpj.exec:\vpvpj.exe97⤵PID:216
-
\??\c:\xrrllrl.exec:\xrrllrl.exe98⤵PID:2052
-
\??\c:\btbbhb.exec:\btbbhb.exe99⤵PID:2012
-
\??\c:\thnhtn.exec:\thnhtn.exe100⤵PID:1960
-
\??\c:\jvdvv.exec:\jvdvv.exe101⤵PID:3636
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe102⤵PID:1144
-
\??\c:\ttbtnh.exec:\ttbtnh.exe103⤵PID:4020
-
\??\c:\5nnnhh.exec:\5nnnhh.exe104⤵PID:4256
-
\??\c:\vpvpj.exec:\vpvpj.exe105⤵PID:4348
-
\??\c:\1lfxllf.exec:\1lfxllf.exe106⤵PID:2112
-
\??\c:\9nnbtt.exec:\9nnbtt.exe107⤵PID:2220
-
\??\c:\vppvd.exec:\vppvd.exe108⤵PID:4656
-
\??\c:\pvdvj.exec:\pvdvj.exe109⤵PID:968
-
\??\c:\xxffffl.exec:\xxffffl.exe110⤵PID:1916
-
\??\c:\hbnhhh.exec:\hbnhhh.exe111⤵PID:1548
-
\??\c:\pvdvj.exec:\pvdvj.exe112⤵PID:1764
-
\??\c:\dvjjd.exec:\dvjjd.exe113⤵PID:4620
-
\??\c:\rlxrrlf.exec:\rlxrrlf.exe114⤵PID:1568
-
\??\c:\nnbntn.exec:\nnbntn.exe115⤵PID:3104
-
\??\c:\3djdp.exec:\3djdp.exe116⤵PID:4824
-
\??\c:\rflfxrr.exec:\rflfxrr.exe117⤵PID:2540
-
\??\c:\frrrxxx.exec:\frrrxxx.exe118⤵PID:4912
-
\??\c:\nbnnhh.exec:\nbnnhh.exe119⤵PID:4880
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:2380
-
\??\c:\llrllfl.exec:\llrllfl.exe121⤵PID:5056
-
\??\c:\htttnn.exec:\htttnn.exe122⤵PID:1088
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-