Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe
Resource
win7-20240729-en
General
-
Target
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe
-
Size
454KB
-
MD5
43c1c7cb96a737ca40e8b50b17804728
-
SHA1
f84413491b80f000495ed48944238c0eaabd9aff
-
SHA256
6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0
-
SHA512
04e4c15dc5fcad53b218b1561e2e261bd05f32a48baab99462a9b6263b938b096b693408c162d012b384c8c7b12bf5571f9a191d68e4cf477b96c1c3b56c7451
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4104-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/744-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/612-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2760-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2264-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2392-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1104-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4936-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2416-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1280-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3788-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2096-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4272-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1188-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2884-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3768-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-591-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2500-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3340-674-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5096-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-1244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 744 frrrrff.exe 2508 7jjvv.exe 612 xrffllx.exe 2760 ffxxxrr.exe 3308 vvppj.exe 2284 xrlfflr.exe 3284 7llllrr.exe 4552 jpvdd.exe 1164 5flfflr.exe 2264 hhnntb.exe 1488 hnhnnt.exe 4420 9ppvv.exe 2392 rlxxffr.exe 1104 ffxxflr.exe 2684 jpvvv.exe 920 ntbnnn.exe 4936 1vjpp.exe 4396 nhtttb.exe 2416 fffxxxx.exe 2184 pjvvv.exe 4916 vdvvv.exe 2348 thtthn.exe 5096 pddjd.exe 1532 pvjjp.exe 1320 httthn.exe 880 xxlrrxx.exe 1280 hhhhht.exe 3316 ntbthn.exe 4472 nnhbbb.exe 1528 rfxxrxx.exe 4724 nhtttt.exe 3788 thntnt.exe 3416 xfllrxx.exe 836 nhhbtb.exe 1200 rlfflrx.exe 2396 rlrrrll.exe 760 nthntb.exe 2096 jddpv.exe 1648 jjpvv.exe 3808 xxfxrlr.exe 4272 jjjpv.exe 3728 lxflflx.exe 4780 bhhnbt.exe 1868 rlrrffr.exe 3864 vdjvd.exe 1712 nnhhth.exe 4496 ppppd.exe 3496 bbnbnh.exe 3824 3pjjd.exe 1188 7tbbtt.exe 4956 pdjjj.exe 952 llllflr.exe 2884 1hhhbh.exe 2952 rflxxll.exe 1784 hbtbbb.exe 1940 7pvvv.exe 2380 9rrrlrr.exe 4952 nhnnnn.exe 3992 pvjvj.exe 3016 rxrrxfr.exe 2204 pjvdd.exe 3364 xxffxll.exe 1480 bbttbh.exe 920 jpdjd.exe -
resource yara_rule behavioral2/memory/4104-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/612-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2760-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2264-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4420-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2392-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1104-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4936-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2416-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5096-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1280-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4724-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3788-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2096-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4272-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1188-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2884-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3768-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1996-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2204-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2500-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3340-674-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4104 wrote to memory of 744 4104 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 83 PID 4104 wrote to memory of 744 4104 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 83 PID 4104 wrote to memory of 744 4104 6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe 83 PID 744 wrote to memory of 2508 744 frrrrff.exe 84 PID 744 wrote to memory of 2508 744 frrrrff.exe 84 PID 744 wrote to memory of 2508 744 frrrrff.exe 84 PID 2508 wrote to memory of 612 2508 7jjvv.exe 85 PID 2508 wrote to memory of 612 2508 7jjvv.exe 85 PID 2508 wrote to memory of 612 2508 7jjvv.exe 85 PID 612 wrote to memory of 2760 612 xrffllx.exe 86 PID 612 wrote to memory of 2760 612 xrffllx.exe 86 PID 612 wrote to memory of 2760 612 xrffllx.exe 86 PID 2760 wrote to memory of 3308 2760 ffxxxrr.exe 87 PID 2760 wrote to memory of 3308 2760 ffxxxrr.exe 87 PID 2760 wrote to memory of 3308 2760 ffxxxrr.exe 87 PID 3308 wrote to memory of 2284 3308 vvppj.exe 88 PID 3308 wrote to memory of 2284 3308 vvppj.exe 88 PID 3308 wrote to memory of 2284 3308 vvppj.exe 88 PID 2284 wrote to memory of 3284 2284 xrlfflr.exe 89 PID 2284 wrote to memory of 3284 2284 xrlfflr.exe 89 PID 2284 wrote to memory of 3284 2284 xrlfflr.exe 89 PID 3284 wrote to memory of 4552 3284 7llllrr.exe 90 PID 3284 wrote to memory of 4552 3284 7llllrr.exe 90 PID 3284 wrote to memory of 4552 3284 7llllrr.exe 90 PID 4552 wrote to memory of 1164 4552 jpvdd.exe 91 PID 4552 wrote to memory of 1164 4552 jpvdd.exe 91 PID 4552 wrote to memory of 1164 4552 jpvdd.exe 91 PID 1164 wrote to memory of 2264 1164 5flfflr.exe 92 PID 1164 wrote to memory of 2264 1164 5flfflr.exe 92 PID 1164 wrote to memory of 2264 1164 5flfflr.exe 92 PID 2264 wrote to memory of 1488 2264 hhnntb.exe 93 PID 2264 wrote to memory of 1488 2264 hhnntb.exe 93 PID 2264 wrote to memory of 1488 2264 hhnntb.exe 93 PID 1488 wrote to memory of 4420 1488 hnhnnt.exe 94 PID 1488 wrote to memory of 4420 1488 hnhnnt.exe 94 PID 1488 wrote to memory of 4420 1488 hnhnnt.exe 94 PID 4420 wrote to memory of 2392 4420 9ppvv.exe 95 PID 4420 wrote to memory of 2392 4420 9ppvv.exe 95 PID 4420 wrote to memory of 2392 4420 9ppvv.exe 95 PID 2392 wrote to memory of 1104 2392 rlxxffr.exe 96 PID 2392 wrote to memory of 1104 2392 rlxxffr.exe 96 PID 2392 wrote to memory of 1104 2392 rlxxffr.exe 96 PID 1104 wrote to memory of 2684 1104 ffxxflr.exe 97 PID 1104 wrote to memory of 2684 1104 ffxxflr.exe 97 PID 1104 wrote to memory of 2684 1104 ffxxflr.exe 97 PID 2684 wrote to memory of 920 2684 jpvvv.exe 98 PID 2684 wrote to memory of 920 2684 jpvvv.exe 98 PID 2684 wrote to memory of 920 2684 jpvvv.exe 98 PID 920 wrote to memory of 4936 920 ntbnnn.exe 99 PID 920 wrote to memory of 4936 920 ntbnnn.exe 99 PID 920 wrote to memory of 4936 920 ntbnnn.exe 99 PID 4936 wrote to memory of 4396 4936 1vjpp.exe 100 PID 4936 wrote to memory of 4396 4936 1vjpp.exe 100 PID 4936 wrote to memory of 4396 4936 1vjpp.exe 100 PID 4396 wrote to memory of 2416 4396 nhtttb.exe 101 PID 4396 wrote to memory of 2416 4396 nhtttb.exe 101 PID 4396 wrote to memory of 2416 4396 nhtttb.exe 101 PID 2416 wrote to memory of 2184 2416 fffxxxx.exe 102 PID 2416 wrote to memory of 2184 2416 fffxxxx.exe 102 PID 2416 wrote to memory of 2184 2416 fffxxxx.exe 102 PID 2184 wrote to memory of 4916 2184 pjvvv.exe 103 PID 2184 wrote to memory of 4916 2184 pjvvv.exe 103 PID 2184 wrote to memory of 4916 2184 pjvvv.exe 103 PID 4916 wrote to memory of 2348 4916 vdvvv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe"C:\Users\Admin\AppData\Local\Temp\6afddd7fd533b2b6d7f7d21d42b326d94a3f53508010b0058d613ddadcf3f1a0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\frrrrff.exec:\frrrrff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\7jjvv.exec:\7jjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xrffllx.exec:\xrffllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\ffxxxrr.exec:\ffxxxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\vvppj.exec:\vvppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\xrlfflr.exec:\xrlfflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\7llllrr.exec:\7llllrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\jpvdd.exec:\jpvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\5flfflr.exec:\5flfflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\hhnntb.exec:\hhnntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\hnhnnt.exec:\hnhnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\9ppvv.exec:\9ppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\rlxxffr.exec:\rlxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ffxxflr.exec:\ffxxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\jpvvv.exec:\jpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ntbnnn.exec:\ntbnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\1vjpp.exec:\1vjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\nhtttb.exec:\nhtttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\fffxxxx.exec:\fffxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjvvv.exec:\pjvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vdvvv.exec:\vdvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\thtthn.exec:\thtthn.exe23⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pddjd.exec:\pddjd.exe24⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pvjjp.exec:\pvjjp.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\httthn.exec:\httthn.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe27⤵
- Executes dropped EXE
PID:880 -
\??\c:\hhhhht.exec:\hhhhht.exe28⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ntbthn.exec:\ntbthn.exe29⤵
- Executes dropped EXE
PID:3316 -
\??\c:\nnhbbb.exec:\nnhbbb.exe30⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rfxxrxx.exec:\rfxxrxx.exe31⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhtttt.exec:\nhtttt.exe32⤵
- Executes dropped EXE
PID:4724 -
\??\c:\thntnt.exec:\thntnt.exe33⤵
- Executes dropped EXE
PID:3788 -
\??\c:\xfllrxx.exec:\xfllrxx.exe34⤵
- Executes dropped EXE
PID:3416 -
\??\c:\nhhbtb.exec:\nhhbtb.exe35⤵
- Executes dropped EXE
PID:836 -
\??\c:\rlfflrx.exec:\rlfflrx.exe36⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlrrrll.exec:\rlrrrll.exe37⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nthntb.exec:\nthntb.exe38⤵
- Executes dropped EXE
PID:760 -
\??\c:\jddpv.exec:\jddpv.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\7rrrrxf.exec:\7rrrrxf.exe40⤵PID:4964
-
\??\c:\jjpvv.exec:\jjpvv.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxfxrlr.exec:\xxfxrlr.exe42⤵
- Executes dropped EXE
PID:3808 -
\??\c:\jjjpv.exec:\jjjpv.exe43⤵
- Executes dropped EXE
PID:4272 -
\??\c:\lxflflx.exec:\lxflflx.exe44⤵
- Executes dropped EXE
PID:3728 -
\??\c:\bhhnbt.exec:\bhhnbt.exe45⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rlrrffr.exec:\rlrrffr.exe46⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vdjvd.exec:\vdjvd.exe47⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nnhhth.exec:\nnhhth.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ppppd.exec:\ppppd.exe49⤵
- Executes dropped EXE
PID:4496 -
\??\c:\bbnbnh.exec:\bbnbnh.exe50⤵
- Executes dropped EXE
PID:3496 -
\??\c:\3pjjd.exec:\3pjjd.exe51⤵
- Executes dropped EXE
PID:3824 -
\??\c:\7tbbtt.exec:\7tbbtt.exe52⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pdjjj.exec:\pdjjj.exe53⤵
- Executes dropped EXE
PID:4956 -
\??\c:\llllflr.exec:\llllflr.exe54⤵
- Executes dropped EXE
PID:952 -
\??\c:\1hhhbh.exec:\1hhhbh.exe55⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rflxxll.exec:\rflxxll.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hbtbbb.exec:\hbtbbb.exe57⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7pvvv.exec:\7pvvv.exe58⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9rrrlrr.exec:\9rrrlrr.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nhnnnn.exec:\nhnnnn.exe60⤵
- Executes dropped EXE
PID:4952 -
\??\c:\pvjvj.exec:\pvjvj.exe61⤵
- Executes dropped EXE
PID:3992 -
\??\c:\rxrrxfr.exec:\rxrrxfr.exe62⤵
- Executes dropped EXE
PID:3016 -
\??\c:\pjvdd.exec:\pjvdd.exe63⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xxffxll.exec:\xxffxll.exe64⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bbttbh.exec:\bbttbh.exe65⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jpdjd.exec:\jpdjd.exe66⤵
- Executes dropped EXE
PID:920 -
\??\c:\lllfffl.exec:\lllfffl.exe67⤵PID:4540
-
\??\c:\hntbbh.exec:\hntbbh.exe68⤵PID:948
-
\??\c:\7dppp.exec:\7dppp.exe69⤵PID:4488
-
\??\c:\xxfxrxr.exec:\xxfxrxr.exe70⤵PID:644
-
\??\c:\nttnnh.exec:\nttnnh.exe71⤵PID:2416
-
\??\c:\1vdjp.exec:\1vdjp.exe72⤵PID:3768
-
\??\c:\flxxrxx.exec:\flxxrxx.exe73⤵PID:4016
-
\??\c:\nhtnnt.exec:\nhtnnt.exe74⤵PID:4032
-
\??\c:\ppjdd.exec:\ppjdd.exe75⤵PID:5072
-
\??\c:\lxffrxr.exec:\lxffrxr.exe76⤵PID:4152
-
\??\c:\5thhtb.exec:\5thhtb.exe77⤵PID:1072
-
\??\c:\djjdd.exec:\djjdd.exe78⤵PID:1996
-
\??\c:\hhnnnt.exec:\hhnnnt.exe79⤵PID:2336
-
\??\c:\ddvdj.exec:\ddvdj.exe80⤵PID:1080
-
\??\c:\ffrrxxx.exec:\ffrrxxx.exe81⤵PID:3144
-
\??\c:\ppvpv.exec:\ppvpv.exe82⤵PID:2944
-
\??\c:\rxlxfxl.exec:\rxlxfxl.exe83⤵PID:3820
-
\??\c:\nhbhbn.exec:\nhbhbn.exe84⤵PID:1424
-
\??\c:\pdddp.exec:\pdddp.exe85⤵PID:2972
-
\??\c:\rlxllll.exec:\rlxllll.exe86⤵PID:3872
-
\??\c:\nttnhb.exec:\nttnhb.exe87⤵PID:2656
-
\??\c:\pjvvd.exec:\pjvvd.exe88⤵PID:1168
-
\??\c:\xllfrfr.exec:\xllfrfr.exe89⤵PID:2544
-
\??\c:\tbbbnn.exec:\tbbbnn.exe90⤵PID:4344
-
\??\c:\jvvvv.exec:\jvvvv.exe91⤵PID:3588
-
\??\c:\llffllr.exec:\llffllr.exe92⤵PID:1764
-
\??\c:\9dddd.exec:\9dddd.exe93⤵PID:1544
-
\??\c:\xxrlfff.exec:\xxrlfff.exe94⤵PID:3232
-
\??\c:\xrflffr.exec:\xrflffr.exe95⤵PID:2540
-
\??\c:\thttbb.exec:\thttbb.exe96⤵PID:2396
-
\??\c:\7jdvp.exec:\7jdvp.exe97⤵PID:1568
-
\??\c:\5rxxxxx.exec:\5rxxxxx.exe98⤵PID:3228
-
\??\c:\lrxfffl.exec:\lrxfffl.exe99⤵PID:4316
-
\??\c:\hnbhhb.exec:\hnbhhb.exe100⤵PID:5116
-
\??\c:\3pppv.exec:\3pppv.exe101⤵PID:4964
-
\??\c:\5rffrff.exec:\5rffrff.exe102⤵PID:744
-
\??\c:\nnbhhh.exec:\nnbhhh.exe103⤵PID:4804
-
\??\c:\vpvdj.exec:\vpvdj.exe104⤵PID:3324
-
\??\c:\xfffffl.exec:\xfffffl.exe105⤵PID:3816
-
\??\c:\httnhh.exec:\httnhh.exe106⤵PID:3756
-
\??\c:\vjvvd.exec:\vjvvd.exe107⤵PID:1276
-
\??\c:\7rxrrxr.exec:\7rxrrxr.exe108⤵PID:3200
-
\??\c:\hbbttn.exec:\hbbttn.exe109⤵PID:1060
-
\??\c:\ppddv.exec:\ppddv.exe110⤵PID:3924
-
\??\c:\xxxrrxx.exec:\xxxrrxx.exe111⤵PID:4732
-
\??\c:\htnntb.exec:\htnntb.exe112⤵PID:2768
-
\??\c:\7jjjv.exec:\7jjjv.exe113⤵PID:1952
-
\??\c:\lrllllr.exec:\lrllllr.exe114⤵PID:784
-
\??\c:\9ttthb.exec:\9ttthb.exe115⤵PID:2500
-
\??\c:\pjvjd.exec:\pjvjd.exe116⤵PID:3100
-
\??\c:\7flllxx.exec:\7flllxx.exe117⤵PID:1412
-
\??\c:\thtnnt.exec:\thtnnt.exe118⤵PID:2264
-
\??\c:\vddjd.exec:\vddjd.exe119⤵PID:1936
-
\??\c:\rfrxrrr.exec:\rfrxrrr.exe120⤵PID:2644
-
\??\c:\ttbttt.exec:\ttbttt.exe121⤵PID:3760
-
\??\c:\jpdvv.exec:\jpdvv.exe122⤵
- System Location Discovery: System Language Discovery
PID:4516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-