Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 10:14
Static task
static1
Behavioral task
behavioral1
Sample
6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe
Resource
win7-20241023-en
General
-
Target
6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe
-
Size
454KB
-
MD5
705567e6aa7306460b090858e476aa7b
-
SHA1
37e87315917bc10ab673fe1a864fec0fe1388e68
-
SHA256
6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65
-
SHA512
f1614497294a5a348ea66ea4e191077bbbb99cbe6050f7e77da59b5d26c7380dce42c1975f6022039f978a6a2adf8f1c4f222d849a96eee40f371d0aa774363d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2412-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1848-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3152-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3260-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4908-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2776-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1864-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1336-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2664-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5076-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2196-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/916-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4952-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/896-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3556-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-826-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-1627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3184 rrfxxrr.exe 4052 frxxfxl.exe 640 pddjj.exe 2164 pvpvv.exe 2368 thbbbb.exe 1204 rxffllr.exe 1848 ppvvv.exe 2036 tbtbbn.exe 2844 jppvj.exe 4764 3lrrrxf.exe 3356 tntnnt.exe 3040 pjvvd.exe 4148 rlrllrx.exe 2812 7hhhtb.exe 3152 flrlffr.exe 2224 thntbn.exe 4360 vdjdd.exe 3044 rxrrxxf.exe 4892 vvjjj.exe 4984 lflfxxr.exe 3556 fllfxrl.exe 2260 vjvvv.exe 3424 tttbtn.exe 4988 fflfxxr.exe 3012 9hnnhn.exe 3260 jvjjd.exe 1608 tbtnht.exe 1008 rfffffl.exe 3280 hntnhn.exe 4668 nththn.exe 2452 xlrllll.exe 4908 nbbbbb.exe 4556 fffllll.exe 3108 pvjjj.exe 3900 frlxlll.exe 656 ddvvv.exe 4648 xflllrr.exe 2948 tbttbh.exe 2088 pjpvv.exe 2776 ddvpp.exe 1924 btnbbb.exe 4100 hnhhtt.exe 1864 1rfflrx.exe 4356 1lrfflr.exe 452 bbhhhn.exe 3412 pjppv.exe 412 7lllrxx.exe 2432 tnttnt.exe 4512 1hnnnb.exe 4780 vjdvv.exe 1568 lflllrr.exe 3400 ntbbtb.exe 1336 jpppd.exe 2664 xfrrxlr.exe 1176 hhhnnt.exe 3144 djppj.exe 2744 lxrxxfl.exe 5076 ntbnnb.exe 1576 1thnnt.exe 1000 vjjjj.exe 3964 rxlrflr.exe 1592 3hbtbh.exe 4128 vdvjj.exe 4684 pjppj.exe -
resource yara_rule behavioral2/memory/2412-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1848-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3152-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3260-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4908-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2776-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1864-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1336-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2664-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5076-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2196-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/916-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4952-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/896-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3556-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-798-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 3184 2412 6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe 83 PID 2412 wrote to memory of 3184 2412 6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe 83 PID 2412 wrote to memory of 3184 2412 6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe 83 PID 3184 wrote to memory of 4052 3184 rrfxxrr.exe 84 PID 3184 wrote to memory of 4052 3184 rrfxxrr.exe 84 PID 3184 wrote to memory of 4052 3184 rrfxxrr.exe 84 PID 4052 wrote to memory of 640 4052 frxxfxl.exe 85 PID 4052 wrote to memory of 640 4052 frxxfxl.exe 85 PID 4052 wrote to memory of 640 4052 frxxfxl.exe 85 PID 640 wrote to memory of 2164 640 pddjj.exe 86 PID 640 wrote to memory of 2164 640 pddjj.exe 86 PID 640 wrote to memory of 2164 640 pddjj.exe 86 PID 2164 wrote to memory of 2368 2164 pvpvv.exe 87 PID 2164 wrote to memory of 2368 2164 pvpvv.exe 87 PID 2164 wrote to memory of 2368 2164 pvpvv.exe 87 PID 2368 wrote to memory of 1204 2368 thbbbb.exe 88 PID 2368 wrote to memory of 1204 2368 thbbbb.exe 88 PID 2368 wrote to memory of 1204 2368 thbbbb.exe 88 PID 1204 wrote to memory of 1848 1204 rxffllr.exe 89 PID 1204 wrote to memory of 1848 1204 rxffllr.exe 89 PID 1204 wrote to memory of 1848 1204 rxffllr.exe 89 PID 1848 wrote to memory of 2036 1848 ppvvv.exe 90 PID 1848 wrote to memory of 2036 1848 ppvvv.exe 90 PID 1848 wrote to memory of 2036 1848 ppvvv.exe 90 PID 2036 wrote to memory of 2844 2036 tbtbbn.exe 91 PID 2036 wrote to memory of 2844 2036 tbtbbn.exe 91 PID 2036 wrote to memory of 2844 2036 tbtbbn.exe 91 PID 2844 wrote to memory of 4764 2844 jppvj.exe 92 PID 2844 wrote to memory of 4764 2844 jppvj.exe 92 PID 2844 wrote to memory of 4764 2844 jppvj.exe 92 PID 4764 wrote to memory of 3356 4764 3lrrrxf.exe 93 PID 4764 wrote to memory of 3356 4764 3lrrrxf.exe 93 PID 4764 wrote to memory of 3356 4764 3lrrrxf.exe 93 PID 3356 wrote to memory of 3040 3356 tntnnt.exe 94 PID 3356 wrote to memory of 3040 3356 tntnnt.exe 94 PID 3356 wrote to memory of 3040 3356 tntnnt.exe 94 PID 3040 wrote to memory of 4148 3040 pjvvd.exe 95 PID 3040 wrote to memory of 4148 3040 pjvvd.exe 95 PID 3040 wrote to memory of 4148 3040 pjvvd.exe 95 PID 4148 wrote to memory of 2812 4148 rlrllrx.exe 96 PID 4148 wrote to memory of 2812 4148 rlrllrx.exe 96 PID 4148 wrote to memory of 2812 4148 rlrllrx.exe 96 PID 2812 wrote to memory of 3152 2812 7hhhtb.exe 97 PID 2812 wrote to memory of 3152 2812 7hhhtb.exe 97 PID 2812 wrote to memory of 3152 2812 7hhhtb.exe 97 PID 3152 wrote to memory of 2224 3152 flrlffr.exe 98 PID 3152 wrote to memory of 2224 3152 flrlffr.exe 98 PID 3152 wrote to memory of 2224 3152 flrlffr.exe 98 PID 2224 wrote to memory of 4360 2224 thntbn.exe 99 PID 2224 wrote to memory of 4360 2224 thntbn.exe 99 PID 2224 wrote to memory of 4360 2224 thntbn.exe 99 PID 4360 wrote to memory of 3044 4360 vdjdd.exe 100 PID 4360 wrote to memory of 3044 4360 vdjdd.exe 100 PID 4360 wrote to memory of 3044 4360 vdjdd.exe 100 PID 3044 wrote to memory of 4892 3044 rxrrxxf.exe 101 PID 3044 wrote to memory of 4892 3044 rxrrxxf.exe 101 PID 3044 wrote to memory of 4892 3044 rxrrxxf.exe 101 PID 4892 wrote to memory of 4984 4892 vvjjj.exe 102 PID 4892 wrote to memory of 4984 4892 vvjjj.exe 102 PID 4892 wrote to memory of 4984 4892 vvjjj.exe 102 PID 4984 wrote to memory of 3556 4984 lflfxxr.exe 103 PID 4984 wrote to memory of 3556 4984 lflfxxr.exe 103 PID 4984 wrote to memory of 3556 4984 lflfxxr.exe 103 PID 3556 wrote to memory of 2260 3556 fllfxrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe"C:\Users\Admin\AppData\Local\Temp\6502227cb4f9cf3f669e3f9e2096808603ba910e4beb67e0c737a3fa40571d65.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rrfxxrr.exec:\rrfxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\frxxfxl.exec:\frxxfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\pddjj.exec:\pddjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\pvpvv.exec:\pvpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\thbbbb.exec:\thbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\rxffllr.exec:\rxffllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\ppvvv.exec:\ppvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\tbtbbn.exec:\tbtbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\jppvj.exec:\jppvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\3lrrrxf.exec:\3lrrrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\tntnnt.exec:\tntnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\pjvvd.exec:\pjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rlrllrx.exec:\rlrllrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\7hhhtb.exec:\7hhhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\flrlffr.exec:\flrlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\thntbn.exec:\thntbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vdjdd.exec:\vdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\rxrrxxf.exec:\rxrrxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vvjjj.exec:\vvjjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lflfxxr.exec:\lflfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fllfxrl.exec:\fllfxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\vjvvv.exec:\vjvvv.exe23⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tttbtn.exec:\tttbtn.exe24⤵
- Executes dropped EXE
PID:3424 -
\??\c:\fflfxxr.exec:\fflfxxr.exe25⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9hnnhn.exec:\9hnnhn.exe26⤵
- Executes dropped EXE
PID:3012 -
\??\c:\jvjjd.exec:\jvjjd.exe27⤵
- Executes dropped EXE
PID:3260 -
\??\c:\tbtnht.exec:\tbtnht.exe28⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rfffffl.exec:\rfffffl.exe29⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hntnhn.exec:\hntnhn.exe30⤵
- Executes dropped EXE
PID:3280 -
\??\c:\nththn.exec:\nththn.exe31⤵
- Executes dropped EXE
PID:4668 -
\??\c:\xlrllll.exec:\xlrllll.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nbbbbb.exec:\nbbbbb.exe33⤵
- Executes dropped EXE
PID:4908 -
\??\c:\fffllll.exec:\fffllll.exe34⤵
- Executes dropped EXE
PID:4556 -
\??\c:\pvjjj.exec:\pvjjj.exe35⤵
- Executes dropped EXE
PID:3108 -
\??\c:\frlxlll.exec:\frlxlll.exe36⤵
- Executes dropped EXE
PID:3900 -
\??\c:\ddvvv.exec:\ddvvv.exe37⤵
- Executes dropped EXE
PID:656 -
\??\c:\xflllrr.exec:\xflllrr.exe38⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tbttbh.exec:\tbttbh.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pjpvv.exec:\pjpvv.exe40⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddvpp.exec:\ddvpp.exe41⤵
- Executes dropped EXE
PID:2776 -
\??\c:\btnbbb.exec:\btnbbb.exe42⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hnhhtt.exec:\hnhhtt.exe43⤵
- Executes dropped EXE
PID:4100 -
\??\c:\1rfflrx.exec:\1rfflrx.exe44⤵
- Executes dropped EXE
PID:1864 -
\??\c:\1lrfflr.exec:\1lrfflr.exe45⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bbhhhn.exec:\bbhhhn.exe46⤵
- Executes dropped EXE
PID:452 -
\??\c:\pjppv.exec:\pjppv.exe47⤵
- Executes dropped EXE
PID:3412 -
\??\c:\7lllrxx.exec:\7lllrxx.exe48⤵
- Executes dropped EXE
PID:412 -
\??\c:\tnttnt.exec:\tnttnt.exe49⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1hnnnb.exec:\1hnnnb.exe50⤵
- Executes dropped EXE
PID:4512 -
\??\c:\vjdvv.exec:\vjdvv.exe51⤵
- Executes dropped EXE
PID:4780 -
\??\c:\lflllrr.exec:\lflllrr.exe52⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ntbbtb.exec:\ntbbtb.exe53⤵
- Executes dropped EXE
PID:3400 -
\??\c:\jpppd.exec:\jpppd.exe54⤵
- Executes dropped EXE
PID:1336 -
\??\c:\xfrrxlr.exec:\xfrrxlr.exe55⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hhhnnt.exec:\hhhnnt.exe56⤵
- Executes dropped EXE
PID:1176 -
\??\c:\djppj.exec:\djppj.exe57⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lxrxxfl.exec:\lxrxxfl.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ntbnnb.exec:\ntbnnb.exe59⤵
- Executes dropped EXE
PID:5076 -
\??\c:\1thnnt.exec:\1thnnt.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vjjjj.exec:\vjjjj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1000 -
\??\c:\rxlrflr.exec:\rxlrflr.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\3hbtbh.exec:\3hbtbh.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vdvjj.exec:\vdvjj.exe64⤵
- Executes dropped EXE
PID:4128 -
\??\c:\pjppj.exec:\pjppj.exe65⤵
- Executes dropped EXE
PID:4684 -
\??\c:\xxfrxfl.exec:\xxfrxfl.exe66⤵PID:3308
-
\??\c:\rxfrrll.exec:\rxfrrll.exe67⤵PID:4224
-
\??\c:\bnhtth.exec:\bnhtth.exe68⤵PID:4336
-
\??\c:\ppppp.exec:\ppppp.exe69⤵PID:2820
-
\??\c:\xlxxxfx.exec:\xlxxxfx.exe70⤵PID:2232
-
\??\c:\tbnbnb.exec:\tbnbnb.exe71⤵PID:5084
-
\??\c:\ppvjj.exec:\ppvjj.exe72⤵PID:4804
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe73⤵PID:4692
-
\??\c:\3hhbtb.exec:\3hhbtb.exe74⤵PID:3520
-
\??\c:\vjjdd.exec:\vjjdd.exe75⤵PID:4592
-
\??\c:\lrlxfff.exec:\lrlxfff.exe76⤵PID:2828
-
\??\c:\rxxxxll.exec:\rxxxxll.exe77⤵PID:4792
-
\??\c:\nttnnn.exec:\nttnnn.exe78⤵PID:3408
-
\??\c:\jjjjj.exec:\jjjjj.exe79⤵PID:4984
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe80⤵PID:4248
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe81⤵PID:4900
-
\??\c:\9vvvd.exec:\9vvvd.exe82⤵PID:2196
-
\??\c:\1xrlllf.exec:\1xrlllf.exe83⤵PID:2920
-
\??\c:\nnnhhh.exec:\nnnhhh.exe84⤵PID:948
-
\??\c:\5htnnb.exec:\5htnnb.exe85⤵PID:916
-
\??\c:\vvvpv.exec:\vvvpv.exe86⤵PID:392
-
\??\c:\lxlfffx.exec:\lxlfffx.exe87⤵PID:1292
-
\??\c:\7nhhtn.exec:\7nhhtn.exe88⤵PID:4600
-
\??\c:\hbhtnt.exec:\hbhtnt.exe89⤵PID:2716
-
\??\c:\jjjjj.exec:\jjjjj.exe90⤵PID:844
-
\??\c:\fffxrxr.exec:\fffxrxr.exe91⤵PID:4384
-
\??\c:\1nnhnn.exec:\1nnhnn.exe92⤵PID:1440
-
\??\c:\1vvvd.exec:\1vvvd.exe93⤵PID:2024
-
\??\c:\dpvpp.exec:\dpvpp.exe94⤵PID:4824
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe95⤵PID:2968
-
\??\c:\5hbbbh.exec:\5hbbbh.exe96⤵PID:3664
-
\??\c:\vpdvp.exec:\vpdvp.exe97⤵PID:100
-
\??\c:\fffffff.exec:\fffffff.exe98⤵PID:3568
-
\??\c:\flrrrrr.exec:\flrrrrr.exe99⤵PID:656
-
\??\c:\bthbbb.exec:\bthbbb.exe100⤵PID:2244
-
\??\c:\pjppj.exec:\pjppj.exe101⤵PID:2948
-
\??\c:\fllxxrx.exec:\fllxxrx.exe102⤵PID:3708
-
\??\c:\tnnnnt.exec:\tnnnnt.exe103⤵PID:3448
-
\??\c:\vvjjv.exec:\vvjjv.exe104⤵PID:1420
-
\??\c:\djdjp.exec:\djdjp.exe105⤵PID:464
-
\??\c:\lrflxxx.exec:\lrflxxx.exe106⤵PID:2336
-
\??\c:\tbnhnn.exec:\tbnhnn.exe107⤵PID:4132
-
\??\c:\3dppv.exec:\3dppv.exe108⤵PID:2144
-
\??\c:\rxllffr.exec:\rxllffr.exe109⤵PID:3496
-
\??\c:\ttttnt.exec:\ttttnt.exe110⤵PID:1060
-
\??\c:\jpppj.exec:\jpppj.exe111⤵PID:896
-
\??\c:\rlxxxff.exec:\rlxxxff.exe112⤵PID:3232
-
\??\c:\bbnnnt.exec:\bbnnnt.exe113⤵PID:4512
-
\??\c:\ddjjp.exec:\ddjjp.exe114⤵PID:4780
-
\??\c:\jjppj.exec:\jjppj.exe115⤵PID:3948
-
\??\c:\fllrxxx.exec:\fllrxxx.exe116⤵PID:4304
-
\??\c:\tttttt.exec:\tttttt.exe117⤵PID:4040
-
\??\c:\ddjjj.exec:\ddjjj.exe118⤵PID:640
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe119⤵PID:5096
-
\??\c:\3httnn.exec:\3httnn.exe120⤵PID:2440
-
\??\c:\jpvdj.exec:\jpvdj.exe121⤵PID:1860
-
\??\c:\1jjdv.exec:\1jjdv.exe122⤵PID:468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-