Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:37
Behavioral task
behavioral1
Sample
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
-
Size
344KB
-
MD5
620c97e244bcfb3d324dfa549280b4c8
-
SHA1
5ce5411c88c5099db7985828a284038d3f76528b
-
SHA256
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc
-
SHA512
2fa57f9f95e77bfc1658d7ac946cc7389c1eb8729e1ece6b22d64e90b7cc4c6e09bf000f719ac743e95ae193692db918ef331d8b64fdd975c8c6bdcd168aa889
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA2:R4wFHoS3WXZshJX2VGd2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4528-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/868-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/716-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5072-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3024-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1932-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2456-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/436-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4440-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1468-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4248-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-561-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-621-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-755-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4964 btnhbb.exe 1676 vdjdp.exe 1344 frlxllf.exe 760 bbbtnh.exe 3600 tbnnhh.exe 3412 7xlffll.exe 2136 vppjj.exe 3840 lrflxlx.exe 5100 bnbbbb.exe 4260 fffffff.exe 1500 vpppv.exe 628 xfxxxll.exe 868 vvdpp.exe 716 pvvpp.exe 2012 bbhttn.exe 2596 ppvpj.exe 3596 bbthht.exe 3744 1bhhtt.exe 1968 lxxxxrl.exe 2988 hhtnbb.exe 5072 jjvvp.exe 3020 btbbtt.exe 4896 7vpvp.exe 2512 jdjdp.exe 2736 rrlfrrl.exe 2028 hhbhbt.exe 228 dpvpj.exe 3008 pvvpp.exe 4508 7xlfxfx.exe 4840 nbbtnt.exe 3464 lxfrllf.exe 5020 hhbhbn.exe 3224 pjjdj.exe 4316 pvdpd.exe 4992 nhbbtn.exe 2156 pddvv.exe 3936 rxlfxrx.exe 2552 hbhbtt.exe 404 tbhbbh.exe 3324 vjjdv.exe 3060 llxrxlr.exe 2228 rrlfrrf.exe 1952 nhbtnn.exe 840 rxffllx.exe 2056 nhnhhh.exe 1776 pvppp.exe 4332 ffflfff.exe 4340 flrrxfl.exe 4384 3nttnh.exe 2064 nntnnt.exe 2036 jppdd.exe 3280 fffxxfx.exe 2924 hthnnn.exe 3604 tbtnhh.exe 4908 jjvvd.exe 2204 lrxxlll.exe 4804 lllfxff.exe 5076 ntbbnn.exe 3024 jpvdd.exe 4280 9httnh.exe 5084 tntbtt.exe 5100 ddddv.exe 1628 dvjdj.exe 3716 frxxxxr.exe -
resource yara_rule behavioral2/memory/4528-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b38-3.dat upx behavioral2/memory/4528-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4964-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b93-9.dat upx behavioral2/files/0x000a000000023b9a-10.dat upx behavioral2/memory/1344-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1676-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9b-20.dat upx behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/760-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9c-25.dat upx behavioral2/files/0x000a000000023b9d-30.dat upx behavioral2/memory/3600-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9e-35.dat upx behavioral2/memory/3412-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023b9f-39.dat upx behavioral2/memory/2136-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba0-44.dat upx behavioral2/files/0x000a000000023ba1-48.dat upx behavioral2/memory/5100-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba3-54.dat upx behavioral2/memory/4260-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1500-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0031000000023ba4-59.dat upx behavioral2/files/0x000a000000023ba5-63.dat upx behavioral2/memory/868-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0058000000023ba6-67.dat upx behavioral2/files/0x000a000000023ba7-73.dat upx behavioral2/memory/716-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b000000023b97-77.dat upx behavioral2/files/0x000a000000023ba8-81.dat upx behavioral2/memory/3596-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023ba9-86.dat upx behavioral2/files/0x000a000000023baa-90.dat upx behavioral2/memory/3744-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bab-95.dat upx behavioral2/memory/2988-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bac-100.dat upx behavioral2/files/0x000a000000023bae-105.dat upx behavioral2/files/0x000a000000023baf-109.dat upx behavioral2/memory/4896-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb0-115.dat upx behavioral2/memory/2512-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb1-119.dat upx behavioral2/files/0x000a000000023bb2-123.dat upx behavioral2/files/0x000a000000023bb3-128.dat upx behavioral2/files/0x0058000000023ba6-131.dat upx behavioral2/memory/5072-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb4-136.dat upx behavioral2/files/0x000a000000023bb5-141.dat upx behavioral2/memory/4508-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3008-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4840-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bb6-146.dat upx behavioral2/files/0x000a000000023bb7-150.dat upx behavioral2/memory/3464-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3224-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4316-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3936-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3324-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2056-187-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4528 wrote to memory of 4964 4528 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 83 PID 4528 wrote to memory of 4964 4528 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 83 PID 4528 wrote to memory of 4964 4528 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 83 PID 4964 wrote to memory of 1676 4964 btnhbb.exe 84 PID 4964 wrote to memory of 1676 4964 btnhbb.exe 84 PID 4964 wrote to memory of 1676 4964 btnhbb.exe 84 PID 1676 wrote to memory of 1344 1676 vdjdp.exe 85 PID 1676 wrote to memory of 1344 1676 vdjdp.exe 85 PID 1676 wrote to memory of 1344 1676 vdjdp.exe 85 PID 1344 wrote to memory of 760 1344 frlxllf.exe 86 PID 1344 wrote to memory of 760 1344 frlxllf.exe 86 PID 1344 wrote to memory of 760 1344 frlxllf.exe 86 PID 760 wrote to memory of 3600 760 bbbtnh.exe 87 PID 760 wrote to memory of 3600 760 bbbtnh.exe 87 PID 760 wrote to memory of 3600 760 bbbtnh.exe 87 PID 3600 wrote to memory of 3412 3600 tbnnhh.exe 88 PID 3600 wrote to memory of 3412 3600 tbnnhh.exe 88 PID 3600 wrote to memory of 3412 3600 tbnnhh.exe 88 PID 3412 wrote to memory of 2136 3412 7xlffll.exe 89 PID 3412 wrote to memory of 2136 3412 7xlffll.exe 89 PID 3412 wrote to memory of 2136 3412 7xlffll.exe 89 PID 2136 wrote to memory of 3840 2136 vppjj.exe 90 PID 2136 wrote to memory of 3840 2136 vppjj.exe 90 PID 2136 wrote to memory of 3840 2136 vppjj.exe 90 PID 3840 wrote to memory of 5100 3840 lrflxlx.exe 91 PID 3840 wrote to memory of 5100 3840 lrflxlx.exe 91 PID 3840 wrote to memory of 5100 3840 lrflxlx.exe 91 PID 5100 wrote to memory of 4260 5100 bnbbbb.exe 92 PID 5100 wrote to memory of 4260 5100 bnbbbb.exe 92 PID 5100 wrote to memory of 4260 5100 bnbbbb.exe 92 PID 4260 wrote to memory of 1500 4260 fffffff.exe 93 PID 4260 wrote to memory of 1500 4260 fffffff.exe 93 PID 4260 wrote to memory of 1500 4260 fffffff.exe 93 PID 1500 wrote to memory of 628 1500 vpppv.exe 94 PID 1500 wrote to memory of 628 1500 vpppv.exe 94 PID 1500 wrote to memory of 628 1500 vpppv.exe 94 PID 628 wrote to memory of 868 628 xfxxxll.exe 95 PID 628 wrote to memory of 868 628 xfxxxll.exe 95 PID 628 wrote to memory of 868 628 xfxxxll.exe 95 PID 868 wrote to memory of 716 868 vvdpp.exe 96 PID 868 wrote to memory of 716 868 vvdpp.exe 96 PID 868 wrote to memory of 716 868 vvdpp.exe 96 PID 716 wrote to memory of 2012 716 pvvpp.exe 97 PID 716 wrote to memory of 2012 716 pvvpp.exe 97 PID 716 wrote to memory of 2012 716 pvvpp.exe 97 PID 2012 wrote to memory of 2596 2012 bbhttn.exe 98 PID 2012 wrote to memory of 2596 2012 bbhttn.exe 98 PID 2012 wrote to memory of 2596 2012 bbhttn.exe 98 PID 2596 wrote to memory of 3596 2596 ppvpj.exe 99 PID 2596 wrote to memory of 3596 2596 ppvpj.exe 99 PID 2596 wrote to memory of 3596 2596 ppvpj.exe 99 PID 3596 wrote to memory of 3744 3596 bbthht.exe 100 PID 3596 wrote to memory of 3744 3596 bbthht.exe 100 PID 3596 wrote to memory of 3744 3596 bbthht.exe 100 PID 3744 wrote to memory of 1968 3744 1bhhtt.exe 101 PID 3744 wrote to memory of 1968 3744 1bhhtt.exe 101 PID 3744 wrote to memory of 1968 3744 1bhhtt.exe 101 PID 1968 wrote to memory of 2988 1968 lxxxxrl.exe 102 PID 1968 wrote to memory of 2988 1968 lxxxxrl.exe 102 PID 1968 wrote to memory of 2988 1968 lxxxxrl.exe 102 PID 2988 wrote to memory of 5072 2988 hhtnbb.exe 103 PID 2988 wrote to memory of 5072 2988 hhtnbb.exe 103 PID 2988 wrote to memory of 5072 2988 hhtnbb.exe 103 PID 5072 wrote to memory of 3020 5072 jjvvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\btnhbb.exec:\btnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\vdjdp.exec:\vdjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\frlxllf.exec:\frlxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\bbbtnh.exec:\bbbtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\tbnnhh.exec:\tbnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\7xlffll.exec:\7xlffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\vppjj.exec:\vppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\lrflxlx.exec:\lrflxlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\bnbbbb.exec:\bnbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\fffffff.exec:\fffffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\vpppv.exec:\vpppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\xfxxxll.exec:\xfxxxll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\vvdpp.exec:\vvdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\pvvpp.exec:\pvvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\bbhttn.exec:\bbhttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\ppvpj.exec:\ppvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\bbthht.exec:\bbthht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\1bhhtt.exec:\1bhhtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\hhtnbb.exec:\hhtnbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjvvp.exec:\jjvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\btbbtt.exec:\btbbtt.exe23⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vpvp.exec:\7vpvp.exe24⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jdjdp.exec:\jdjdp.exe25⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrlfrrl.exec:\rrlfrrl.exe26⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hhbhbt.exec:\hhbhbt.exe27⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dpvpj.exec:\dpvpj.exe28⤵
- Executes dropped EXE
PID:228 -
\??\c:\pvvpp.exec:\pvvpp.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7xlfxfx.exec:\7xlfxfx.exe30⤵
- Executes dropped EXE
PID:4508 -
\??\c:\nbbtnt.exec:\nbbtnt.exe31⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lxfrllf.exec:\lxfrllf.exe32⤵
- Executes dropped EXE
PID:3464 -
\??\c:\hhbhbn.exec:\hhbhbn.exe33⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pjjdj.exec:\pjjdj.exe34⤵
- Executes dropped EXE
PID:3224 -
\??\c:\pvdpd.exec:\pvdpd.exe35⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nhbbtn.exec:\nhbbtn.exe36⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pddvv.exec:\pddvv.exe37⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxlfxrx.exec:\rxlfxrx.exe38⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hbhbtt.exec:\hbhbtt.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tbhbbh.exec:\tbhbbh.exe40⤵
- Executes dropped EXE
PID:404 -
\??\c:\vjjdv.exec:\vjjdv.exe41⤵
- Executes dropped EXE
PID:3324 -
\??\c:\llxrxlr.exec:\llxrxlr.exe42⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nhbtnn.exec:\nhbtnn.exe44⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rxffllx.exec:\rxffllx.exe45⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhnhhh.exec:\nhnhhh.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\pvppp.exec:\pvppp.exe47⤵
- Executes dropped EXE
PID:1776 -
\??\c:\ffflfff.exec:\ffflfff.exe48⤵
- Executes dropped EXE
PID:4332 -
\??\c:\flrrxfl.exec:\flrrxfl.exe49⤵
- Executes dropped EXE
PID:4340 -
\??\c:\3nttnh.exec:\3nttnh.exe50⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nntnnt.exec:\nntnnt.exe51⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jppdd.exec:\jppdd.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fffxxfx.exec:\fffxxfx.exe53⤵
- Executes dropped EXE
PID:3280 -
\??\c:\hthnnn.exec:\hthnnn.exe54⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tbtnhh.exec:\tbtnhh.exe55⤵
- Executes dropped EXE
PID:3604 -
\??\c:\jjvvd.exec:\jjvvd.exe56⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lrxxlll.exec:\lrxxlll.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lllfxff.exec:\lllfxff.exe58⤵
- Executes dropped EXE
PID:4804 -
\??\c:\ntbbnn.exec:\ntbbnn.exe59⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jpvdd.exec:\jpvdd.exe60⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9httnh.exec:\9httnh.exe61⤵
- Executes dropped EXE
PID:4280 -
\??\c:\tntbtt.exec:\tntbtt.exe62⤵
- Executes dropped EXE
PID:5084 -
\??\c:\ddddv.exec:\ddddv.exe63⤵
- Executes dropped EXE
PID:5100 -
\??\c:\dvjdj.exec:\dvjdj.exe64⤵
- Executes dropped EXE
PID:1628 -
\??\c:\frxxxxr.exec:\frxxxxr.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\btbttt.exec:\btbttt.exe66⤵PID:3656
-
\??\c:\vvppp.exec:\vvppp.exe67⤵PID:628
-
\??\c:\pvvvp.exec:\pvvvp.exe68⤵PID:3296
-
\??\c:\rrrrfxx.exec:\rrrrfxx.exe69⤵PID:4080
-
\??\c:\bbhhbb.exec:\bbhhbb.exe70⤵PID:1932
-
\??\c:\jpjjj.exec:\jpjjj.exe71⤵PID:232
-
\??\c:\jdddv.exec:\jdddv.exe72⤵PID:3016
-
\??\c:\llxxxxx.exec:\llxxxxx.exe73⤵PID:4752
-
\??\c:\bthbbh.exec:\bthbbh.exe74⤵PID:4092
-
\??\c:\djvpp.exec:\djvpp.exe75⤵PID:4988
-
\??\c:\lrrxrrr.exec:\lrrxrrr.exe76⤵PID:4636
-
\??\c:\xxllffx.exec:\xxllffx.exe77⤵PID:4824
-
\??\c:\tbbnhh.exec:\tbbnhh.exe78⤵PID:388
-
\??\c:\9ddvp.exec:\9ddvp.exe79⤵PID:548
-
\??\c:\rrrlllr.exec:\rrrlllr.exe80⤵PID:4352
-
\??\c:\xrrlxfl.exec:\xrrlxfl.exe81⤵PID:5108
-
\??\c:\ttbbbb.exec:\ttbbbb.exe82⤵PID:4560
-
\??\c:\vvdjp.exec:\vvdjp.exe83⤵PID:1632
-
\??\c:\pjjdp.exec:\pjjdp.exe84⤵PID:2456
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe85⤵PID:984
-
\??\c:\1tnnnn.exec:\1tnnnn.exe86⤵PID:1108
-
\??\c:\djvpd.exec:\djvpd.exe87⤵PID:4136
-
\??\c:\vvvvp.exec:\vvvvp.exe88⤵PID:3696
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe89⤵PID:2664
-
\??\c:\tttthn.exec:\tttthn.exe90⤵PID:3892
-
\??\c:\vpddd.exec:\vpddd.exe91⤵PID:1048
-
\??\c:\pdddv.exec:\pdddv.exe92⤵PID:4840
-
\??\c:\rxffffx.exec:\rxffffx.exe93⤵PID:1276
-
\??\c:\lrrrrrf.exec:\lrrrrrf.exe94⤵PID:2896
-
\??\c:\nhnnnn.exec:\nhnnnn.exe95⤵PID:4960
-
\??\c:\jjpdv.exec:\jjpdv.exe96⤵PID:436
-
\??\c:\llrrrrr.exec:\llrrrrr.exe97⤵PID:4316
-
\??\c:\nnbbbh.exec:\nnbbbh.exe98⤵PID:4668
-
\??\c:\dpjjj.exec:\dpjjj.exe99⤵PID:3668
-
\??\c:\7pvvj.exec:\7pvvj.exe100⤵PID:4440
-
\??\c:\lrrllll.exec:\lrrllll.exe101⤵PID:4712
-
\??\c:\bhtttt.exec:\bhtttt.exe102⤵PID:4404
-
\??\c:\9dddd.exec:\9dddd.exe103⤵PID:4780
-
\??\c:\llllxxl.exec:\llllxxl.exe104⤵PID:3056
-
\??\c:\llxfxxx.exec:\llxfxxx.exe105⤵PID:3792
-
\??\c:\hnhthb.exec:\hnhthb.exe106⤵PID:4144
-
\??\c:\jjjjj.exec:\jjjjj.exe107⤵PID:840
-
\??\c:\3pppd.exec:\3pppd.exe108⤵PID:2056
-
\??\c:\llrrxxx.exec:\llrrxxx.exe109⤵PID:1776
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe110⤵PID:4344
-
\??\c:\nbhhhh.exec:\nbhhhh.exe111⤵PID:4340
-
\??\c:\5jddv.exec:\5jddv.exe112⤵PID:4384
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe113⤵PID:1676
-
\??\c:\fxlllll.exec:\fxlllll.exe114⤵PID:2764
-
\??\c:\btbbtb.exec:\btbbtb.exe115⤵PID:2912
-
\??\c:\dpvvp.exec:\dpvvp.exe116⤵PID:2404
-
\??\c:\flrrlrr.exec:\flrrlrr.exe117⤵PID:3604
-
\??\c:\nttnhh.exec:\nttnhh.exe118⤵PID:4908
-
\??\c:\nnhnbb.exec:\nnhnbb.exe119⤵PID:3096
-
\??\c:\pdvvv.exec:\pdvvv.exe120⤵PID:1624
-
\??\c:\vvjjd.exec:\vvjjd.exe121⤵
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\fxlrlrl.exec:\fxlrlrl.exe122⤵PID:3024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-