Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe
Resource
win7-20240903-en
General
-
Target
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe
-
Size
454KB
-
MD5
e923c13b68357e17befed95e04380873
-
SHA1
29d10f5970269163b37dd4b02d5234119bc51bb2
-
SHA256
f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94
-
SHA512
5f6102b90a01f37f6467d6870b31e15802bd5b7367bdb9f98b0a10c43c5dd8c829a4b332aab0af9e7ccfa364b69bc8ac93b15c4d4e70022c83ffac1c5178dada
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4332-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2840-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1424-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3004-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3064-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2252-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3956-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1852-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3124-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2772-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1620-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4200-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4988-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4932-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/548-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/348-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4652-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/620-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1956-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1624-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2464-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/812-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4780-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4480-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5060-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1340-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1020-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-945-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-1069-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-1159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-1470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 9llxrlf.exe 2808 vjvvd.exe 4932 frrlfff.exe 4664 3ffrlfr.exe 4988 bbhbbn.exe 1732 1vvpd.exe 1380 xfxrxrl.exe 2840 rlrlfff.exe 4924 5hntnn.exe 1424 9pvpp.exe 540 xlrfffr.exe 948 vjdvv.exe 4200 frxlfxr.exe 3004 7hnnhh.exe 2768 jpdpj.exe 652 xlrlxxx.exe 212 3xfxxxx.exe 4372 thhbnn.exe 1620 1ddvp.exe 2772 vvdpj.exe 1916 3rxlfxr.exe 2928 tbthth.exe 3196 vdvjp.exe 1020 rrxrxxl.exe 3548 lfxrlfr.exe 1100 tnnhbn.exe 4836 jjjpd.exe 3124 pvdpj.exe 1356 1ffrllf.exe 1704 tntnht.exe 3680 1jjdp.exe 3064 jvdvj.exe 2312 rllfrlf.exe 1624 ntbthb.exe 1168 7btnnh.exe 228 dppjv.exe 1852 flxxlfx.exe 3956 lflfxxl.exe 1412 nhhbtn.exe 3164 dvppj.exe 1456 fllffff.exe 4044 rffxrfx.exe 4584 bhnbtn.exe 1604 pjddj.exe 4476 pjpdv.exe 3496 rrrxfrf.exe 1932 bhbnhb.exe 1060 vjppj.exe 5004 rxlfxxx.exe 2816 lrlllrr.exe 3444 bbhbnh.exe 1804 jvdvv.exe 4392 vjjjd.exe 2796 flrlfxx.exe 3856 1nhbtt.exe 2592 vjjjd.exe 4004 jdppj.exe 3604 xxrrlll.exe 2252 nnntnn.exe 2820 jdpvp.exe 3296 1fllffl.exe 1092 tnnbtn.exe 1264 vvvjd.exe 548 5rxxlll.exe -
resource yara_rule behavioral2/memory/4332-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1424-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3004-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3064-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2252-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3956-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1852-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3124-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2772-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1620-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4200-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1732-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4988-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4932-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/548-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/348-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/620-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1956-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1624-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2464-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/812-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4780-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4480-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5060-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1340-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1020-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-1069-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4332 wrote to memory of 3060 4332 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 82 PID 4332 wrote to memory of 3060 4332 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 82 PID 4332 wrote to memory of 3060 4332 f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe 82 PID 3060 wrote to memory of 2808 3060 9llxrlf.exe 83 PID 3060 wrote to memory of 2808 3060 9llxrlf.exe 83 PID 3060 wrote to memory of 2808 3060 9llxrlf.exe 83 PID 2808 wrote to memory of 4932 2808 vjvvd.exe 84 PID 2808 wrote to memory of 4932 2808 vjvvd.exe 84 PID 2808 wrote to memory of 4932 2808 vjvvd.exe 84 PID 4932 wrote to memory of 4664 4932 frrlfff.exe 85 PID 4932 wrote to memory of 4664 4932 frrlfff.exe 85 PID 4932 wrote to memory of 4664 4932 frrlfff.exe 85 PID 4664 wrote to memory of 4988 4664 3ffrlfr.exe 86 PID 4664 wrote to memory of 4988 4664 3ffrlfr.exe 86 PID 4664 wrote to memory of 4988 4664 3ffrlfr.exe 86 PID 4988 wrote to memory of 1732 4988 bbhbbn.exe 87 PID 4988 wrote to memory of 1732 4988 bbhbbn.exe 87 PID 4988 wrote to memory of 1732 4988 bbhbbn.exe 87 PID 1732 wrote to memory of 1380 1732 1vvpd.exe 88 PID 1732 wrote to memory of 1380 1732 1vvpd.exe 88 PID 1732 wrote to memory of 1380 1732 1vvpd.exe 88 PID 1380 wrote to memory of 2840 1380 xfxrxrl.exe 89 PID 1380 wrote to memory of 2840 1380 xfxrxrl.exe 89 PID 1380 wrote to memory of 2840 1380 xfxrxrl.exe 89 PID 2840 wrote to memory of 4924 2840 rlrlfff.exe 90 PID 2840 wrote to memory of 4924 2840 rlrlfff.exe 90 PID 2840 wrote to memory of 4924 2840 rlrlfff.exe 90 PID 4924 wrote to memory of 1424 4924 5hntnn.exe 91 PID 4924 wrote to memory of 1424 4924 5hntnn.exe 91 PID 4924 wrote to memory of 1424 4924 5hntnn.exe 91 PID 1424 wrote to memory of 540 1424 9pvpp.exe 92 PID 1424 wrote to memory of 540 1424 9pvpp.exe 92 PID 1424 wrote to memory of 540 1424 9pvpp.exe 92 PID 540 wrote to memory of 948 540 xlrfffr.exe 93 PID 540 wrote to memory of 948 540 xlrfffr.exe 93 PID 540 wrote to memory of 948 540 xlrfffr.exe 93 PID 948 wrote to memory of 4200 948 vjdvv.exe 94 PID 948 wrote to memory of 4200 948 vjdvv.exe 94 PID 948 wrote to memory of 4200 948 vjdvv.exe 94 PID 4200 wrote to memory of 3004 4200 frxlfxr.exe 95 PID 4200 wrote to memory of 3004 4200 frxlfxr.exe 95 PID 4200 wrote to memory of 3004 4200 frxlfxr.exe 95 PID 3004 wrote to memory of 2768 3004 7hnnhh.exe 150 PID 3004 wrote to memory of 2768 3004 7hnnhh.exe 150 PID 3004 wrote to memory of 2768 3004 7hnnhh.exe 150 PID 2768 wrote to memory of 652 2768 jpdpj.exe 151 PID 2768 wrote to memory of 652 2768 jpdpj.exe 151 PID 2768 wrote to memory of 652 2768 jpdpj.exe 151 PID 652 wrote to memory of 212 652 xlrlxxx.exe 98 PID 652 wrote to memory of 212 652 xlrlxxx.exe 98 PID 652 wrote to memory of 212 652 xlrlxxx.exe 98 PID 212 wrote to memory of 4372 212 3xfxxxx.exe 99 PID 212 wrote to memory of 4372 212 3xfxxxx.exe 99 PID 212 wrote to memory of 4372 212 3xfxxxx.exe 99 PID 4372 wrote to memory of 1620 4372 thhbnn.exe 100 PID 4372 wrote to memory of 1620 4372 thhbnn.exe 100 PID 4372 wrote to memory of 1620 4372 thhbnn.exe 100 PID 1620 wrote to memory of 2772 1620 1ddvp.exe 101 PID 1620 wrote to memory of 2772 1620 1ddvp.exe 101 PID 1620 wrote to memory of 2772 1620 1ddvp.exe 101 PID 2772 wrote to memory of 1916 2772 vvdpj.exe 102 PID 2772 wrote to memory of 1916 2772 vvdpj.exe 102 PID 2772 wrote to memory of 1916 2772 vvdpj.exe 102 PID 1916 wrote to memory of 2928 1916 3rxlfxr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe"C:\Users\Admin\AppData\Local\Temp\f07756d90f1ebe179e441c012048d738134d7b240a0fb2becf75881402ec0b94.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\9llxrlf.exec:\9llxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\vjvvd.exec:\vjvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\frrlfff.exec:\frrlfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\3ffrlfr.exec:\3ffrlfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\bbhbbn.exec:\bbhbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\1vvpd.exec:\1vvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\xfxrxrl.exec:\xfxrxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\rlrlfff.exec:\rlrlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5hntnn.exec:\5hntnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\9pvpp.exec:\9pvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\xlrfffr.exec:\xlrfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\vjdvv.exec:\vjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\frxlfxr.exec:\frxlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\7hnnhh.exec:\7hnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jpdpj.exec:\jpdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xlrlxxx.exec:\xlrlxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\thhbnn.exec:\thhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\1ddvp.exec:\1ddvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\vvdpj.exec:\vvdpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3rxlfxr.exec:\3rxlfxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\tbthth.exec:\tbthth.exe23⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vdvjp.exec:\vdvjp.exe24⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe25⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe26⤵
- Executes dropped EXE
PID:3548 -
\??\c:\tnnhbn.exec:\tnnhbn.exe27⤵
- Executes dropped EXE
PID:1100 -
\??\c:\jjjpd.exec:\jjjpd.exe28⤵
- Executes dropped EXE
PID:4836 -
\??\c:\pvdpj.exec:\pvdpj.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\1ffrllf.exec:\1ffrllf.exe30⤵
- Executes dropped EXE
PID:1356 -
\??\c:\tntnht.exec:\tntnht.exe31⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1jjdp.exec:\1jjdp.exe32⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jvdvj.exec:\jvdvj.exe33⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rllfrlf.exec:\rllfrlf.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ntbthb.exec:\ntbthb.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\7btnnh.exec:\7btnnh.exe36⤵
- Executes dropped EXE
PID:1168 -
\??\c:\dppjv.exec:\dppjv.exe37⤵
- Executes dropped EXE
PID:228 -
\??\c:\flxxlfx.exec:\flxxlfx.exe38⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lflfxxl.exec:\lflfxxl.exe39⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nhhbtn.exec:\nhhbtn.exe40⤵
- Executes dropped EXE
PID:1412 -
\??\c:\dvppj.exec:\dvppj.exe41⤵
- Executes dropped EXE
PID:3164 -
\??\c:\fllffff.exec:\fllffff.exe42⤵
- Executes dropped EXE
PID:1456 -
\??\c:\rffxrfx.exec:\rffxrfx.exe43⤵
- Executes dropped EXE
PID:4044 -
\??\c:\bhnbtn.exec:\bhnbtn.exe44⤵
- Executes dropped EXE
PID:4584 -
\??\c:\pjddj.exec:\pjddj.exe45⤵
- Executes dropped EXE
PID:1604 -
\??\c:\pjpdv.exec:\pjpdv.exe46⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rrrxfrf.exec:\rrrxfrf.exe47⤵
- Executes dropped EXE
PID:3496 -
\??\c:\bhbnhb.exec:\bhbnhb.exe48⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vjppj.exec:\vjppj.exe49⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe50⤵
- Executes dropped EXE
PID:5004 -
\??\c:\lrlllrr.exec:\lrlllrr.exe51⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bbhbnh.exec:\bbhbnh.exe52⤵
- Executes dropped EXE
PID:3444 -
\??\c:\jvdvv.exec:\jvdvv.exe53⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vjjjd.exec:\vjjjd.exe54⤵
- Executes dropped EXE
PID:4392 -
\??\c:\flrlfxx.exec:\flrlfxx.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1nhbtt.exec:\1nhbtt.exe56⤵
- Executes dropped EXE
PID:3856 -
\??\c:\vjjjd.exec:\vjjjd.exe57⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jdppj.exec:\jdppj.exe58⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xxrrlll.exec:\xxrrlll.exe59⤵
- Executes dropped EXE
PID:3604 -
\??\c:\nnntnn.exec:\nnntnn.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\jdpvp.exec:\jdpvp.exe61⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1fllffl.exec:\1fllffl.exe62⤵
- Executes dropped EXE
PID:3296 -
\??\c:\tnnbtn.exec:\tnnbtn.exe63⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vvvjd.exec:\vvvjd.exe64⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5rxxlll.exec:\5rxxlll.exe65⤵
- Executes dropped EXE
PID:548 -
\??\c:\pjpjd.exec:\pjpjd.exe66⤵PID:348
-
\??\c:\7fxrllr.exec:\7fxrllr.exe67⤵PID:5052
-
\??\c:\thhbbn.exec:\thhbbn.exe68⤵PID:3280
-
\??\c:\dvdvp.exec:\dvdvp.exe69⤵PID:2912
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe70⤵PID:2768
-
\??\c:\hhhhtt.exec:\hhhhtt.exe71⤵PID:652
-
\??\c:\dpdvp.exec:\dpdvp.exe72⤵PID:220
-
\??\c:\llfxlxr.exec:\llfxlxr.exe73⤵PID:4740
-
\??\c:\ntbnbb.exec:\ntbnbb.exe74⤵PID:1316
-
\??\c:\htbbtn.exec:\htbbtn.exe75⤵PID:4652
-
\??\c:\jddvj.exec:\jddvj.exe76⤵PID:5064
-
\??\c:\rxllxxx.exec:\rxllxxx.exe77⤵PID:1648
-
\??\c:\7tnhhh.exec:\7tnhhh.exe78⤵PID:620
-
\??\c:\rlfxxrl.exec:\rlfxxrl.exe79⤵PID:3196
-
\??\c:\bntnhb.exec:\bntnhb.exe80⤵PID:924
-
\??\c:\vpdvd.exec:\vpdvd.exe81⤵PID:4212
-
\??\c:\tbttnn.exec:\tbttnn.exe82⤵PID:4588
-
\??\c:\djvpd.exec:\djvpd.exe83⤵PID:1956
-
\??\c:\xrfxfxr.exec:\xrfxfxr.exe84⤵PID:748
-
\??\c:\dppvp.exec:\dppvp.exe85⤵PID:4268
-
\??\c:\hhhbtn.exec:\hhhbtn.exe86⤵PID:884
-
\??\c:\3pjdv.exec:\3pjdv.exe87⤵PID:1520
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe88⤵PID:1624
-
\??\c:\bbbttt.exec:\bbbttt.exe89⤵PID:1848
-
\??\c:\jdppd.exec:\jdppd.exe90⤵PID:1104
-
\??\c:\rfffxrl.exec:\rfffxrl.exe91⤵PID:1268
-
\??\c:\fxfxfff.exec:\fxfxfff.exe92⤵PID:1204
-
\??\c:\3lffxxx.exec:\3lffxxx.exe93⤵PID:3956
-
\??\c:\bhbnhh.exec:\bhbnhh.exe94⤵PID:836
-
\??\c:\7vpjd.exec:\7vpjd.exe95⤵PID:2464
-
\??\c:\xxxrfff.exec:\xxxrfff.exe96⤵PID:1876
-
\??\c:\pdjdj.exec:\pdjdj.exe97⤵PID:4360
-
\??\c:\pjjvp.exec:\pjjvp.exe98⤵PID:2424
-
\??\c:\5fxxffx.exec:\5fxxffx.exe99⤵PID:4584
-
\??\c:\tthbtt.exec:\tthbtt.exe100⤵PID:3236
-
\??\c:\pdvpp.exec:\pdvpp.exe101⤵PID:2732
-
\??\c:\7rxfffx.exec:\7rxfffx.exe102⤵PID:2908
-
\??\c:\ppppd.exec:\ppppd.exe103⤵PID:2904
-
\??\c:\ntbthh.exec:\ntbthh.exe104⤵PID:2576
-
\??\c:\vdjjj.exec:\vdjjj.exe105⤵PID:2748
-
\??\c:\3ddvj.exec:\3ddvj.exe106⤵PID:5004
-
\??\c:\rrrlffx.exec:\rrrlffx.exe107⤵PID:3480
-
\??\c:\bttnhb.exec:\bttnhb.exe108⤵PID:812
-
\??\c:\jjpvp.exec:\jjpvp.exe109⤵PID:4684
-
\??\c:\9xfrrrx.exec:\9xfrrrx.exe110⤵PID:4384
-
\??\c:\bthhhh.exec:\bthhhh.exe111⤵PID:4340
-
\??\c:\nhbhbb.exec:\nhbhbb.exe112⤵PID:2040
-
\??\c:\djdvv.exec:\djdvv.exe113⤵PID:4512
-
\??\c:\rfflllf.exec:\rfflllf.exe114⤵PID:3660
-
\??\c:\xfxrlxf.exec:\xfxrlxf.exe115⤵PID:4464
-
\??\c:\hbhbbh.exec:\hbhbbh.exe116⤵PID:3104
-
\??\c:\dppjd.exec:\dppjd.exe117⤵PID:4696
-
\??\c:\xrxlfxr.exec:\xrxlfxr.exe118⤵PID:4572
-
\??\c:\5tnhtt.exec:\5tnhtt.exe119⤵PID:4768
-
\??\c:\pvjpj.exec:\pvjpj.exe120⤵PID:628
-
\??\c:\rlrxrrr.exec:\rlrxrrr.exe121⤵PID:1008
-
\??\c:\9tbnhh.exec:\9tbnhh.exe122⤵PID:3116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-