Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 10:28
Static task
static1
Behavioral task
behavioral1
Sample
87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe
Resource
win7-20240708-en
General
-
Target
87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe
-
Size
453KB
-
MD5
d99bf23c3d7cf717def0c4bd261d4242
-
SHA1
8837f5f8034cff3e2999ed78407be44f5c329717
-
SHA256
87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4
-
SHA512
79fc0e22b12508b5aebba0f6a9f4da349f906a807504b70589b41a0e209ac964bf447fcd67d9c7a779a264b2e8cdca09f6e971215b6ff088c9de74d74dded595
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2308-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2796-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3504-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1976-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1256-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3376-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/320-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4624-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3544-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3328-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2144-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/396-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1592-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1596 tbhtbh.exe 2796 3bhbnn.exe 2780 3ntnnn.exe 3920 vvjdv.exe 4692 fxxxrll.exe 4068 bntnhb.exe 3116 bbnhtt.exe 3504 dvvvp.exe 1264 5dvpj.exe 540 5hhbbh.exe 4940 ppvdv.exe 5052 ppjdv.exe 3808 ppvpp.exe 1976 fxxllfx.exe 396 3dvpj.exe 3432 jdddv.exe 4372 rrffxrr.exe 1516 hbbbtb.exe 2764 jdjvv.exe 1916 tnnnnn.exe 1256 djvvj.exe 4880 pvvpp.exe 3376 bhnnht.exe 2388 1pvvp.exe 2304 1frlxxl.exe 1164 nthbbt.exe 744 7tbtnn.exe 2612 pdvvv.exe 2876 bbhhnt.exe 4752 vpjdd.exe 2996 5lllfll.exe 320 bbhhnn.exe 4024 3pjdv.exe 3520 vjvpj.exe 1968 5rxxrxf.exe 1936 bhnhbb.exe 2424 pjjdd.exe 3436 nhnthh.exe 3536 3tttnn.exe 4948 pjvpj.exe 4380 rlxrlll.exe 4876 bhnnbb.exe 3368 7htntt.exe 1548 1jpjj.exe 1476 frrlxfx.exe 4592 hthhht.exe 1044 jdpjj.exe 840 djppd.exe 4384 1bhbtb.exe 4340 tbnhbb.exe 4624 5pvvv.exe 4464 fxfxrrr.exe 4900 3hbtnn.exe 2780 5dvvp.exe 3920 1rxlllr.exe 1972 tnhttb.exe 2828 bhttnn.exe 3656 1djjj.exe 3644 7xxxrrl.exe 1088 lrfrfxl.exe 2880 1nnhbb.exe 388 ppppj.exe 2368 jvddv.exe 2284 fxlfxxf.exe -
resource yara_rule behavioral2/memory/2308-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2796-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3504-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3808-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1976-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1256-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3376-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/320-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4024-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1968-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4624-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2828-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3544-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1592-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2876-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2144-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/744-585-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1596 2308 87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe 82 PID 2308 wrote to memory of 1596 2308 87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe 82 PID 2308 wrote to memory of 1596 2308 87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe 82 PID 1596 wrote to memory of 2796 1596 tbhtbh.exe 83 PID 1596 wrote to memory of 2796 1596 tbhtbh.exe 83 PID 1596 wrote to memory of 2796 1596 tbhtbh.exe 83 PID 2796 wrote to memory of 2780 2796 3bhbnn.exe 84 PID 2796 wrote to memory of 2780 2796 3bhbnn.exe 84 PID 2796 wrote to memory of 2780 2796 3bhbnn.exe 84 PID 2780 wrote to memory of 3920 2780 3ntnnn.exe 85 PID 2780 wrote to memory of 3920 2780 3ntnnn.exe 85 PID 2780 wrote to memory of 3920 2780 3ntnnn.exe 85 PID 3920 wrote to memory of 4692 3920 vvjdv.exe 86 PID 3920 wrote to memory of 4692 3920 vvjdv.exe 86 PID 3920 wrote to memory of 4692 3920 vvjdv.exe 86 PID 4692 wrote to memory of 4068 4692 fxxxrll.exe 87 PID 4692 wrote to memory of 4068 4692 fxxxrll.exe 87 PID 4692 wrote to memory of 4068 4692 fxxxrll.exe 87 PID 4068 wrote to memory of 3116 4068 bntnhb.exe 88 PID 4068 wrote to memory of 3116 4068 bntnhb.exe 88 PID 4068 wrote to memory of 3116 4068 bntnhb.exe 88 PID 3116 wrote to memory of 3504 3116 bbnhtt.exe 89 PID 3116 wrote to memory of 3504 3116 bbnhtt.exe 89 PID 3116 wrote to memory of 3504 3116 bbnhtt.exe 89 PID 3504 wrote to memory of 1264 3504 dvvvp.exe 90 PID 3504 wrote to memory of 1264 3504 dvvvp.exe 90 PID 3504 wrote to memory of 1264 3504 dvvvp.exe 90 PID 1264 wrote to memory of 540 1264 5dvpj.exe 91 PID 1264 wrote to memory of 540 1264 5dvpj.exe 91 PID 1264 wrote to memory of 540 1264 5dvpj.exe 91 PID 540 wrote to memory of 4940 540 5hhbbh.exe 92 PID 540 wrote to memory of 4940 540 5hhbbh.exe 92 PID 540 wrote to memory of 4940 540 5hhbbh.exe 92 PID 4940 wrote to memory of 5052 4940 ppvdv.exe 93 PID 4940 wrote to memory of 5052 4940 ppvdv.exe 93 PID 4940 wrote to memory of 5052 4940 ppvdv.exe 93 PID 5052 wrote to memory of 3808 5052 ppjdv.exe 94 PID 5052 wrote to memory of 3808 5052 ppjdv.exe 94 PID 5052 wrote to memory of 3808 5052 ppjdv.exe 94 PID 3808 wrote to memory of 1976 3808 ppvpp.exe 95 PID 3808 wrote to memory of 1976 3808 ppvpp.exe 95 PID 3808 wrote to memory of 1976 3808 ppvpp.exe 95 PID 1976 wrote to memory of 396 1976 fxxllfx.exe 96 PID 1976 wrote to memory of 396 1976 fxxllfx.exe 96 PID 1976 wrote to memory of 396 1976 fxxllfx.exe 96 PID 396 wrote to memory of 3432 396 3dvpj.exe 97 PID 396 wrote to memory of 3432 396 3dvpj.exe 97 PID 396 wrote to memory of 3432 396 3dvpj.exe 97 PID 3432 wrote to memory of 4372 3432 jdddv.exe 98 PID 3432 wrote to memory of 4372 3432 jdddv.exe 98 PID 3432 wrote to memory of 4372 3432 jdddv.exe 98 PID 4372 wrote to memory of 1516 4372 rrffxrr.exe 99 PID 4372 wrote to memory of 1516 4372 rrffxrr.exe 99 PID 4372 wrote to memory of 1516 4372 rrffxrr.exe 99 PID 1516 wrote to memory of 2764 1516 hbbbtb.exe 100 PID 1516 wrote to memory of 2764 1516 hbbbtb.exe 100 PID 1516 wrote to memory of 2764 1516 hbbbtb.exe 100 PID 2764 wrote to memory of 1916 2764 jdjvv.exe 101 PID 2764 wrote to memory of 1916 2764 jdjvv.exe 101 PID 2764 wrote to memory of 1916 2764 jdjvv.exe 101 PID 1916 wrote to memory of 1256 1916 tnnnnn.exe 102 PID 1916 wrote to memory of 1256 1916 tnnnnn.exe 102 PID 1916 wrote to memory of 1256 1916 tnnnnn.exe 102 PID 1256 wrote to memory of 4880 1256 djvvj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe"C:\Users\Admin\AppData\Local\Temp\87992b4d6330927f8db3636b34c5d0f05c3b71af81fb8eed302e5411bfa768a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\tbhtbh.exec:\tbhtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\3bhbnn.exec:\3bhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\3ntnnn.exec:\3ntnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvjdv.exec:\vvjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\fxxxrll.exec:\fxxxrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\bntnhb.exec:\bntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\bbnhtt.exec:\bbnhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\dvvvp.exec:\dvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\5dvpj.exec:\5dvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\5hhbbh.exec:\5hhbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\ppvdv.exec:\ppvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ppjdv.exec:\ppjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\ppvpp.exec:\ppvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\fxxllfx.exec:\fxxllfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\3dvpj.exec:\3dvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\jdddv.exec:\jdddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\rrffxrr.exec:\rrffxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\hbbbtb.exec:\hbbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\jdjvv.exec:\jdjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\tnnnnn.exec:\tnnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\djvvj.exec:\djvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\pvvpp.exec:\pvvpp.exe23⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bhnnht.exec:\bhnnht.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3376 -
\??\c:\1pvvp.exec:\1pvvp.exe25⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1frlxxl.exec:\1frlxxl.exe26⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nthbbt.exec:\nthbbt.exe27⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7tbtnn.exec:\7tbtnn.exe28⤵
- Executes dropped EXE
PID:744 -
\??\c:\pdvvv.exec:\pdvvv.exe29⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bbhhnt.exec:\bbhhnt.exe30⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vpjdd.exec:\vpjdd.exe31⤵
- Executes dropped EXE
PID:4752 -
\??\c:\5lllfll.exec:\5lllfll.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bbhhnn.exec:\bbhhnn.exe33⤵
- Executes dropped EXE
PID:320 -
\??\c:\3pjdv.exec:\3pjdv.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\vjvpj.exec:\vjvpj.exe35⤵
- Executes dropped EXE
PID:3520 -
\??\c:\5rxxrxf.exec:\5rxxrxf.exe36⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bhnhbb.exec:\bhnhbb.exe37⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjjdd.exec:\pjjdd.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\nhnthh.exec:\nhnthh.exe39⤵
- Executes dropped EXE
PID:3436 -
\??\c:\3tttnn.exec:\3tttnn.exe40⤵
- Executes dropped EXE
PID:3536 -
\??\c:\pjvpj.exec:\pjvpj.exe41⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rlxrlll.exec:\rlxrlll.exe42⤵
- Executes dropped EXE
PID:4380 -
\??\c:\bhnnbb.exec:\bhnnbb.exe43⤵
- Executes dropped EXE
PID:4876 -
\??\c:\7htntt.exec:\7htntt.exe44⤵
- Executes dropped EXE
PID:3368 -
\??\c:\1jpjj.exec:\1jpjj.exe45⤵
- Executes dropped EXE
PID:1548 -
\??\c:\frrlxfx.exec:\frrlxfx.exe46⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hthhht.exec:\hthhht.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\jdpjj.exec:\jdpjj.exe48⤵
- Executes dropped EXE
PID:1044 -
\??\c:\djppd.exec:\djppd.exe49⤵
- Executes dropped EXE
PID:840 -
\??\c:\1bhbtb.exec:\1bhbtb.exe50⤵
- Executes dropped EXE
PID:4384 -
\??\c:\tbnhbb.exec:\tbnhbb.exe51⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5pvvv.exec:\5pvvv.exe52⤵
- Executes dropped EXE
PID:4624 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe53⤵
- Executes dropped EXE
PID:4464 -
\??\c:\3hbtnn.exec:\3hbtnn.exe54⤵
- Executes dropped EXE
PID:4900 -
\??\c:\5dvvp.exec:\5dvvp.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1rxlllr.exec:\1rxlllr.exe56⤵
- Executes dropped EXE
PID:3920 -
\??\c:\tnhttb.exec:\tnhttb.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bhttnn.exec:\bhttnn.exe58⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1djjj.exec:\1djjj.exe59⤵
- Executes dropped EXE
PID:3656 -
\??\c:\7xxxrrl.exec:\7xxxrrl.exe60⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lrfrfxl.exec:\lrfrfxl.exe61⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1nnhbb.exec:\1nnhbb.exe62⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ppppj.exec:\ppppj.exe63⤵
- Executes dropped EXE
PID:388 -
\??\c:\jvddv.exec:\jvddv.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\thbtnn.exec:\thbtnn.exe66⤵PID:936
-
\??\c:\nthbhb.exec:\nthbhb.exe67⤵
- System Location Discovery: System Language Discovery
PID:3544 -
\??\c:\pdjjp.exec:\pdjjp.exe68⤵PID:4924
-
\??\c:\xxxrxrr.exec:\xxxrxrr.exe69⤵PID:2352
-
\??\c:\nntnnn.exec:\nntnnn.exe70⤵PID:2912
-
\??\c:\ppvjj.exec:\ppvjj.exe71⤵PID:1592
-
\??\c:\vvdvj.exec:\vvdvj.exe72⤵PID:4104
-
\??\c:\ffxxrff.exec:\ffxxrff.exe73⤵PID:4032
-
\??\c:\bhttnn.exec:\bhttnn.exe74⤵PID:2496
-
\??\c:\vvjjd.exec:\vvjjd.exe75⤵PID:4984
-
\??\c:\rflfxxr.exec:\rflfxxr.exe76⤵PID:3068
-
\??\c:\frxrlff.exec:\frxrlff.exe77⤵PID:1708
-
\??\c:\tthnhh.exec:\tthnhh.exe78⤵PID:5064
-
\??\c:\3pddj.exec:\3pddj.exe79⤵PID:4684
-
\??\c:\lflfxfx.exec:\lflfxfx.exe80⤵PID:3300
-
\??\c:\nnnhbb.exec:\nnnhbb.exe81⤵PID:2096
-
\??\c:\ppddd.exec:\ppddd.exe82⤵PID:1020
-
\??\c:\pvdvp.exec:\pvdvp.exe83⤵PID:408
-
\??\c:\9rxxxrr.exec:\9rxxxrr.exe84⤵PID:3548
-
\??\c:\3bhhnn.exec:\3bhhnn.exe85⤵
- System Location Discovery: System Language Discovery
PID:5096 -
\??\c:\7jppj.exec:\7jppj.exe86⤵PID:3932
-
\??\c:\3llxrrr.exec:\3llxrrr.exe87⤵PID:2304
-
\??\c:\btbthh.exec:\btbthh.exe88⤵PID:3040
-
\??\c:\jjdvj.exec:\jjdvj.exe89⤵PID:32
-
\??\c:\1rrllff.exec:\1rrllff.exe90⤵PID:1764
-
\??\c:\7tnhbb.exec:\7tnhbb.exe91⤵PID:2612
-
\??\c:\ppjdd.exec:\ppjdd.exe92⤵PID:2876
-
\??\c:\5pvpp.exec:\5pvpp.exe93⤵PID:1352
-
\??\c:\xxffxfl.exec:\xxffxfl.exe94⤵PID:884
-
\??\c:\bhnhbb.exec:\bhnhbb.exe95⤵PID:3884
-
\??\c:\ppvvv.exec:\ppvvv.exe96⤵PID:320
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe97⤵PID:3328
-
\??\c:\bthbtn.exec:\bthbtn.exe98⤵PID:3556
-
\??\c:\jvdvj.exec:\jvdvj.exe99⤵PID:2696
-
\??\c:\lflxllf.exec:\lflxllf.exe100⤵PID:4360
-
\??\c:\3hnnnb.exec:\3hnnnb.exe101⤵PID:2144
-
\??\c:\pdjdd.exec:\pdjdd.exe102⤵PID:1172
-
\??\c:\pjdjj.exec:\pjdjj.exe103⤵PID:4584
-
\??\c:\xxrrflf.exec:\xxrrflf.exe104⤵PID:3928
-
\??\c:\hbbttt.exec:\hbbttt.exe105⤵PID:4476
-
\??\c:\1vvvj.exec:\1vvvj.exe106⤵PID:2732
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe107⤵PID:4496
-
\??\c:\9hhhhh.exec:\9hhhhh.exe108⤵PID:452
-
\??\c:\9pvvp.exec:\9pvvp.exe109⤵PID:1548
-
\??\c:\lxfxrxx.exec:\lxfxrxx.exe110⤵PID:2136
-
\??\c:\1ntnhn.exec:\1ntnhn.exe111⤵PID:2432
-
\??\c:\hhhhtt.exec:\hhhhtt.exe112⤵PID:3508
-
\??\c:\dpvvv.exec:\dpvvv.exe113⤵PID:4388
-
\??\c:\llrfxrf.exec:\llrfxrf.exe114⤵
- System Location Discovery: System Language Discovery
PID:3660 -
\??\c:\httttt.exec:\httttt.exe115⤵PID:4012
-
\??\c:\jjpjd.exec:\jjpjd.exe116⤵PID:1596
-
\??\c:\lllfffx.exec:\lllfffx.exe117⤵PID:2176
-
\??\c:\btbttt.exec:\btbttt.exe118⤵PID:720
-
\??\c:\btnntt.exec:\btnntt.exe119⤵PID:4528
-
\??\c:\jjjdv.exec:\jjjdv.exe120⤵PID:4664
-
\??\c:\lffxrlf.exec:\lffxrlf.exe121⤵PID:3172
-
\??\c:\bthbtt.exec:\bthbtt.exe122⤵PID:3616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-