Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 10:36
Static task
static1
Behavioral task
behavioral1
Sample
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe
Resource
win7-20240903-en
General
-
Target
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe
-
Size
454KB
-
MD5
483f1a72619d1f27b52dc73259819d30
-
SHA1
75275e298e9e1fc74f9de91bc0cb26f3fc5fa4a2
-
SHA256
b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5a
-
SHA512
ed642b91a5fea7d2b3f7369d639d4f5715e05d2bbef054d7948273441b814016f2b936655dd235a87b2d5265f32d4e4d093627ce99ad9ac9d02f4aad0168a3c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeg:q7Tc2NYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4712-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3672-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5052-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4900-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4372-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1172-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2724-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/856-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4496-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1232-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1940-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3220-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4252-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1924-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2780-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1708-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2468-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4300-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1096-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-933-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 vdvjd.exe 3196 jpppd.exe 5048 llrfxlr.exe 5052 fxxrfrf.exe 4900 fxfxxxr.exe 3568 vdjdv.exe 5084 xrxxxxx.exe 3380 ppvjj.exe 1544 bbntbh.exe 4252 jpdjp.exe 3700 pvjvv.exe 4372 xxfxlxx.exe 8 nbbttt.exe 2408 1jvvp.exe 4124 htbbtt.exe 1180 jdvpj.exe 1172 bhhbtt.exe 2948 lxfrxrl.exe 4232 hhtbhh.exe 856 nntnnn.exe 4972 frrxrfr.exe 2724 htnnbb.exe 4092 xxfxlff.exe 1356 xfxrrfl.exe 4180 bntttt.exe 2904 rfrrrxx.exe 4496 fxflxfl.exe 2492 3vvpj.exe 4956 bbbbbt.exe 4444 5flxlrf.exe 3244 rlxrrrl.exe 1232 vjvvp.exe 4108 fflrffr.exe 5088 vjvpv.exe 1552 fxfxxxr.exe 3508 bbhhnn.exe 3580 ppvpj.exe 2968 fxrrxxl.exe 1960 tthbnn.exe 4916 dppjj.exe 604 rrrrfff.exe 4828 vvppp.exe 4320 llffllf.exe 1940 fxfffxx.exe 1112 dvjdv.exe 3724 fxxfxxx.exe 4000 hnnhtt.exe 2952 jpdpj.exe 4640 rlrlffx.exe 220 bttnhh.exe 4816 ppvpj.exe 1916 fflrlll.exe 1996 ppjjd.exe 904 7xlfflx.exe 4672 nnbbtt.exe 3380 3vjdj.exe 3220 xrxxxrr.exe 4252 hhnhbt.exe 1924 fxlfllf.exe 372 rfrllll.exe 1188 vpdvp.exe 4880 flxrlll.exe 3096 bthhhh.exe 8 btbbnn.exe -
resource yara_rule behavioral2/memory/4712-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3672-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5052-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4372-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1172-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2724-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/856-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4496-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3244-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1232-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1940-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4672-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4252-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1924-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3864-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2780-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1708-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2468-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4300-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1096-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-652-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4712 wrote to memory of 3672 4712 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 83 PID 4712 wrote to memory of 3672 4712 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 83 PID 4712 wrote to memory of 3672 4712 b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe 83 PID 3672 wrote to memory of 3196 3672 vdvjd.exe 84 PID 3672 wrote to memory of 3196 3672 vdvjd.exe 84 PID 3672 wrote to memory of 3196 3672 vdvjd.exe 84 PID 3196 wrote to memory of 5048 3196 jpppd.exe 85 PID 3196 wrote to memory of 5048 3196 jpppd.exe 85 PID 3196 wrote to memory of 5048 3196 jpppd.exe 85 PID 5048 wrote to memory of 5052 5048 llrfxlr.exe 86 PID 5048 wrote to memory of 5052 5048 llrfxlr.exe 86 PID 5048 wrote to memory of 5052 5048 llrfxlr.exe 86 PID 5052 wrote to memory of 4900 5052 fxxrfrf.exe 87 PID 5052 wrote to memory of 4900 5052 fxxrfrf.exe 87 PID 5052 wrote to memory of 4900 5052 fxxrfrf.exe 87 PID 4900 wrote to memory of 3568 4900 fxfxxxr.exe 88 PID 4900 wrote to memory of 3568 4900 fxfxxxr.exe 88 PID 4900 wrote to memory of 3568 4900 fxfxxxr.exe 88 PID 3568 wrote to memory of 5084 3568 vdjdv.exe 89 PID 3568 wrote to memory of 5084 3568 vdjdv.exe 89 PID 3568 wrote to memory of 5084 3568 vdjdv.exe 89 PID 5084 wrote to memory of 3380 5084 xrxxxxx.exe 90 PID 5084 wrote to memory of 3380 5084 xrxxxxx.exe 90 PID 5084 wrote to memory of 3380 5084 xrxxxxx.exe 90 PID 3380 wrote to memory of 1544 3380 ppvjj.exe 91 PID 3380 wrote to memory of 1544 3380 ppvjj.exe 91 PID 3380 wrote to memory of 1544 3380 ppvjj.exe 91 PID 1544 wrote to memory of 4252 1544 bbntbh.exe 92 PID 1544 wrote to memory of 4252 1544 bbntbh.exe 92 PID 1544 wrote to memory of 4252 1544 bbntbh.exe 92 PID 4252 wrote to memory of 3700 4252 jpdjp.exe 93 PID 4252 wrote to memory of 3700 4252 jpdjp.exe 93 PID 4252 wrote to memory of 3700 4252 jpdjp.exe 93 PID 3700 wrote to memory of 4372 3700 pvjvv.exe 94 PID 3700 wrote to memory of 4372 3700 pvjvv.exe 94 PID 3700 wrote to memory of 4372 3700 pvjvv.exe 94 PID 4372 wrote to memory of 8 4372 xxfxlxx.exe 95 PID 4372 wrote to memory of 8 4372 xxfxlxx.exe 95 PID 4372 wrote to memory of 8 4372 xxfxlxx.exe 95 PID 8 wrote to memory of 2408 8 nbbttt.exe 96 PID 8 wrote to memory of 2408 8 nbbttt.exe 96 PID 8 wrote to memory of 2408 8 nbbttt.exe 96 PID 2408 wrote to memory of 4124 2408 1jvvp.exe 97 PID 2408 wrote to memory of 4124 2408 1jvvp.exe 97 PID 2408 wrote to memory of 4124 2408 1jvvp.exe 97 PID 4124 wrote to memory of 1180 4124 htbbtt.exe 98 PID 4124 wrote to memory of 1180 4124 htbbtt.exe 98 PID 4124 wrote to memory of 1180 4124 htbbtt.exe 98 PID 1180 wrote to memory of 1172 1180 jdvpj.exe 99 PID 1180 wrote to memory of 1172 1180 jdvpj.exe 99 PID 1180 wrote to memory of 1172 1180 jdvpj.exe 99 PID 1172 wrote to memory of 2948 1172 bhhbtt.exe 100 PID 1172 wrote to memory of 2948 1172 bhhbtt.exe 100 PID 1172 wrote to memory of 2948 1172 bhhbtt.exe 100 PID 2948 wrote to memory of 4232 2948 lxfrxrl.exe 101 PID 2948 wrote to memory of 4232 2948 lxfrxrl.exe 101 PID 2948 wrote to memory of 4232 2948 lxfrxrl.exe 101 PID 4232 wrote to memory of 856 4232 hhtbhh.exe 102 PID 4232 wrote to memory of 856 4232 hhtbhh.exe 102 PID 4232 wrote to memory of 856 4232 hhtbhh.exe 102 PID 856 wrote to memory of 4972 856 nntnnn.exe 103 PID 856 wrote to memory of 4972 856 nntnnn.exe 103 PID 856 wrote to memory of 4972 856 nntnnn.exe 103 PID 4972 wrote to memory of 2724 4972 frrxrfr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe"C:\Users\Admin\AppData\Local\Temp\b1f6b1bb63f8e9ec0bd6691c41b1221ccb1463a18e4080f24864174b3fcd0a5aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\vdvjd.exec:\vdvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jpppd.exec:\jpppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\llrfxlr.exec:\llrfxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\fxxrfrf.exec:\fxxrfrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\vdjdv.exec:\vdjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\ppvjj.exec:\ppvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\bbntbh.exec:\bbntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\jpdjp.exec:\jpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\pvjvv.exec:\pvjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xxfxlxx.exec:\xxfxlxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\nbbttt.exec:\nbbttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\1jvvp.exec:\1jvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\htbbtt.exec:\htbbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\jdvpj.exec:\jdvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\bhhbtt.exec:\bhhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\lxfrxrl.exec:\lxfrxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hhtbhh.exec:\hhtbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\nntnnn.exec:\nntnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\frrxrfr.exec:\frrxrfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\htnnbb.exec:\htnnbb.exe23⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxfxlff.exec:\xxfxlff.exe24⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xfxrrfl.exec:\xfxrrfl.exe25⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bntttt.exec:\bntttt.exe26⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rfrrrxx.exec:\rfrrrxx.exe27⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxflxfl.exec:\fxflxfl.exe28⤵
- Executes dropped EXE
PID:4496 -
\??\c:\3vvpj.exec:\3vvpj.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbbbbt.exec:\bbbbbt.exe30⤵
- Executes dropped EXE
PID:4956 -
\??\c:\5flxlrf.exec:\5flxlrf.exe31⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rlxrrrl.exec:\rlxrrrl.exe32⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vjvvp.exec:\vjvvp.exe33⤵
- Executes dropped EXE
PID:1232 -
\??\c:\fflrffr.exec:\fflrffr.exe34⤵
- Executes dropped EXE
PID:4108 -
\??\c:\vjvpv.exec:\vjvpv.exe35⤵
- Executes dropped EXE
PID:5088 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bbhhnn.exec:\bbhhnn.exe37⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppvpj.exec:\ppvpj.exe38⤵
- Executes dropped EXE
PID:3580 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tthbnn.exec:\tthbnn.exe40⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dppjj.exec:\dppjj.exe41⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rrrrfff.exec:\rrrrfff.exe42⤵
- Executes dropped EXE
PID:604 -
\??\c:\vvppp.exec:\vvppp.exe43⤵
- Executes dropped EXE
PID:4828 -
\??\c:\llffllf.exec:\llffllf.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4320 -
\??\c:\fxfffxx.exec:\fxfffxx.exe45⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dvjdv.exec:\dvjdv.exe46⤵
- Executes dropped EXE
PID:1112 -
\??\c:\fxxfxxx.exec:\fxxfxxx.exe47⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hnnhtt.exec:\hnnhtt.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\jpdpj.exec:\jpdpj.exe49⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rlrlffx.exec:\rlrlffx.exe50⤵
- Executes dropped EXE
PID:4640 -
\??\c:\bttnhh.exec:\bttnhh.exe51⤵
- Executes dropped EXE
PID:220 -
\??\c:\ppvpj.exec:\ppvpj.exe52⤵
- Executes dropped EXE
PID:4816 -
\??\c:\fflrlll.exec:\fflrlll.exe53⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ppjjd.exec:\ppjjd.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7xlfflx.exec:\7xlfflx.exe55⤵
- Executes dropped EXE
PID:904 -
\??\c:\nnbbtt.exec:\nnbbtt.exe56⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3vjdj.exec:\3vjdj.exe57⤵
- Executes dropped EXE
PID:3380 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe58⤵
- Executes dropped EXE
PID:3220 -
\??\c:\hhnhbt.exec:\hhnhbt.exe59⤵
- Executes dropped EXE
PID:4252 -
\??\c:\fxlfllf.exec:\fxlfllf.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rfrllll.exec:\rfrllll.exe61⤵
- Executes dropped EXE
PID:372 -
\??\c:\vpdvp.exec:\vpdvp.exe62⤵
- Executes dropped EXE
PID:1188 -
\??\c:\flxrlll.exec:\flxrlll.exe63⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bthhhh.exec:\bthhhh.exe64⤵
- Executes dropped EXE
PID:3096 -
\??\c:\btbbnn.exec:\btbbnn.exe65⤵
- Executes dropped EXE
PID:8 -
\??\c:\ddvpp.exec:\ddvpp.exe66⤵PID:4292
-
\??\c:\xxfrrxx.exec:\xxfrrxx.exe67⤵PID:808
-
\??\c:\9hnttb.exec:\9hnttb.exe68⤵PID:4524
-
\??\c:\jvjjd.exec:\jvjjd.exe69⤵PID:1180
-
\??\c:\xfrxlxr.exec:\xfrxlxr.exe70⤵PID:2460
-
\??\c:\httnht.exec:\httnht.exe71⤵PID:3432
-
\??\c:\9pppp.exec:\9pppp.exe72⤵PID:4468
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe73⤵PID:5024
-
\??\c:\1jppj.exec:\1jppj.exe74⤵PID:1636
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe75⤵PID:4964
-
\??\c:\tbnhnh.exec:\tbnhnh.exe76⤵PID:3436
-
\??\c:\nttttt.exec:\nttttt.exe77⤵PID:1004
-
\??\c:\pjvvp.exec:\pjvvp.exe78⤵PID:3184
-
\??\c:\hbthtn.exec:\hbthtn.exe79⤵PID:3784
-
\??\c:\9jvvp.exec:\9jvvp.exe80⤵PID:448
-
\??\c:\llrlrrx.exec:\llrlrrx.exe81⤵PID:5092
-
\??\c:\hbhbbh.exec:\hbhbbh.exe82⤵PID:3708
-
\??\c:\ppvjd.exec:\ppvjd.exe83⤵PID:2912
-
\??\c:\rlrlfll.exec:\rlrlfll.exe84⤵PID:4496
-
\??\c:\hhnhhh.exec:\hhnhhh.exe85⤵PID:4576
-
\??\c:\ddpvp.exec:\ddpvp.exe86⤵PID:3864
-
\??\c:\ppddd.exec:\ppddd.exe87⤵
- System Location Discovery: System Language Discovery
PID:940 -
\??\c:\xfrlffr.exec:\xfrlffr.exe88⤵PID:3060
-
\??\c:\hbhhhh.exec:\hbhhhh.exe89⤵PID:4568
-
\??\c:\7vjjd.exec:\7vjjd.exe90⤵PID:636
-
\??\c:\fxlffxr.exec:\fxlffxr.exe91⤵PID:408
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe92⤵PID:4108
-
\??\c:\vdddv.exec:\vdddv.exe93⤵PID:5088
-
\??\c:\pvddp.exec:\pvddp.exe94⤵PID:1552
-
\??\c:\frfxxrr.exec:\frfxxrr.exe95⤵PID:2944
-
\??\c:\hhnnnn.exec:\hhnnnn.exe96⤵PID:2976
-
\??\c:\7vddj.exec:\7vddj.exe97⤵PID:4948
-
\??\c:\fxxfflf.exec:\fxxfflf.exe98⤵PID:2780
-
\??\c:\hbnnnn.exec:\hbnnnn.exe99⤵PID:3484
-
\??\c:\ppppj.exec:\ppppj.exe100⤵PID:5080
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe101⤵PID:4828
-
\??\c:\hbttnn.exec:\hbttnn.exe102⤵PID:4408
-
\??\c:\ddjjj.exec:\ddjjj.exe103⤵PID:1940
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe104⤵PID:1112
-
\??\c:\jpvpj.exec:\jpvpj.exe105⤵PID:3724
-
\??\c:\dvvjd.exec:\dvvjd.exe106⤵PID:1440
-
\??\c:\5xffxxx.exec:\5xffxxx.exe107⤵PID:368
-
\??\c:\nbbbtt.exec:\nbbbtt.exe108⤵PID:3300
-
\??\c:\vpvpp.exec:\vpvpp.exe109⤵PID:1708
-
\??\c:\3rlrrrr.exec:\3rlrrrr.exe110⤵PID:2284
-
\??\c:\nttnhb.exec:\nttnhb.exe111⤵PID:2164
-
\??\c:\dpdvp.exec:\dpdvp.exe112⤵PID:2468
-
\??\c:\llxrrlf.exec:\llxrrlf.exe113⤵PID:1916
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe114⤵PID:2480
-
\??\c:\3bhbbb.exec:\3bhbbb.exe115⤵PID:5084
-
\??\c:\fxlxrfr.exec:\fxlxrfr.exe116⤵PID:3152
-
\??\c:\nthntt.exec:\nthntt.exe117⤵PID:760
-
\??\c:\pdjjd.exec:\pdjjd.exe118⤵PID:1748
-
\??\c:\jjjdd.exec:\jjjdd.exe119⤵PID:2036
-
\??\c:\llrxxxx.exec:\llrxxxx.exe120⤵PID:424
-
\??\c:\bhtttb.exec:\bhtttb.exe121⤵PID:4068
-
\??\c:\3ppdp.exec:\3ppdp.exe122⤵PID:3700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-