Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 12:18
Static task
static1
Behavioral task
behavioral1
Sample
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe
Resource
win7-20240903-en
General
-
Target
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe
-
Size
454KB
-
MD5
4431bc822bc994164ec19348049647bf
-
SHA1
0ef4aea2d83d2bedb102a899971d73be6103e173
-
SHA256
1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108
-
SHA512
44460bfa3b96bf37a7f0291cd8f93785775011434a47adde5b460f0e14f6ecb6ec1796561126b89a543032a2deb19d9fed1222053e957cfa75cf96500d1c69f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2584-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1952-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3188-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1016-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1284-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/184-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/400-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1696-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2732-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1068-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2692-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4152-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2480-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3540-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2520-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1444-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2244-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4696-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/656-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4236-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3312-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3584-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2184-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1368-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4100-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/572-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4964-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3744-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4656-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/816-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1840-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1952 jjdvp.exe 3848 xfxllfl.exe 3732 3tnhtn.exe 4016 djjvd.exe 4996 3frfrlf.exe 2152 rlrfrlf.exe 4576 hbbhth.exe 3188 dvvjd.exe 1016 lxrlfxr.exe 1284 vvpjj.exe 184 rlrlrlr.exe 400 7djvj.exe 2732 rflffff.exe 1696 dppvp.exe 1068 xffxrxr.exe 2276 pdvjp.exe 2692 pjvjj.exe 2300 7lrrrxx.exe 1364 jpvjd.exe 4152 lxxrllx.exe 468 frrlxlf.exe 3268 xxxfflf.exe 1596 bhnbnh.exe 4384 nbnbnh.exe 2188 7jjvv.exe 3792 tnthnh.exe 2480 xllrfrf.exe 3540 9bnhtt.exe 3144 1vvpj.exe 2520 ffrrxfl.exe 1444 7jjvj.exe 3628 xxxlrlr.exe 2244 pjjdd.exe 3928 pddpv.exe 2064 xflrfxr.exe 3496 tnbthh.exe 4676 vjjdv.exe 3992 fxfrfxf.exe 4696 xrxlxrl.exe 1488 nbbthb.exe 3344 pddpd.exe 1448 dvvjd.exe 656 frrlxrl.exe 1884 bnthth.exe 4236 nhnbth.exe 4352 vvdpj.exe 4808 rxxrrll.exe 3504 rffrfxr.exe 4456 ttbntt.exe 3848 jdjdd.exe 3312 xrlfrlf.exe 4548 frlxrlf.exe 4800 nhbhbn.exe 3580 pdjdv.exe 3584 9rxrrfr.exe 4476 lxrlllf.exe 2184 hnnbtn.exe 1368 3dpdp.exe 1004 3llxllf.exe 1016 9rfxfxl.exe 4636 tbbbnh.exe 3008 jpvjp.exe 1136 rlrlllf.exe 184 5ttnbt.exe -
resource yara_rule behavioral2/memory/2584-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3188-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1016-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1284-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/184-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/400-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1696-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2732-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1068-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2692-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4152-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3792-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2480-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3540-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2520-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1444-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2244-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4696-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/656-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4236-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3312-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3584-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2184-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1368-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4100-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2300-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/572-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4964-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3744-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4656-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-539-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxrlf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1952 2584 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 83 PID 2584 wrote to memory of 1952 2584 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 83 PID 2584 wrote to memory of 1952 2584 1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe 83 PID 1952 wrote to memory of 3848 1952 jjdvp.exe 84 PID 1952 wrote to memory of 3848 1952 jjdvp.exe 84 PID 1952 wrote to memory of 3848 1952 jjdvp.exe 84 PID 3848 wrote to memory of 3732 3848 xfxllfl.exe 85 PID 3848 wrote to memory of 3732 3848 xfxllfl.exe 85 PID 3848 wrote to memory of 3732 3848 xfxllfl.exe 85 PID 3732 wrote to memory of 4016 3732 3tnhtn.exe 86 PID 3732 wrote to memory of 4016 3732 3tnhtn.exe 86 PID 3732 wrote to memory of 4016 3732 3tnhtn.exe 86 PID 4016 wrote to memory of 4996 4016 djjvd.exe 87 PID 4016 wrote to memory of 4996 4016 djjvd.exe 87 PID 4016 wrote to memory of 4996 4016 djjvd.exe 87 PID 4996 wrote to memory of 2152 4996 3frfrlf.exe 88 PID 4996 wrote to memory of 2152 4996 3frfrlf.exe 88 PID 4996 wrote to memory of 2152 4996 3frfrlf.exe 88 PID 2152 wrote to memory of 4576 2152 rlrfrlf.exe 89 PID 2152 wrote to memory of 4576 2152 rlrfrlf.exe 89 PID 2152 wrote to memory of 4576 2152 rlrfrlf.exe 89 PID 4576 wrote to memory of 3188 4576 hbbhth.exe 90 PID 4576 wrote to memory of 3188 4576 hbbhth.exe 90 PID 4576 wrote to memory of 3188 4576 hbbhth.exe 90 PID 3188 wrote to memory of 1016 3188 dvvjd.exe 91 PID 3188 wrote to memory of 1016 3188 dvvjd.exe 91 PID 3188 wrote to memory of 1016 3188 dvvjd.exe 91 PID 1016 wrote to memory of 1284 1016 lxrlfxr.exe 92 PID 1016 wrote to memory of 1284 1016 lxrlfxr.exe 92 PID 1016 wrote to memory of 1284 1016 lxrlfxr.exe 92 PID 1284 wrote to memory of 184 1284 vvpjj.exe 93 PID 1284 wrote to memory of 184 1284 vvpjj.exe 93 PID 1284 wrote to memory of 184 1284 vvpjj.exe 93 PID 184 wrote to memory of 400 184 rlrlrlr.exe 94 PID 184 wrote to memory of 400 184 rlrlrlr.exe 94 PID 184 wrote to memory of 400 184 rlrlrlr.exe 94 PID 400 wrote to memory of 2732 400 7djvj.exe 95 PID 400 wrote to memory of 2732 400 7djvj.exe 95 PID 400 wrote to memory of 2732 400 7djvj.exe 95 PID 2732 wrote to memory of 1696 2732 rflffff.exe 96 PID 2732 wrote to memory of 1696 2732 rflffff.exe 96 PID 2732 wrote to memory of 1696 2732 rflffff.exe 96 PID 1696 wrote to memory of 1068 1696 dppvp.exe 97 PID 1696 wrote to memory of 1068 1696 dppvp.exe 97 PID 1696 wrote to memory of 1068 1696 dppvp.exe 97 PID 1068 wrote to memory of 2276 1068 xffxrxr.exe 98 PID 1068 wrote to memory of 2276 1068 xffxrxr.exe 98 PID 1068 wrote to memory of 2276 1068 xffxrxr.exe 98 PID 2276 wrote to memory of 2692 2276 pdvjp.exe 99 PID 2276 wrote to memory of 2692 2276 pdvjp.exe 99 PID 2276 wrote to memory of 2692 2276 pdvjp.exe 99 PID 2692 wrote to memory of 2300 2692 pjvjj.exe 100 PID 2692 wrote to memory of 2300 2692 pjvjj.exe 100 PID 2692 wrote to memory of 2300 2692 pjvjj.exe 100 PID 2300 wrote to memory of 1364 2300 7lrrrxx.exe 101 PID 2300 wrote to memory of 1364 2300 7lrrrxx.exe 101 PID 2300 wrote to memory of 1364 2300 7lrrrxx.exe 101 PID 1364 wrote to memory of 4152 1364 jpvjd.exe 102 PID 1364 wrote to memory of 4152 1364 jpvjd.exe 102 PID 1364 wrote to memory of 4152 1364 jpvjd.exe 102 PID 4152 wrote to memory of 468 4152 lxxrllx.exe 103 PID 4152 wrote to memory of 468 4152 lxxrllx.exe 103 PID 4152 wrote to memory of 468 4152 lxxrllx.exe 103 PID 468 wrote to memory of 3268 468 frrlxlf.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe"C:\Users\Admin\AppData\Local\Temp\1273a594a6afb7683d8af6905d1af3608891b1792450ae608f54761044421108.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\jjdvp.exec:\jjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\xfxllfl.exec:\xfxllfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\3tnhtn.exec:\3tnhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\djjvd.exec:\djjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\3frfrlf.exec:\3frfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rlrfrlf.exec:\rlrfrlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\hbbhth.exec:\hbbhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\dvvjd.exec:\dvvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\vvpjj.exec:\vvpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:184 -
\??\c:\7djvj.exec:\7djvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rflffff.exec:\rflffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\dppvp.exec:\dppvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\xffxrxr.exec:\xffxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\pdvjp.exec:\pdvjp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\pjvjj.exec:\pjvjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\7lrrrxx.exec:\7lrrrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\jpvjd.exec:\jpvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\lxxrllx.exec:\lxxrllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\frrlxlf.exec:\frrlxlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\xxxfflf.exec:\xxxfflf.exe23⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bhnbnh.exec:\bhnbnh.exe24⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbnbnh.exec:\nbnbnh.exe25⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7jjvv.exec:\7jjvv.exe26⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tnthnh.exec:\tnthnh.exe27⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xllrfrf.exec:\xllrfrf.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9bnhtt.exec:\9bnhtt.exe29⤵
- Executes dropped EXE
PID:3540 -
\??\c:\1vvpj.exec:\1vvpj.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7jjvj.exec:\7jjvj.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xxxlrlr.exec:\xxxlrlr.exe33⤵
- Executes dropped EXE
PID:3628 -
\??\c:\pjjdd.exec:\pjjdd.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pddpv.exec:\pddpv.exe35⤵
- Executes dropped EXE
PID:3928 -
\??\c:\xflrfxr.exec:\xflrfxr.exe36⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnbthh.exec:\tnbthh.exe37⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vjjdv.exec:\vjjdv.exe38⤵
- Executes dropped EXE
PID:4676 -
\??\c:\fxfrfxf.exec:\fxfrfxf.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xrxlxrl.exec:\xrxlxrl.exe40⤵
- Executes dropped EXE
PID:4696 -
\??\c:\nbbthb.exec:\nbbthb.exe41⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pddpd.exec:\pddpd.exe42⤵
- Executes dropped EXE
PID:3344 -
\??\c:\dvvjd.exec:\dvvjd.exe43⤵
- Executes dropped EXE
PID:1448 -
\??\c:\frrlxrl.exec:\frrlxrl.exe44⤵
- Executes dropped EXE
PID:656 -
\??\c:\bnthth.exec:\bnthth.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nhnbth.exec:\nhnbth.exe46⤵
- Executes dropped EXE
PID:4236 -
\??\c:\vvdpj.exec:\vvdpj.exe47⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rxxrrll.exec:\rxxrrll.exe48⤵
- Executes dropped EXE
PID:4808 -
\??\c:\rffrfxr.exec:\rffrfxr.exe49⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ttbntt.exec:\ttbntt.exe50⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jdjdd.exec:\jdjdd.exe51⤵
- Executes dropped EXE
PID:3848 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe52⤵
- Executes dropped EXE
PID:3312 -
\??\c:\frlxrlf.exec:\frlxrlf.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4548 -
\??\c:\nhbhbn.exec:\nhbhbn.exe54⤵
- Executes dropped EXE
PID:4800 -
\??\c:\pdjdv.exec:\pdjdv.exe55⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9rxrrfr.exec:\9rxrrfr.exe56⤵
- Executes dropped EXE
PID:3584 -
\??\c:\lxrlllf.exec:\lxrlllf.exe57⤵
- Executes dropped EXE
PID:4476 -
\??\c:\hnnbtn.exec:\hnnbtn.exe58⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3dpdp.exec:\3dpdp.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3llxllf.exec:\3llxllf.exe60⤵
- Executes dropped EXE
PID:1004 -
\??\c:\9rfxfxl.exec:\9rfxfxl.exe61⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tbbbnh.exec:\tbbbnh.exe62⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jpvjp.exec:\jpvjp.exe63⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rlrlllf.exec:\rlrlllf.exe64⤵
- Executes dropped EXE
PID:1136 -
\??\c:\5ttnbt.exec:\5ttnbt.exe65⤵
- Executes dropped EXE
PID:184 -
\??\c:\thhbtt.exec:\thhbtt.exe66⤵PID:4100
-
\??\c:\jpdvd.exec:\jpdvd.exe67⤵PID:696
-
\??\c:\7rxrfxl.exec:\7rxrfxl.exe68⤵PID:2236
-
\??\c:\btnhtb.exec:\btnhtb.exe69⤵PID:4580
-
\??\c:\vjpjd.exec:\vjpjd.exe70⤵PID:5040
-
\??\c:\xllxlfx.exec:\xllxlfx.exe71⤵PID:2276
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe72⤵PID:384
-
\??\c:\7ntnhh.exec:\7ntnhh.exe73⤵PID:2300
-
\??\c:\dpvpj.exec:\dpvpj.exe74⤵PID:3064
-
\??\c:\vppjv.exec:\vppjv.exe75⤵PID:572
-
\??\c:\flxrlfx.exec:\flxrlfx.exe76⤵PID:4144
-
\??\c:\tnbhth.exec:\tnbhth.exe77⤵PID:4280
-
\??\c:\dpjdv.exec:\dpjdv.exe78⤵PID:948
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe79⤵PID:3724
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe80⤵PID:1596
-
\??\c:\hbnbtn.exec:\hbnbtn.exe81⤵PID:4196
-
\??\c:\vjjdj.exec:\vjjdj.exe82⤵PID:2968
-
\??\c:\xlllxrl.exec:\xlllxrl.exe83⤵PID:1084
-
\??\c:\btbnnn.exec:\btbnnn.exe84⤵PID:3792
-
\??\c:\9tbthb.exec:\9tbthb.exe85⤵PID:2924
-
\??\c:\jpvpd.exec:\jpvpd.exe86⤵PID:3940
-
\??\c:\jpvjv.exec:\jpvjv.exe87⤵PID:2944
-
\??\c:\1lllfll.exec:\1lllfll.exe88⤵PID:4964
-
\??\c:\bnnbnh.exec:\bnnbnh.exe89⤵PID:3144
-
\??\c:\jjdvp.exec:\jjdvp.exe90⤵PID:2520
-
\??\c:\jpvpd.exec:\jpvpd.exe91⤵PID:2420
-
\??\c:\fxlflrx.exec:\fxlflrx.exe92⤵PID:2212
-
\??\c:\3bthbt.exec:\3bthbt.exe93⤵PID:2912
-
\??\c:\hnthtn.exec:\hnthtn.exe94⤵PID:4028
-
\??\c:\pddvv.exec:\pddvv.exe95⤵PID:4728
-
\??\c:\1rrfrlf.exec:\1rrfrlf.exe96⤵PID:2092
-
\??\c:\htbbbt.exec:\htbbbt.exe97⤵PID:2120
-
\??\c:\thhhbb.exec:\thhhbb.exe98⤵PID:4848
-
\??\c:\vvdjp.exec:\vvdjp.exe99⤵PID:1140
-
\??\c:\llrlrlf.exec:\llrlrlf.exe100⤵PID:4956
-
\??\c:\rffxxxl.exec:\rffxxxl.exe101⤵PID:1488
-
\??\c:\tnnhbt.exec:\tnnhbt.exe102⤵PID:1636
-
\??\c:\jdjdd.exec:\jdjdd.exe103⤵PID:1448
-
\??\c:\5jjpd.exec:\5jjpd.exe104⤵PID:656
-
\??\c:\frrlxrf.exec:\frrlxrf.exe105⤵PID:4360
-
\??\c:\nntnbn.exec:\nntnbn.exe106⤵PID:4236
-
\??\c:\thnnhb.exec:\thnnhb.exe107⤵PID:4352
-
\??\c:\dpvpd.exec:\dpvpd.exe108⤵PID:4880
-
\??\c:\lxlxrrf.exec:\lxlxrrf.exe109⤵PID:3744
-
\??\c:\llrlxrf.exec:\llrlxrf.exe110⤵PID:512
-
\??\c:\vpvjd.exec:\vpvjd.exe111⤵PID:4176
-
\??\c:\jvvjv.exec:\jvvjv.exe112⤵PID:2204
-
\??\c:\lfrffxf.exec:\lfrffxf.exe113⤵PID:116
-
\??\c:\bhhhtn.exec:\bhhhtn.exe114⤵PID:2240
-
\??\c:\7thtbb.exec:\7thtbb.exe115⤵PID:3580
-
\??\c:\pddvp.exec:\pddvp.exe116⤵PID:5048
-
\??\c:\7rlfxxl.exec:\7rlfxxl.exe117⤵PID:1968
-
\??\c:\rrxfxrl.exec:\rrxfxrl.exe118⤵PID:4860
-
\??\c:\bhhbth.exec:\bhhbth.exe119⤵PID:5012
-
\??\c:\ppvpv.exec:\ppvpv.exe120⤵
- System Location Discovery: System Language Discovery
PID:5024 -
\??\c:\vpdvv.exec:\vpdvv.exe121⤵PID:2656
-
\??\c:\lflflll.exec:\lflflll.exe122⤵PID:3440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-