Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 14:10
Static task
static1
Behavioral task
behavioral1
Sample
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe
Resource
win7-20240903-en
General
-
Target
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe
-
Size
454KB
-
MD5
7f1afc6a8cdb558b3d0939c622ca1410
-
SHA1
9a48a872f1815d2edebfddb2530529a648c95c91
-
SHA256
a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639
-
SHA512
ff439d0659790c109fa2ce27abb7bec9c517ab93e6fb2a65c48939553bb7f75de344ad25ed61fb1f77b90679612789170add74a8ec04ae0c5f4f3745573d2121
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1136-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2068-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2296-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4412-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/920-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3516-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3136-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/648-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1780-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/964-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3052-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2008-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3456-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2824-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2064-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3304-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2248-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2716-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4832-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2240-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1584-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3696-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3876-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3012-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-862-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/8-965-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2576-1101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-1268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-1895-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3516 bhbtnh.exe 3456 vpppp.exe 2068 rrlxlfx.exe 3208 3frlxxr.exe 4992 tbhbbn.exe 5068 dddvp.exe 2008 vjddv.exe 3052 lrlxrlf.exe 5084 7bbbnn.exe 2948 3tnhtb.exe 1572 9ppdv.exe 432 9llffrl.exe 3640 hnhtnh.exe 3164 ttthnb.exe 1724 jjdvp.exe 4964 frxxlfx.exe 636 bttnhb.exe 3452 tbbttn.exe 4488 djpdv.exe 3816 lfxrfxl.exe 2128 5lrlffr.exe 2316 hhnnnh.exe 2988 jjdvp.exe 964 xxfxfxr.exe 2440 llrlfxr.exe 2688 7ththt.exe 2496 vpdpj.exe 1584 rffxlfx.exe 3584 7fxrllf.exe 2296 nbhthn.exe 4640 dvvjd.exe 544 vpjdp.exe 1780 rrlfxrl.exe 1456 btbbnn.exe 1176 5vpvp.exe 648 9jdpd.exe 4848 1xrlxxr.exe 4924 bbthtt.exe 4932 hbthbb.exe 2284 7vpjv.exe 1748 rfxrlfx.exe 4804 lfxrffx.exe 3656 hhnhbt.exe 2060 pdvpd.exe 2064 dvpvj.exe 32 1rlfxxr.exe 3476 hnbtnh.exe 696 bhhbnn.exe 3136 jdpjd.exe 2256 frrrllf.exe 4132 7nnbtn.exe 452 thbbtt.exe 4540 vjjdp.exe 4428 rffffrr.exe 1136 9rlfxxl.exe 3516 tttnhb.exe 2020 dvdvj.exe 4392 jpdvp.exe 3212 lllrxxf.exe 4336 nbnbnh.exe 2812 5dvpj.exe 3924 1pvpp.exe 4412 fxxrffx.exe 920 9ttntt.exe -
resource yara_rule behavioral2/memory/1136-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2296-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2284-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4412-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3516-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3136-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/648-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1780-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/964-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3816-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3052-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2008-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3456-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2064-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3304-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1952-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2248-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2716-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4832-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2240-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3696-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3912-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3876-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3012-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4968-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-862-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/8-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-1012-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1136 wrote to memory of 3516 1136 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 83 PID 1136 wrote to memory of 3516 1136 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 83 PID 1136 wrote to memory of 3516 1136 a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe 83 PID 3516 wrote to memory of 3456 3516 bhbtnh.exe 84 PID 3516 wrote to memory of 3456 3516 bhbtnh.exe 84 PID 3516 wrote to memory of 3456 3516 bhbtnh.exe 84 PID 3456 wrote to memory of 2068 3456 vpppp.exe 85 PID 3456 wrote to memory of 2068 3456 vpppp.exe 85 PID 3456 wrote to memory of 2068 3456 vpppp.exe 85 PID 2068 wrote to memory of 3208 2068 rrlxlfx.exe 86 PID 2068 wrote to memory of 3208 2068 rrlxlfx.exe 86 PID 2068 wrote to memory of 3208 2068 rrlxlfx.exe 86 PID 3208 wrote to memory of 4992 3208 3frlxxr.exe 87 PID 3208 wrote to memory of 4992 3208 3frlxxr.exe 87 PID 3208 wrote to memory of 4992 3208 3frlxxr.exe 87 PID 4992 wrote to memory of 5068 4992 tbhbbn.exe 88 PID 4992 wrote to memory of 5068 4992 tbhbbn.exe 88 PID 4992 wrote to memory of 5068 4992 tbhbbn.exe 88 PID 5068 wrote to memory of 2008 5068 dddvp.exe 89 PID 5068 wrote to memory of 2008 5068 dddvp.exe 89 PID 5068 wrote to memory of 2008 5068 dddvp.exe 89 PID 2008 wrote to memory of 3052 2008 vjddv.exe 90 PID 2008 wrote to memory of 3052 2008 vjddv.exe 90 PID 2008 wrote to memory of 3052 2008 vjddv.exe 90 PID 3052 wrote to memory of 5084 3052 lrlxrlf.exe 91 PID 3052 wrote to memory of 5084 3052 lrlxrlf.exe 91 PID 3052 wrote to memory of 5084 3052 lrlxrlf.exe 91 PID 5084 wrote to memory of 2948 5084 7bbbnn.exe 92 PID 5084 wrote to memory of 2948 5084 7bbbnn.exe 92 PID 5084 wrote to memory of 2948 5084 7bbbnn.exe 92 PID 2948 wrote to memory of 1572 2948 3tnhtb.exe 93 PID 2948 wrote to memory of 1572 2948 3tnhtb.exe 93 PID 2948 wrote to memory of 1572 2948 3tnhtb.exe 93 PID 1572 wrote to memory of 432 1572 9ppdv.exe 94 PID 1572 wrote to memory of 432 1572 9ppdv.exe 94 PID 1572 wrote to memory of 432 1572 9ppdv.exe 94 PID 432 wrote to memory of 3640 432 9llffrl.exe 95 PID 432 wrote to memory of 3640 432 9llffrl.exe 95 PID 432 wrote to memory of 3640 432 9llffrl.exe 95 PID 3640 wrote to memory of 3164 3640 hnhtnh.exe 96 PID 3640 wrote to memory of 3164 3640 hnhtnh.exe 96 PID 3640 wrote to memory of 3164 3640 hnhtnh.exe 96 PID 3164 wrote to memory of 1724 3164 ttthnb.exe 97 PID 3164 wrote to memory of 1724 3164 ttthnb.exe 97 PID 3164 wrote to memory of 1724 3164 ttthnb.exe 97 PID 1724 wrote to memory of 4964 1724 jjdvp.exe 98 PID 1724 wrote to memory of 4964 1724 jjdvp.exe 98 PID 1724 wrote to memory of 4964 1724 jjdvp.exe 98 PID 4964 wrote to memory of 636 4964 frxxlfx.exe 99 PID 4964 wrote to memory of 636 4964 frxxlfx.exe 99 PID 4964 wrote to memory of 636 4964 frxxlfx.exe 99 PID 636 wrote to memory of 3452 636 bttnhb.exe 100 PID 636 wrote to memory of 3452 636 bttnhb.exe 100 PID 636 wrote to memory of 3452 636 bttnhb.exe 100 PID 3452 wrote to memory of 4488 3452 tbbttn.exe 155 PID 3452 wrote to memory of 4488 3452 tbbttn.exe 155 PID 3452 wrote to memory of 4488 3452 tbbttn.exe 155 PID 4488 wrote to memory of 3816 4488 djpdv.exe 102 PID 4488 wrote to memory of 3816 4488 djpdv.exe 102 PID 4488 wrote to memory of 3816 4488 djpdv.exe 102 PID 3816 wrote to memory of 2128 3816 lfxrfxl.exe 103 PID 3816 wrote to memory of 2128 3816 lfxrfxl.exe 103 PID 3816 wrote to memory of 2128 3816 lfxrfxl.exe 103 PID 2128 wrote to memory of 2316 2128 5lrlffr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe"C:\Users\Admin\AppData\Local\Temp\a16c3203f87b58ae2247950e66499eb31c720170d786b1d37ed3304f9eb6e639N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\bhbtnh.exec:\bhbtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\vpppp.exec:\vpppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\3frlxxr.exec:\3frlxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\tbhbbn.exec:\tbhbbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\dddvp.exec:\dddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\vjddv.exec:\vjddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\7bbbnn.exec:\7bbbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\3tnhtb.exec:\3tnhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9ppdv.exec:\9ppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\9llffrl.exec:\9llffrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\hnhtnh.exec:\hnhtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\ttthnb.exec:\ttthnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\jjdvp.exec:\jjdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\frxxlfx.exec:\frxxlfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\bttnhb.exec:\bttnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tbbttn.exec:\tbbttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\djpdv.exec:\djpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\5lrlffr.exec:\5lrlffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hhnnnh.exec:\hhnnnh.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\jjdvp.exec:\jjdvp.exe24⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxfxfxr.exec:\xxfxfxr.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\llrlfxr.exec:\llrlfxr.exe26⤵
- Executes dropped EXE
PID:2440 -
\??\c:\7ththt.exec:\7ththt.exe27⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vpdpj.exec:\vpdpj.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rffxlfx.exec:\rffxlfx.exe29⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7fxrllf.exec:\7fxrllf.exe30⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nbhthn.exec:\nbhthn.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\dvvjd.exec:\dvvjd.exe32⤵
- Executes dropped EXE
PID:4640 -
\??\c:\vpjdp.exec:\vpjdp.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrlfxrl.exec:\rrlfxrl.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\btbbnn.exec:\btbbnn.exe35⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5vpvp.exec:\5vpvp.exe36⤵
- Executes dropped EXE
PID:1176 -
\??\c:\9jdpd.exec:\9jdpd.exe37⤵
- Executes dropped EXE
PID:648 -
\??\c:\1xrlxxr.exec:\1xrlxxr.exe38⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bbthtt.exec:\bbthtt.exe39⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hbthbb.exec:\hbthbb.exe40⤵
- Executes dropped EXE
PID:4932 -
\??\c:\7vpjv.exec:\7vpjv.exe41⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe42⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lfxrffx.exec:\lfxrffx.exe43⤵
- Executes dropped EXE
PID:4804 -
\??\c:\hhnhbt.exec:\hhnhbt.exe44⤵
- Executes dropped EXE
PID:3656 -
\??\c:\pdvpd.exec:\pdvpd.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dvpvj.exec:\dvpvj.exe46⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1rlfxxr.exec:\1rlfxxr.exe47⤵
- Executes dropped EXE
PID:32 -
\??\c:\hnbtnh.exec:\hnbtnh.exe48⤵
- Executes dropped EXE
PID:3476 -
\??\c:\bhhbnn.exec:\bhhbnn.exe49⤵
- Executes dropped EXE
PID:696 -
\??\c:\jdpjd.exec:\jdpjd.exe50⤵
- Executes dropped EXE
PID:3136 -
\??\c:\frrrllf.exec:\frrrllf.exe51⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7nnbtn.exec:\7nnbtn.exe52⤵
- Executes dropped EXE
PID:4132 -
\??\c:\thbbtt.exec:\thbbtt.exe53⤵
- Executes dropped EXE
PID:452 -
\??\c:\vjjdp.exec:\vjjdp.exe54⤵
- Executes dropped EXE
PID:4540 -
\??\c:\rffffrr.exec:\rffffrr.exe55⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9rlfxxl.exec:\9rlfxxl.exe56⤵
- Executes dropped EXE
PID:1136 -
\??\c:\tttnhb.exec:\tttnhb.exe57⤵
- Executes dropped EXE
PID:3516 -
\??\c:\dvdvj.exec:\dvdvj.exe58⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jpdvp.exec:\jpdvp.exe59⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lllrxxf.exec:\lllrxxf.exe60⤵
- Executes dropped EXE
PID:3212 -
\??\c:\nbnbnh.exec:\nbnbnh.exe61⤵
- Executes dropped EXE
PID:4336 -
\??\c:\5dvpj.exec:\5dvpj.exe62⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1pvpp.exec:\1pvpp.exe63⤵
- Executes dropped EXE
PID:3924 -
\??\c:\fxxrffx.exec:\fxxrffx.exe64⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9ttntt.exec:\9ttntt.exe65⤵
- Executes dropped EXE
PID:920 -
\??\c:\3hhtnn.exec:\3hhtnn.exe66⤵PID:1612
-
\??\c:\dvvpd.exec:\dvvpd.exe67⤵PID:1740
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe68⤵PID:4996
-
\??\c:\nthbnn.exec:\nthbnn.exe69⤵PID:1316
-
\??\c:\pvvjd.exec:\pvvjd.exe70⤵PID:2600
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe71⤵PID:4760
-
\??\c:\pvvdv.exec:\pvvdv.exe72⤵PID:5040
-
\??\c:\1ppdv.exec:\1ppdv.exe73⤵PID:4352
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe74⤵PID:4488
-
\??\c:\5jjvp.exec:\5jjvp.exe75⤵PID:2576
-
\??\c:\9rfxrrf.exec:\9rfxrrf.exe76⤵PID:1220
-
\??\c:\ttbthh.exec:\ttbthh.exe77⤵PID:4060
-
\??\c:\ddjpv.exec:\ddjpv.exe78⤵PID:2888
-
\??\c:\frrlffx.exec:\frrlffx.exe79⤵PID:2192
-
\??\c:\tthhbt.exec:\tthhbt.exe80⤵PID:1224
-
\??\c:\ttbbbh.exec:\ttbbbh.exe81⤵PID:2688
-
\??\c:\ddvvp.exec:\ddvvp.exe82⤵PID:2648
-
\??\c:\1fffxfx.exec:\1fffxfx.exe83⤵PID:4448
-
\??\c:\7tnhbb.exec:\7tnhbb.exe84⤵PID:4820
-
\??\c:\1hhbtn.exec:\1hhbtn.exe85⤵PID:5028
-
\??\c:\ddjdv.exec:\ddjdv.exe86⤵PID:4744
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe87⤵PID:4840
-
\??\c:\tttttt.exec:\tttttt.exe88⤵PID:4568
-
\??\c:\ppvjj.exec:\ppvjj.exe89⤵PID:2824
-
\??\c:\vjvvp.exec:\vjvvp.exe90⤵PID:3956
-
\??\c:\thhbbn.exec:\thhbbn.exe91⤵PID:1532
-
\??\c:\hnhbbb.exec:\hnhbbb.exe92⤵PID:3980
-
\??\c:\pjpjd.exec:\pjpjd.exe93⤵PID:376
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe94⤵PID:2588
-
\??\c:\ppddv.exec:\ppddv.exe95⤵PID:2088
-
\??\c:\5rrlffx.exec:\5rrlffx.exe96⤵PID:4660
-
\??\c:\bhbtnh.exec:\bhbtnh.exe97⤵
- System Location Discovery: System Language Discovery
PID:3964 -
\??\c:\hbhnhb.exec:\hbhnhb.exe98⤵PID:3656
-
\??\c:\9vpjd.exec:\9vpjd.exe99⤵PID:2352
-
\??\c:\3lrxlfx.exec:\3lrxlfx.exe100⤵PID:2064
-
\??\c:\ntbttt.exec:\ntbttt.exe101⤵PID:4608
-
\??\c:\pvjdv.exec:\pvjdv.exe102⤵PID:2664
-
\??\c:\ffrlxxl.exec:\ffrlxxl.exe103⤵PID:696
-
\??\c:\nthhnb.exec:\nthhnb.exe104⤵PID:2700
-
\??\c:\llfxllf.exec:\llfxllf.exe105⤵PID:4368
-
\??\c:\hhbbbb.exec:\hhbbbb.exe106⤵PID:3340
-
\??\c:\jppjd.exec:\jppjd.exe107⤵PID:4324
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe108⤵PID:2768
-
\??\c:\xllfffr.exec:\xllfffr.exe109⤵PID:1412
-
\??\c:\jpjjd.exec:\jpjjd.exe110⤵PID:5024
-
\??\c:\fflxfll.exec:\fflxfll.exe111⤵PID:3304
-
\??\c:\jvvpj.exec:\jvvpj.exe112⤵PID:1952
-
\??\c:\ddddp.exec:\ddddp.exe113⤵PID:2248
-
\??\c:\llrrffx.exec:\llrrffx.exe114⤵PID:4232
-
\??\c:\nnbbth.exec:\nnbbth.exe115⤵PID:1844
-
\??\c:\pddjd.exec:\pddjd.exe116⤵PID:3212
-
\??\c:\1vppd.exec:\1vppd.exe117⤵PID:1144
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe118⤵PID:5108
-
\??\c:\hnhbhh.exec:\hnhbhh.exe119⤵PID:3992
-
\??\c:\ddvpj.exec:\ddvpj.exe120⤵PID:2008
-
\??\c:\jjjdv.exec:\jjjdv.exe121⤵PID:1216
-
\??\c:\nhnthh.exec:\nhnthh.exe122⤵PID:4412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-