Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 15:32
Static task
static1
Behavioral task
behavioral1
Sample
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe
Resource
win7-20240729-en
General
-
Target
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe
-
Size
453KB
-
MD5
2d9e64dac154b68e4c611618b24011ac
-
SHA1
0efcaddf18eb50ee38416e2ba8530e6f1809e309
-
SHA256
7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af
-
SHA512
baf2057ca023ff6c50d8a8abb496f9041118a21c443b4d2fb90c9ed9705a5f8c43261112d1a2e4b8a4dc7ea6e93413d6470aee3c05d8e0adf51f8ca32530d047
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2464-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2556-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/624-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/628-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2916-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3104-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4720-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1176-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4056-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4360-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2836-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3972-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4032-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2024-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/944-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2432-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1396-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4584-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/540-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2360-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1748-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2928-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4288-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/972-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3144-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3736-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2388-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-1067-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-1550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2556 9vjjp.exe 1260 xrrlxxx.exe 2920 9tbttb.exe 4916 vdjdj.exe 4940 5rrllxf.exe 2928 rrrlfxr.exe 1748 3nnnhh.exe 2904 pjpvv.exe 2360 pvpdv.exe 4368 xffffff.exe 2804 frrlffx.exe 3208 ntnntb.exe 540 jjddv.exe 4584 frlrlrr.exe 2548 xfffxxx.exe 2440 nttttb.exe 4972 hnnnnt.exe 5116 djjjj.exe 1472 7rfxrrl.exe 2832 xrfxxrr.exe 624 9ttnhn.exe 1396 jpppp.exe 2432 9jjdv.exe 748 rlrllll.exe 4512 nnttnn.exe 1264 hhhbtt.exe 3464 5dppv.exe 976 fllllll.exe 3364 7lrrlll.exe 4260 bhhhht.exe 3492 9dvvp.exe 4044 1xlfxrx.exe 4572 xlfrllx.exe 3496 bhnhtt.exe 4796 jvjjd.exe 3712 jjjjd.exe 944 xxfffll.exe 4392 tbbnhn.exe 4736 hhbhbb.exe 1600 pvppp.exe 2024 xxxlxrl.exe 3792 flrlffx.exe 2848 tbnhbb.exe 4700 djddv.exe 4032 ddjpp.exe 3092 1ffxxxr.exe 2608 nnhhbb.exe 3084 htnnhh.exe 1640 vjvjj.exe 628 1vvpp.exe 4516 xfllrrf.exe 3972 tnnnnt.exe 1736 ttbtnn.exe 2836 jjjdd.exe 4360 5rxxrxl.exe 4056 xxffxxx.exe 4576 hbhhhb.exe 1176 dpppj.exe 836 jpvpd.exe 4320 fxrlffx.exe 432 hbhhbt.exe 4720 tthbbb.exe 3532 ddjdv.exe 3104 fxlfxxr.exe -
resource yara_rule behavioral2/memory/2464-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2556-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/624-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/628-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4652-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3104-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4720-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1176-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4056-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4360-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2836-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3972-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4032-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2024-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/944-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2432-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1396-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4584-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/540-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2360-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2904-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1748-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2928-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1688-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4288-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/972-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3144-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3736-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2388-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-1067-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2556 2464 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 83 PID 2464 wrote to memory of 2556 2464 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 83 PID 2464 wrote to memory of 2556 2464 7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe 83 PID 2556 wrote to memory of 1260 2556 9vjjp.exe 84 PID 2556 wrote to memory of 1260 2556 9vjjp.exe 84 PID 2556 wrote to memory of 1260 2556 9vjjp.exe 84 PID 1260 wrote to memory of 2920 1260 xrrlxxx.exe 85 PID 1260 wrote to memory of 2920 1260 xrrlxxx.exe 85 PID 1260 wrote to memory of 2920 1260 xrrlxxx.exe 85 PID 2920 wrote to memory of 4916 2920 9tbttb.exe 86 PID 2920 wrote to memory of 4916 2920 9tbttb.exe 86 PID 2920 wrote to memory of 4916 2920 9tbttb.exe 86 PID 4916 wrote to memory of 4940 4916 vdjdj.exe 87 PID 4916 wrote to memory of 4940 4916 vdjdj.exe 87 PID 4916 wrote to memory of 4940 4916 vdjdj.exe 87 PID 4940 wrote to memory of 2928 4940 5rrllxf.exe 88 PID 4940 wrote to memory of 2928 4940 5rrllxf.exe 88 PID 4940 wrote to memory of 2928 4940 5rrllxf.exe 88 PID 2928 wrote to memory of 1748 2928 rrrlfxr.exe 89 PID 2928 wrote to memory of 1748 2928 rrrlfxr.exe 89 PID 2928 wrote to memory of 1748 2928 rrrlfxr.exe 89 PID 1748 wrote to memory of 2904 1748 3nnnhh.exe 90 PID 1748 wrote to memory of 2904 1748 3nnnhh.exe 90 PID 1748 wrote to memory of 2904 1748 3nnnhh.exe 90 PID 2904 wrote to memory of 2360 2904 pjpvv.exe 91 PID 2904 wrote to memory of 2360 2904 pjpvv.exe 91 PID 2904 wrote to memory of 2360 2904 pjpvv.exe 91 PID 2360 wrote to memory of 4368 2360 pvpdv.exe 92 PID 2360 wrote to memory of 4368 2360 pvpdv.exe 92 PID 2360 wrote to memory of 4368 2360 pvpdv.exe 92 PID 4368 wrote to memory of 2804 4368 xffffff.exe 93 PID 4368 wrote to memory of 2804 4368 xffffff.exe 93 PID 4368 wrote to memory of 2804 4368 xffffff.exe 93 PID 2804 wrote to memory of 3208 2804 frrlffx.exe 94 PID 2804 wrote to memory of 3208 2804 frrlffx.exe 94 PID 2804 wrote to memory of 3208 2804 frrlffx.exe 94 PID 3208 wrote to memory of 540 3208 ntnntb.exe 95 PID 3208 wrote to memory of 540 3208 ntnntb.exe 95 PID 3208 wrote to memory of 540 3208 ntnntb.exe 95 PID 540 wrote to memory of 4584 540 jjddv.exe 96 PID 540 wrote to memory of 4584 540 jjddv.exe 96 PID 540 wrote to memory of 4584 540 jjddv.exe 96 PID 4584 wrote to memory of 2548 4584 frlrlrr.exe 97 PID 4584 wrote to memory of 2548 4584 frlrlrr.exe 97 PID 4584 wrote to memory of 2548 4584 frlrlrr.exe 97 PID 2548 wrote to memory of 2440 2548 xfffxxx.exe 98 PID 2548 wrote to memory of 2440 2548 xfffxxx.exe 98 PID 2548 wrote to memory of 2440 2548 xfffxxx.exe 98 PID 2440 wrote to memory of 4972 2440 nttttb.exe 99 PID 2440 wrote to memory of 4972 2440 nttttb.exe 99 PID 2440 wrote to memory of 4972 2440 nttttb.exe 99 PID 4972 wrote to memory of 5116 4972 hnnnnt.exe 100 PID 4972 wrote to memory of 5116 4972 hnnnnt.exe 100 PID 4972 wrote to memory of 5116 4972 hnnnnt.exe 100 PID 5116 wrote to memory of 1472 5116 djjjj.exe 101 PID 5116 wrote to memory of 1472 5116 djjjj.exe 101 PID 5116 wrote to memory of 1472 5116 djjjj.exe 101 PID 1472 wrote to memory of 2832 1472 7rfxrrl.exe 102 PID 1472 wrote to memory of 2832 1472 7rfxrrl.exe 102 PID 1472 wrote to memory of 2832 1472 7rfxrrl.exe 102 PID 2832 wrote to memory of 624 2832 xrfxxrr.exe 103 PID 2832 wrote to memory of 624 2832 xrfxxrr.exe 103 PID 2832 wrote to memory of 624 2832 xrfxxrr.exe 103 PID 624 wrote to memory of 1396 624 9ttnhn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe"C:\Users\Admin\AppData\Local\Temp\7ebe843212271d6360c3c840deb713a2e063b6ab35727b6caa272ce49d82d0af.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\9vjjp.exec:\9vjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\9tbttb.exec:\9tbttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vdjdj.exec:\vdjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\5rrllxf.exec:\5rrllxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3nnnhh.exec:\3nnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\pjpvv.exec:\pjpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\pvpdv.exec:\pvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xffffff.exec:\xffffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\frrlffx.exec:\frrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ntnntb.exec:\ntnntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\jjddv.exec:\jjddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\frlrlrr.exec:\frlrlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\xfffxxx.exec:\xfffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\nttttb.exec:\nttttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hnnnnt.exec:\hnnnnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\djjjj.exec:\djjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\7rfxrrl.exec:\7rfxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9ttnhn.exec:\9ttnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\jpppp.exec:\jpppp.exe23⤵
- Executes dropped EXE
PID:1396 -
\??\c:\9jjdv.exec:\9jjdv.exe24⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlrllll.exec:\rlrllll.exe25⤵
- Executes dropped EXE
PID:748 -
\??\c:\nnttnn.exec:\nnttnn.exe26⤵
- Executes dropped EXE
PID:4512 -
\??\c:\hhhbtt.exec:\hhhbtt.exe27⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5dppv.exec:\5dppv.exe28⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fllllll.exec:\fllllll.exe29⤵
- Executes dropped EXE
PID:976 -
\??\c:\7lrrlll.exec:\7lrrlll.exe30⤵
- Executes dropped EXE
PID:3364 -
\??\c:\bhhhht.exec:\bhhhht.exe31⤵
- Executes dropped EXE
PID:4260 -
\??\c:\9dvvp.exec:\9dvvp.exe32⤵
- Executes dropped EXE
PID:3492 -
\??\c:\1xlfxrx.exec:\1xlfxrx.exe33⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xlfrllx.exec:\xlfrllx.exe34⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bhnhtt.exec:\bhnhtt.exe35⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jvjjd.exec:\jvjjd.exe36⤵
- Executes dropped EXE
PID:4796 -
\??\c:\jjjjd.exec:\jjjjd.exe37⤵
- Executes dropped EXE
PID:3712 -
\??\c:\xxfffll.exec:\xxfffll.exe38⤵
- Executes dropped EXE
PID:944 -
\??\c:\tbbnhn.exec:\tbbnhn.exe39⤵
- Executes dropped EXE
PID:4392 -
\??\c:\hhbhbb.exec:\hhbhbb.exe40⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pvppp.exec:\pvppp.exe41⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe42⤵
- Executes dropped EXE
PID:2024 -
\??\c:\flrlffx.exec:\flrlffx.exe43⤵
- Executes dropped EXE
PID:3792 -
\??\c:\tbnhbb.exec:\tbnhbb.exe44⤵
- Executes dropped EXE
PID:2848 -
\??\c:\djddv.exec:\djddv.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\ddjpp.exec:\ddjpp.exe46⤵
- Executes dropped EXE
PID:4032 -
\??\c:\1ffxxxr.exec:\1ffxxxr.exe47⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nnhhbb.exec:\nnhhbb.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:3084 -
\??\c:\vjvjj.exec:\vjvjj.exe50⤵
- Executes dropped EXE
PID:1640 -
\??\c:\1vvpp.exec:\1vvpp.exe51⤵
- Executes dropped EXE
PID:628 -
\??\c:\xfllrrf.exec:\xfllrrf.exe52⤵
- Executes dropped EXE
PID:4516 -
\??\c:\tnnnnt.exec:\tnnnnt.exe53⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ttbtnn.exec:\ttbtnn.exe54⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjjdd.exec:\jjjdd.exe55⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5rxxrxl.exec:\5rxxrxl.exe56⤵
- Executes dropped EXE
PID:4360 -
\??\c:\xxffxxx.exec:\xxffxxx.exe57⤵
- Executes dropped EXE
PID:4056 -
\??\c:\hbhhhb.exec:\hbhhhb.exe58⤵
- Executes dropped EXE
PID:4576 -
\??\c:\dpppj.exec:\dpppj.exe59⤵
- Executes dropped EXE
PID:1176 -
\??\c:\jpvpd.exec:\jpvpd.exe60⤵
- Executes dropped EXE
PID:836 -
\??\c:\fxrlffx.exec:\fxrlffx.exe61⤵
- Executes dropped EXE
PID:4320 -
\??\c:\hbhhbt.exec:\hbhhbt.exe62⤵
- Executes dropped EXE
PID:432 -
\??\c:\tthbbb.exec:\tthbbb.exe63⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ddjdv.exec:\ddjdv.exe64⤵
- Executes dropped EXE
PID:3532 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe65⤵
- Executes dropped EXE
PID:3104 -
\??\c:\frfxxxx.exec:\frfxxxx.exe66⤵PID:2108
-
\??\c:\tbtnhh.exec:\tbtnhh.exe67⤵PID:4940
-
\??\c:\djppj.exec:\djppj.exe68⤵PID:4880
-
\??\c:\ppppp.exec:\ppppp.exe69⤵PID:4000
-
\??\c:\lrlffxx.exec:\lrlffxx.exe70⤵PID:4388
-
\??\c:\ntbbbb.exec:\ntbbbb.exe71⤵PID:2904
-
\??\c:\nnhbtn.exec:\nnhbtn.exe72⤵PID:2916
-
\??\c:\vvddj.exec:\vvddj.exe73⤵PID:4536
-
\??\c:\fflffrl.exec:\fflffrl.exe74⤵PID:2032
-
\??\c:\7ntnhb.exec:\7ntnhb.exe75⤵
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\tthbtn.exec:\tthbtn.exe76⤵PID:3596
-
\??\c:\jjppj.exec:\jjppj.exe77⤵PID:4584
-
\??\c:\frlrlxr.exec:\frlrlxr.exe78⤵PID:2428
-
\??\c:\1llfxrl.exec:\1llfxrl.exe79⤵PID:4652
-
\??\c:\9ntntt.exec:\9ntntt.exe80⤵PID:4352
-
\??\c:\pvvpj.exec:\pvvpj.exe81⤵PID:4524
-
\??\c:\nhttnt.exec:\nhttnt.exe82⤵PID:4528
-
\??\c:\pjjdd.exec:\pjjdd.exe83⤵PID:3840
-
\??\c:\5llfffx.exec:\5llfffx.exe84⤵PID:4088
-
\??\c:\ntbbnn.exec:\ntbbnn.exe85⤵PID:3788
-
\??\c:\jvdvp.exec:\jvdvp.exe86⤵PID:2868
-
\??\c:\1ddvv.exec:\1ddvv.exe87⤵PID:456
-
\??\c:\xrlffff.exec:\xrlffff.exe88⤵PID:2364
-
\??\c:\5bnnhn.exec:\5bnnhn.exe89⤵PID:924
-
\??\c:\dddpp.exec:\dddpp.exe90⤵PID:1688
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe91⤵PID:2988
-
\??\c:\nntnnt.exec:\nntnnt.exe92⤵PID:4464
-
\??\c:\nbhntt.exec:\nbhntt.exe93⤵PID:3604
-
\??\c:\5djdd.exec:\5djdd.exe94⤵PID:4796
-
\??\c:\xfffffx.exec:\xfffffx.exe95⤵PID:2616
-
\??\c:\9bhhbt.exec:\9bhhbt.exe96⤵PID:1608
-
\??\c:\7bhhnh.exec:\7bhhnh.exe97⤵PID:4548
-
\??\c:\ppjjd.exec:\ppjjd.exe98⤵PID:1600
-
\??\c:\rxrfxlf.exec:\rxrfxlf.exe99⤵PID:5028
-
\??\c:\bbbbtt.exec:\bbbbtt.exe100⤵PID:5064
-
\??\c:\nnnnbt.exec:\nnnnbt.exe101⤵PID:3312
-
\??\c:\vddvp.exec:\vddvp.exe102⤵PID:400
-
\??\c:\rxffxxx.exec:\rxffxxx.exe103⤵PID:4228
-
\??\c:\frffrxx.exec:\frffrxx.exe104⤵PID:4472
-
\??\c:\bnhntb.exec:\bnhntb.exe105⤵PID:1212
-
\??\c:\vdpjj.exec:\vdpjj.exe106⤵PID:4516
-
\??\c:\xrxrrll.exec:\xrxrrll.exe107⤵PID:3872
-
\??\c:\nhhhhh.exec:\nhhhhh.exe108⤵PID:4544
-
\??\c:\nbtttt.exec:\nbtttt.exe109⤵PID:4224
-
\??\c:\jpjpj.exec:\jpjpj.exe110⤵PID:4960
-
\??\c:\rffflll.exec:\rffflll.exe111⤵PID:1696
-
\??\c:\nntnbh.exec:\nntnbh.exe112⤵PID:2168
-
\??\c:\djppp.exec:\djppp.exe113⤵PID:4288
-
\??\c:\frrllfx.exec:\frrllfx.exe114⤵PID:4540
-
\??\c:\3tbhhn.exec:\3tbhhn.exe115⤵PID:972
-
\??\c:\5pjdv.exec:\5pjdv.exe116⤵PID:3144
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe117⤵PID:4252
-
\??\c:\nnhhhn.exec:\nnhhhn.exe118⤵PID:3968
-
\??\c:\hnhhbb.exec:\hnhhbb.exe119⤵PID:1556
-
\??\c:\vvjjp.exec:\vvjjp.exe120⤵PID:4324
-
\??\c:\rxllflf.exec:\rxllflf.exe121⤵PID:4504
-
\??\c:\hnttbb.exec:\hnttbb.exe122⤵PID:776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-