Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 17:00
Static task
static1
Behavioral task
behavioral1
Sample
c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe
Resource
win7-20240708-en
General
-
Target
c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe
-
Size
454KB
-
MD5
b29891dfe79476db682cc0fc792b9d0f
-
SHA1
a51a0dd300c60f44c9518de2d9375271b320fcf7
-
SHA256
c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528
-
SHA512
c5a7af1ec8f748ca67def2156f9fea4eba520d6216a6b8175c14bf10c23e1544ad02fa5dc09e71368f0e7cf71200cfb525836392def8f6309efe0fd690fff831
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetP:q7Tc2NYHUrAwfMp3CDtP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2912-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1660-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3496-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1672-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4144-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/456-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3284-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1320-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4604-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2404-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2424-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4424-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1448-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2860-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2120-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3452-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4104-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2804-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4452-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3460-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3872-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3200-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2508-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1144-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1140-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1800-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/316-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/468-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2672-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4204-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/700-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5088-734-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-960-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2284-1337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4904-1581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3496 lflxxfx.exe 468 9jvjd.exe 1660 1lffxfx.exe 1672 hhnnhh.exe 3640 jddvv.exe 4144 lflrlfr.exe 456 nntntt.exe 1704 vppvp.exe 3436 pjdpd.exe 228 hhnhbb.exe 3284 5llfllf.exe 3484 tbbbhn.exe 3092 pdjvp.exe 1320 tnttbn.exe 2404 pddvv.exe 4604 3rfxllr.exe 2424 htntnb.exe 3132 vjpjp.exe 2388 lxffxxx.exe 4496 pjvpj.exe 4424 hhthbn.exe 864 ffxrlll.exe 1448 xxffxxr.exe 3916 1ttttb.exe 2764 1dvvp.exe 1312 rffxxxx.exe 2860 1hhhhh.exe 4940 pjjdv.exe 4344 lllrlll.exe 1372 fxxxrxx.exe 2120 bnnhbt.exe 1268 5rlfxxx.exe 3452 nthbtn.exe 2960 vvjdj.exe 2936 rllxrrr.exe 2312 thnhbn.exe 4104 llfxxff.exe 1724 tnhthn.exe 4436 pvdvv.exe 1152 lfrrlxr.exe 4588 fxffllr.exe 2804 1ttbbh.exe 4452 1pvpj.exe 2612 lrxxfxl.exe 3460 hnttnn.exe 856 tnttnb.exe 3548 1xlfxxf.exe 4760 xxxrrrr.exe 3088 bttnhn.exe 1736 5jpjd.exe 3836 lffllll.exe 2304 3tbbht.exe 3872 thhbtt.exe 3200 9dddv.exe 1516 rlrrrrr.exe 944 tnbnht.exe 1664 7vpjd.exe 5000 jvjdp.exe 2452 bbbttn.exe 4576 1jdvp.exe 1484 vpvvp.exe 3012 xxfxxxx.exe 2508 thnhbb.exe 3028 jvppv.exe -
resource yara_rule behavioral2/memory/2912-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1660-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3496-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4144-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/456-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3284-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1320-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4604-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2404-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2424-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4424-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1448-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2860-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2120-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3452-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2804-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4452-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3460-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3872-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3200-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1516-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2508-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1144-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1140-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1800-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/316-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/468-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2672-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4204-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/700-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/396-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5088-734-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 3496 2912 c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe 82 PID 2912 wrote to memory of 3496 2912 c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe 82 PID 2912 wrote to memory of 3496 2912 c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe 82 PID 3496 wrote to memory of 468 3496 lflxxfx.exe 83 PID 3496 wrote to memory of 468 3496 lflxxfx.exe 83 PID 3496 wrote to memory of 468 3496 lflxxfx.exe 83 PID 468 wrote to memory of 1660 468 9jvjd.exe 84 PID 468 wrote to memory of 1660 468 9jvjd.exe 84 PID 468 wrote to memory of 1660 468 9jvjd.exe 84 PID 1660 wrote to memory of 1672 1660 1lffxfx.exe 85 PID 1660 wrote to memory of 1672 1660 1lffxfx.exe 85 PID 1660 wrote to memory of 1672 1660 1lffxfx.exe 85 PID 1672 wrote to memory of 3640 1672 hhnnhh.exe 86 PID 1672 wrote to memory of 3640 1672 hhnnhh.exe 86 PID 1672 wrote to memory of 3640 1672 hhnnhh.exe 86 PID 3640 wrote to memory of 4144 3640 jddvv.exe 87 PID 3640 wrote to memory of 4144 3640 jddvv.exe 87 PID 3640 wrote to memory of 4144 3640 jddvv.exe 87 PID 4144 wrote to memory of 456 4144 lflrlfr.exe 88 PID 4144 wrote to memory of 456 4144 lflrlfr.exe 88 PID 4144 wrote to memory of 456 4144 lflrlfr.exe 88 PID 456 wrote to memory of 1704 456 nntntt.exe 89 PID 456 wrote to memory of 1704 456 nntntt.exe 89 PID 456 wrote to memory of 1704 456 nntntt.exe 89 PID 1704 wrote to memory of 3436 1704 vppvp.exe 90 PID 1704 wrote to memory of 3436 1704 vppvp.exe 90 PID 1704 wrote to memory of 3436 1704 vppvp.exe 90 PID 3436 wrote to memory of 228 3436 pjdpd.exe 91 PID 3436 wrote to memory of 228 3436 pjdpd.exe 91 PID 3436 wrote to memory of 228 3436 pjdpd.exe 91 PID 228 wrote to memory of 3284 228 hhnhbb.exe 92 PID 228 wrote to memory of 3284 228 hhnhbb.exe 92 PID 228 wrote to memory of 3284 228 hhnhbb.exe 92 PID 3284 wrote to memory of 3484 3284 5llfllf.exe 93 PID 3284 wrote to memory of 3484 3284 5llfllf.exe 93 PID 3284 wrote to memory of 3484 3284 5llfllf.exe 93 PID 3484 wrote to memory of 3092 3484 tbbbhn.exe 94 PID 3484 wrote to memory of 3092 3484 tbbbhn.exe 94 PID 3484 wrote to memory of 3092 3484 tbbbhn.exe 94 PID 3092 wrote to memory of 1320 3092 pdjvp.exe 95 PID 3092 wrote to memory of 1320 3092 pdjvp.exe 95 PID 3092 wrote to memory of 1320 3092 pdjvp.exe 95 PID 1320 wrote to memory of 2404 1320 tnttbn.exe 96 PID 1320 wrote to memory of 2404 1320 tnttbn.exe 96 PID 1320 wrote to memory of 2404 1320 tnttbn.exe 96 PID 2404 wrote to memory of 4604 2404 pddvv.exe 97 PID 2404 wrote to memory of 4604 2404 pddvv.exe 97 PID 2404 wrote to memory of 4604 2404 pddvv.exe 97 PID 4604 wrote to memory of 2424 4604 3rfxllr.exe 98 PID 4604 wrote to memory of 2424 4604 3rfxllr.exe 98 PID 4604 wrote to memory of 2424 4604 3rfxllr.exe 98 PID 2424 wrote to memory of 3132 2424 htntnb.exe 99 PID 2424 wrote to memory of 3132 2424 htntnb.exe 99 PID 2424 wrote to memory of 3132 2424 htntnb.exe 99 PID 3132 wrote to memory of 2388 3132 vjpjp.exe 100 PID 3132 wrote to memory of 2388 3132 vjpjp.exe 100 PID 3132 wrote to memory of 2388 3132 vjpjp.exe 100 PID 2388 wrote to memory of 4496 2388 lxffxxx.exe 101 PID 2388 wrote to memory of 4496 2388 lxffxxx.exe 101 PID 2388 wrote to memory of 4496 2388 lxffxxx.exe 101 PID 4496 wrote to memory of 4424 4496 pjvpj.exe 102 PID 4496 wrote to memory of 4424 4496 pjvpj.exe 102 PID 4496 wrote to memory of 4424 4496 pjvpj.exe 102 PID 4424 wrote to memory of 864 4424 hhthbn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe"C:\Users\Admin\AppData\Local\Temp\c2293abda7d0c4294d75c286710724aeb990ef729851e8df110c6fe7d8319528.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\lflxxfx.exec:\lflxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\9jvjd.exec:\9jvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\1lffxfx.exec:\1lffxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\hhnnhh.exec:\hhnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jddvv.exec:\jddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\lflrlfr.exec:\lflrlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\nntntt.exec:\nntntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\vppvp.exec:\vppvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\pjdpd.exec:\pjdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\hhnhbb.exec:\hhnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\5llfllf.exec:\5llfllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\tbbbhn.exec:\tbbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pdjvp.exec:\pdjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\tnttbn.exec:\tnttbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\pddvv.exec:\pddvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\3rfxllr.exec:\3rfxllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\htntnb.exec:\htntnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\vjpjp.exec:\vjpjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\lxffxxx.exec:\lxffxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pjvpj.exec:\pjvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\hhthbn.exec:\hhthbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\ffxrlll.exec:\ffxrlll.exe23⤵
- Executes dropped EXE
PID:864 -
\??\c:\xxffxxr.exec:\xxffxxr.exe24⤵
- Executes dropped EXE
PID:1448 -
\??\c:\1ttttb.exec:\1ttttb.exe25⤵
- Executes dropped EXE
PID:3916 -
\??\c:\1dvvp.exec:\1dvvp.exe26⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rffxxxx.exec:\rffxxxx.exe27⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1hhhhh.exec:\1hhhhh.exe28⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pjjdv.exec:\pjjdv.exe29⤵
- Executes dropped EXE
PID:4940 -
\??\c:\lllrlll.exec:\lllrlll.exe30⤵
- Executes dropped EXE
PID:4344 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe31⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bnnhbt.exec:\bnnhbt.exe32⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5rlfxxx.exec:\5rlfxxx.exe33⤵
- Executes dropped EXE
PID:1268 -
\??\c:\nthbtn.exec:\nthbtn.exe34⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vvjdj.exec:\vvjdj.exe35⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rllxrrr.exec:\rllxrrr.exe36⤵
- Executes dropped EXE
PID:2936 -
\??\c:\thnhbn.exec:\thnhbn.exe37⤵
- Executes dropped EXE
PID:2312 -
\??\c:\llfxxff.exec:\llfxxff.exe38⤵
- Executes dropped EXE
PID:4104 -
\??\c:\tnhthn.exec:\tnhthn.exe39⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pvdvv.exec:\pvdvv.exe40⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lfrrlxr.exec:\lfrrlxr.exe41⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fxffllr.exec:\fxffllr.exe42⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1ttbbh.exec:\1ttbbh.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1pvpj.exec:\1pvpj.exe44⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lrxxfxl.exec:\lrxxfxl.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hnttnn.exec:\hnttnn.exe46⤵
- Executes dropped EXE
PID:3460 -
\??\c:\tnttnb.exec:\tnttnb.exe47⤵
- Executes dropped EXE
PID:856 -
\??\c:\1xlfxxf.exec:\1xlfxxf.exe48⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xxxrrrr.exec:\xxxrrrr.exe49⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bttnhn.exec:\bttnhn.exe50⤵
- Executes dropped EXE
PID:3088 -
\??\c:\5jpjd.exec:\5jpjd.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\lffllll.exec:\lffllll.exe52⤵
- Executes dropped EXE
PID:3836 -
\??\c:\3tbbht.exec:\3tbbht.exe53⤵
- Executes dropped EXE
PID:2304 -
\??\c:\thhbtt.exec:\thhbtt.exe54⤵
- Executes dropped EXE
PID:3872 -
\??\c:\9dddv.exec:\9dddv.exe55⤵
- Executes dropped EXE
PID:3200 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\tnbnht.exec:\tnbnht.exe57⤵
- Executes dropped EXE
PID:944 -
\??\c:\7vpjd.exec:\7vpjd.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jvjdp.exec:\jvjdp.exe59⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bbbttn.exec:\bbbttn.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1jdvp.exec:\1jdvp.exe61⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vpvvp.exec:\vpvvp.exe62⤵
- Executes dropped EXE
PID:1484 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\thnhbb.exec:\thnhbb.exe64⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jvppv.exec:\jvppv.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\rfffffx.exec:\rfffffx.exe66⤵PID:2728
-
\??\c:\htbbtt.exec:\htbbtt.exe67⤵PID:4628
-
\??\c:\bttnhh.exec:\bttnhh.exe68⤵PID:2864
-
\??\c:\1dvvd.exec:\1dvvd.exe69⤵PID:3664
-
\??\c:\ffrfrfl.exec:\ffrfrfl.exe70⤵PID:1364
-
\??\c:\5tthbh.exec:\5tthbh.exe71⤵PID:3856
-
\??\c:\vjpjj.exec:\vjpjj.exe72⤵PID:2028
-
\??\c:\lffxrfx.exec:\lffxrfx.exe73⤵PID:4272
-
\??\c:\tnhbtn.exec:\tnhbtn.exe74⤵PID:3132
-
\??\c:\jvpvp.exec:\jvpvp.exe75⤵PID:4468
-
\??\c:\xllfxrx.exec:\xllfxrx.exe76⤵PID:3876
-
\??\c:\rrllfxr.exec:\rrllfxr.exe77⤵
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\1nnhbt.exec:\1nnhbt.exe78⤵
- System Location Discovery: System Language Discovery
PID:3388 -
\??\c:\dvvpj.exec:\dvvpj.exe79⤵PID:4476
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe80⤵PID:980
-
\??\c:\rxrflfl.exec:\rxrflfl.exe81⤵PID:2156
-
\??\c:\hhbbtb.exec:\hhbbtb.exe82⤵PID:3916
-
\??\c:\pdvvp.exec:\pdvvp.exe83⤵PID:716
-
\??\c:\fxfflff.exec:\fxfflff.exe84⤵PID:712
-
\??\c:\tnnhbh.exec:\tnnhbh.exe85⤵PID:1192
-
\??\c:\jdjdd.exec:\jdjdd.exe86⤵PID:2128
-
\??\c:\dpvpj.exec:\dpvpj.exe87⤵PID:4940
-
\??\c:\lxlllff.exec:\lxlllff.exe88⤵PID:1332
-
\??\c:\tnnhtn.exec:\tnnhtn.exe89⤵PID:2068
-
\??\c:\3jjdp.exec:\3jjdp.exe90⤵PID:2540
-
\??\c:\lxlxfrf.exec:\lxlxfrf.exe91⤵PID:2120
-
\??\c:\tbtbth.exec:\tbtbth.exe92⤵PID:1144
-
\??\c:\9vvpj.exec:\9vvpj.exe93⤵PID:2784
-
\??\c:\9fllfxl.exec:\9fllfxl.exe94⤵PID:1140
-
\??\c:\frrfxlf.exec:\frrfxlf.exe95⤵PID:4600
-
\??\c:\nhnnnn.exec:\nhnnnn.exe96⤵PID:1272
-
\??\c:\pdjpj.exec:\pdjpj.exe97⤵PID:4936
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe98⤵PID:1844
-
\??\c:\htbbtn.exec:\htbbtn.exe99⤵PID:3480
-
\??\c:\tnhbnh.exec:\tnhbnh.exe100⤵PID:4436
-
\??\c:\pjppp.exec:\pjppp.exe101⤵PID:4904
-
\??\c:\5rrlxxr.exec:\5rrlxxr.exe102⤵PID:1800
-
\??\c:\nnbhth.exec:\nnbhth.exe103⤵PID:316
-
\??\c:\vpvvp.exec:\vpvvp.exe104⤵
- System Location Discovery: System Language Discovery
PID:4720 -
\??\c:\rrrfxrl.exec:\rrrfxrl.exe105⤵PID:4876
-
\??\c:\httnbb.exec:\httnbb.exe106⤵PID:4304
-
\??\c:\dddpj.exec:\dddpj.exe107⤵PID:2280
-
\??\c:\ppjdv.exec:\ppjdv.exe108⤵PID:2932
-
\??\c:\xrrflrf.exec:\xrrflrf.exe109⤵PID:468
-
\??\c:\nntnhb.exec:\nntnhb.exe110⤵PID:1660
-
\??\c:\pdjvp.exec:\pdjvp.exe111⤵PID:1736
-
\??\c:\ppdjj.exec:\ppdjj.exe112⤵PID:3836
-
\??\c:\rfrflrx.exec:\rfrflrx.exe113⤵PID:2124
-
\??\c:\tbbthb.exec:\tbbthb.exe114⤵PID:1984
-
\??\c:\9jpjp.exec:\9jpjp.exe115⤵PID:2328
-
\??\c:\vpvjv.exec:\vpvjv.exe116⤵PID:456
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe117⤵PID:3392
-
\??\c:\1hthbt.exec:\1hthbt.exe118⤵PID:2672
-
\??\c:\vjvpj.exec:\vjvpj.exe119⤵PID:2692
-
\??\c:\pjjdv.exec:\pjjdv.exe120⤵PID:4076
-
\??\c:\1lllfxr.exec:\1lllfxr.exe121⤵PID:4204
-
\??\c:\bnhbtn.exec:\bnhbtn.exe122⤵PID:228
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-