Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 18:52
Static task
static1
Behavioral task
behavioral1
Sample
949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe
Resource
win7-20241010-en
General
-
Target
949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe
-
Size
454KB
-
MD5
e3a4dbcf27d4b64e126d834c63a21c62
-
SHA1
1ac94a8574337a2cc636ef31111370b04c1aa079
-
SHA256
949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7
-
SHA512
09d947e82a84631ebef6a25203eede57834941c86021bef933f47e448827eb8356bf9cbeedf99ab7818cdc89469f891c46540ead23bc44c9744971b9064ff4be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4460-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2524-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2168-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1028-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1664-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5084-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1704-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1164-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/376-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4992-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1380-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2800-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4636-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1560-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2516-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1264-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2320-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3032-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/788-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3224-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4776-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4620-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3252-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1828-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4552-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3292-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4296-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2056-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-931-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-1166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-1289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-1566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-1669-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3760-1890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 hnnbtn.exe 1972 1djdd.exe 2168 rllffxr.exe 3132 xxlxrrl.exe 4956 nbhnhb.exe 2032 3hhbhb.exe 1028 pjdpd.exe 1664 lxxrlrl.exe 5084 pvvpj.exe 1084 xlxxflr.exe 1704 pvvvp.exe 636 flllfxr.exe 3068 htbbbh.exe 2944 jjjdd.exe 4320 rlffxll.exe 2756 tnhhnn.exe 1164 jvvpv.exe 4816 xfrlxxx.exe 376 hthhtt.exe 3320 dvvpp.exe 4992 rrfxllr.exe 436 vjjdj.exe 4704 ddjdv.exe 1380 1nhbbb.exe 960 fxlfllr.exe 2800 frxrllf.exe 1168 lfrflfx.exe 3532 fxfxfff.exe 2312 nbhhbb.exe 4268 3djdd.exe 4636 ttthtt.exe 4600 jvvpj.exe 968 7flffff.exe 1008 bthbhh.exe 632 9pjpj.exe 1560 rxllllr.exe 1220 bbtnhh.exe 1788 pvddv.exe 2356 rllfrrr.exe 4536 rflffff.exe 2516 5nhhbb.exe 1496 lfrffxr.exe 2416 bnnbtt.exe 4352 nbbbtn.exe 3084 fflxffx.exe 1648 nhnhnh.exe 540 jdppj.exe 3292 tntnhh.exe 1972 hnnhbt.exe 3036 jdppv.exe 1924 frxrffx.exe 1264 tbnhtt.exe 2320 9pvpp.exe 5052 3rxrlll.exe 3668 rrrxxxr.exe 1968 ntbttt.exe 4488 dpppp.exe 3520 lllxrrx.exe 1668 rllrlrl.exe 5084 hhhbbb.exe 1804 dvvpp.exe 4108 ddpjv.exe 1240 9nnhnn.exe 2016 bnnhhb.exe -
resource yara_rule behavioral2/memory/4460-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2524-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2168-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1028-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5084-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1704-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1164-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4992-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1380-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2800-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4636-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1560-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2516-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1264-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2320-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3032-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/788-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4776-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4620-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3252-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1828-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4552-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3292-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4296-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2056-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-931-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-1166-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 2524 4460 949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe 83 PID 4460 wrote to memory of 2524 4460 949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe 83 PID 4460 wrote to memory of 2524 4460 949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe 83 PID 2524 wrote to memory of 1972 2524 hnnbtn.exe 84 PID 2524 wrote to memory of 1972 2524 hnnbtn.exe 84 PID 2524 wrote to memory of 1972 2524 hnnbtn.exe 84 PID 1972 wrote to memory of 2168 1972 1djdd.exe 85 PID 1972 wrote to memory of 2168 1972 1djdd.exe 85 PID 1972 wrote to memory of 2168 1972 1djdd.exe 85 PID 2168 wrote to memory of 3132 2168 rllffxr.exe 86 PID 2168 wrote to memory of 3132 2168 rllffxr.exe 86 PID 2168 wrote to memory of 3132 2168 rllffxr.exe 86 PID 3132 wrote to memory of 4956 3132 xxlxrrl.exe 87 PID 3132 wrote to memory of 4956 3132 xxlxrrl.exe 87 PID 3132 wrote to memory of 4956 3132 xxlxrrl.exe 87 PID 4956 wrote to memory of 2032 4956 nbhnhb.exe 88 PID 4956 wrote to memory of 2032 4956 nbhnhb.exe 88 PID 4956 wrote to memory of 2032 4956 nbhnhb.exe 88 PID 2032 wrote to memory of 1028 2032 3hhbhb.exe 89 PID 2032 wrote to memory of 1028 2032 3hhbhb.exe 89 PID 2032 wrote to memory of 1028 2032 3hhbhb.exe 89 PID 1028 wrote to memory of 1664 1028 pjdpd.exe 90 PID 1028 wrote to memory of 1664 1028 pjdpd.exe 90 PID 1028 wrote to memory of 1664 1028 pjdpd.exe 90 PID 1664 wrote to memory of 5084 1664 lxxrlrl.exe 91 PID 1664 wrote to memory of 5084 1664 lxxrlrl.exe 91 PID 1664 wrote to memory of 5084 1664 lxxrlrl.exe 91 PID 5084 wrote to memory of 1084 5084 pvvpj.exe 92 PID 5084 wrote to memory of 1084 5084 pvvpj.exe 92 PID 5084 wrote to memory of 1084 5084 pvvpj.exe 92 PID 1084 wrote to memory of 1704 1084 xlxxflr.exe 93 PID 1084 wrote to memory of 1704 1084 xlxxflr.exe 93 PID 1084 wrote to memory of 1704 1084 xlxxflr.exe 93 PID 1704 wrote to memory of 636 1704 pvvvp.exe 94 PID 1704 wrote to memory of 636 1704 pvvvp.exe 94 PID 1704 wrote to memory of 636 1704 pvvvp.exe 94 PID 636 wrote to memory of 3068 636 flllfxr.exe 95 PID 636 wrote to memory of 3068 636 flllfxr.exe 95 PID 636 wrote to memory of 3068 636 flllfxr.exe 95 PID 3068 wrote to memory of 2944 3068 htbbbh.exe 96 PID 3068 wrote to memory of 2944 3068 htbbbh.exe 96 PID 3068 wrote to memory of 2944 3068 htbbbh.exe 96 PID 2944 wrote to memory of 4320 2944 jjjdd.exe 97 PID 2944 wrote to memory of 4320 2944 jjjdd.exe 97 PID 2944 wrote to memory of 4320 2944 jjjdd.exe 97 PID 4320 wrote to memory of 2756 4320 rlffxll.exe 98 PID 4320 wrote to memory of 2756 4320 rlffxll.exe 98 PID 4320 wrote to memory of 2756 4320 rlffxll.exe 98 PID 2756 wrote to memory of 1164 2756 tnhhnn.exe 99 PID 2756 wrote to memory of 1164 2756 tnhhnn.exe 99 PID 2756 wrote to memory of 1164 2756 tnhhnn.exe 99 PID 1164 wrote to memory of 4816 1164 jvvpv.exe 100 PID 1164 wrote to memory of 4816 1164 jvvpv.exe 100 PID 1164 wrote to memory of 4816 1164 jvvpv.exe 100 PID 4816 wrote to memory of 376 4816 xfrlxxx.exe 101 PID 4816 wrote to memory of 376 4816 xfrlxxx.exe 101 PID 4816 wrote to memory of 376 4816 xfrlxxx.exe 101 PID 376 wrote to memory of 3320 376 hthhtt.exe 102 PID 376 wrote to memory of 3320 376 hthhtt.exe 102 PID 376 wrote to memory of 3320 376 hthhtt.exe 102 PID 3320 wrote to memory of 4992 3320 dvvpp.exe 103 PID 3320 wrote to memory of 4992 3320 dvvpp.exe 103 PID 3320 wrote to memory of 4992 3320 dvvpp.exe 103 PID 4992 wrote to memory of 436 4992 rrfxllr.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe"C:\Users\Admin\AppData\Local\Temp\949c6377d7cd3f104932a4c7b51ee766fae3ab018f4919c3d03331cfde70ecf7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\hnnbtn.exec:\hnnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\1djdd.exec:\1djdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\rllffxr.exec:\rllffxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xxlxrrl.exec:\xxlxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\nbhnhb.exec:\nbhnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\3hhbhb.exec:\3hhbhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\pjdpd.exec:\pjdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pvvpj.exec:\pvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\xlxxflr.exec:\xlxxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\pvvvp.exec:\pvvvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\flllfxr.exec:\flllfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\htbbbh.exec:\htbbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\jjjdd.exec:\jjjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rlffxll.exec:\rlffxll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\tnhhnn.exec:\tnhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jvvpv.exec:\jvvpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xfrlxxx.exec:\xfrlxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\hthhtt.exec:\hthhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\dvvpp.exec:\dvvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rrfxllr.exec:\rrfxllr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\vjjdj.exec:\vjjdj.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\ddjdv.exec:\ddjdv.exe24⤵
- Executes dropped EXE
PID:4704 -
\??\c:\1nhbbb.exec:\1nhbbb.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380 -
\??\c:\fxlfllr.exec:\fxlfllr.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\frxrllf.exec:\frxrllf.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lfrflfx.exec:\lfrflfx.exe28⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fxfxfff.exec:\fxfxfff.exe29⤵
- Executes dropped EXE
PID:3532 -
\??\c:\nbhhbb.exec:\nbhhbb.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3djdd.exec:\3djdd.exe31⤵
- Executes dropped EXE
PID:4268 -
\??\c:\ttthtt.exec:\ttthtt.exe32⤵
- Executes dropped EXE
PID:4636 -
\??\c:\jvvpj.exec:\jvvpj.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4600 -
\??\c:\7flffff.exec:\7flffff.exe34⤵
- Executes dropped EXE
PID:968 -
\??\c:\bthbhh.exec:\bthbhh.exe35⤵
- Executes dropped EXE
PID:1008 -
\??\c:\9pjpj.exec:\9pjpj.exe36⤵
- Executes dropped EXE
PID:632 -
\??\c:\rxllllr.exec:\rxllllr.exe37⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bbtnhh.exec:\bbtnhh.exe38⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pvddv.exec:\pvddv.exe39⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rllfrrr.exec:\rllfrrr.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rflffff.exec:\rflffff.exe41⤵
- Executes dropped EXE
PID:4536 -
\??\c:\5nhhbb.exec:\5nhhbb.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lfrffxr.exec:\lfrffxr.exe43⤵
- Executes dropped EXE
PID:1496 -
\??\c:\bnnbtt.exec:\bnnbtt.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nbbbtn.exec:\nbbbtn.exe45⤵
- Executes dropped EXE
PID:4352 -
\??\c:\fflxffx.exec:\fflxffx.exe46⤵
- Executes dropped EXE
PID:3084 -
\??\c:\nhnhnh.exec:\nhnhnh.exe47⤵
- Executes dropped EXE
PID:1648 -
\??\c:\jdppj.exec:\jdppj.exe48⤵
- Executes dropped EXE
PID:540 -
\??\c:\tntnhh.exec:\tntnhh.exe49⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hnnhbt.exec:\hnnhbt.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jdppv.exec:\jdppv.exe51⤵
- Executes dropped EXE
PID:3036 -
\??\c:\frxrffx.exec:\frxrffx.exe52⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tbnhtt.exec:\tbnhtt.exe53⤵
- Executes dropped EXE
PID:1264 -
\??\c:\9pvpp.exec:\9pvpp.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3rxrlll.exec:\3rxrlll.exe55⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rrrxxxr.exec:\rrrxxxr.exe56⤵
- Executes dropped EXE
PID:3668 -
\??\c:\ntbttt.exec:\ntbttt.exe57⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpppp.exec:\dpppp.exe58⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lllxrrx.exec:\lllxrrx.exe59⤵
- Executes dropped EXE
PID:3520 -
\??\c:\rllrlrl.exec:\rllrlrl.exe60⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hhhbbb.exec:\hhhbbb.exe61⤵
- Executes dropped EXE
PID:5084 -
\??\c:\dvvpp.exec:\dvvpp.exe62⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ddpjv.exec:\ddpjv.exe63⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9nnhnn.exec:\9nnhnn.exe64⤵
- Executes dropped EXE
PID:1240 -
\??\c:\bnnhhb.exec:\bnnhhb.exe65⤵
- Executes dropped EXE
PID:2016 -
\??\c:\5ppdv.exec:\5ppdv.exe66⤵PID:2600
-
\??\c:\xfrfxrf.exec:\xfrfxrf.exe67⤵PID:4404
-
\??\c:\xrffflf.exec:\xrffflf.exe68⤵PID:3068
-
\??\c:\1thbnb.exec:\1thbnb.exe69⤵PID:4172
-
\??\c:\jdpvv.exec:\jdpvv.exe70⤵PID:3032
-
\??\c:\dvpvj.exec:\dvpvj.exe71⤵PID:3604
-
\??\c:\flrfxxf.exec:\flrfxxf.exe72⤵PID:3500
-
\??\c:\tntthn.exec:\tntthn.exe73⤵PID:3752
-
\??\c:\vvpjv.exec:\vvpjv.exe74⤵PID:788
-
\??\c:\ppvvj.exec:\ppvvj.exe75⤵PID:1492
-
\??\c:\5rrrlrr.exec:\5rrrlrr.exe76⤵PID:4356
-
\??\c:\nnttnn.exec:\nnttnn.exe77⤵PID:928
-
\??\c:\vdvpj.exec:\vdvpj.exe78⤵PID:4260
-
\??\c:\rlxfxrl.exec:\rlxfxrl.exe79⤵PID:1632
-
\??\c:\llrlxxr.exec:\llrlxxr.exe80⤵PID:3340
-
\??\c:\nbntnh.exec:\nbntnh.exe81⤵PID:856
-
\??\c:\vjppj.exec:\vjppj.exe82⤵PID:3224
-
\??\c:\dddpj.exec:\dddpj.exe83⤵PID:4912
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe84⤵PID:4776
-
\??\c:\nhbbtt.exec:\nhbbtt.exe85⤵PID:4760
-
\??\c:\jvvvp.exec:\jvvvp.exe86⤵PID:1380
-
\??\c:\frrrlll.exec:\frrrlll.exe87⤵PID:3328
-
\??\c:\xrxllll.exec:\xrxllll.exe88⤵PID:1204
-
\??\c:\nnhhbt.exec:\nnhhbt.exe89⤵PID:2232
-
\??\c:\jvddp.exec:\jvddp.exe90⤵PID:1300
-
\??\c:\llfxxrr.exec:\llfxxrr.exe91⤵PID:4740
-
\??\c:\thnhhh.exec:\thnhhh.exe92⤵PID:4620
-
\??\c:\5vpjj.exec:\5vpjj.exe93⤵PID:1484
-
\??\c:\frfxrlf.exec:\frfxrlf.exe94⤵PID:2908
-
\??\c:\lxffxxx.exec:\lxffxxx.exe95⤵PID:4268
-
\??\c:\hbhbbb.exec:\hbhbbb.exe96⤵PID:4636
-
\??\c:\jdjvp.exec:\jdjvp.exe97⤵PID:3164
-
\??\c:\7rffxll.exec:\7rffxll.exe98⤵PID:5076
-
\??\c:\3lllffr.exec:\3lllffr.exe99⤵PID:4804
-
\??\c:\bhnhbt.exec:\bhnhbt.exe100⤵PID:4920
-
\??\c:\htbthh.exec:\htbthh.exe101⤵PID:2228
-
\??\c:\vjpjv.exec:\vjpjv.exe102⤵PID:3704
-
\??\c:\1xfxllf.exec:\1xfxllf.exe103⤵PID:1220
-
\??\c:\bnnhhb.exec:\bnnhhb.exe104⤵PID:1788
-
\??\c:\bbtnnn.exec:\bbtnnn.exe105⤵PID:1620
-
\??\c:\fxxrlll.exec:\fxxrlll.exe106⤵PID:4536
-
\??\c:\3rxxrrl.exec:\3rxxrrl.exe107⤵PID:2072
-
\??\c:\tnnnbh.exec:\tnnnbh.exe108⤵PID:4008
-
\??\c:\djpjv.exec:\djpjv.exe109⤵PID:4052
-
\??\c:\pjpjd.exec:\pjpjd.exe110⤵PID:5068
-
\??\c:\rffxllx.exec:\rffxllx.exe111⤵PID:3084
-
\??\c:\nbhbtt.exec:\nbhbtt.exe112⤵PID:2428
-
\??\c:\3nbtbb.exec:\3nbtbb.exe113⤵PID:3184
-
\??\c:\jdddd.exec:\jdddd.exe114⤵PID:3452
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe115⤵PID:3620
-
\??\c:\xlrrlll.exec:\xlrrlll.exe116⤵PID:4888
-
\??\c:\hbbbnt.exec:\hbbbnt.exe117⤵PID:3132
-
\??\c:\pjdvv.exec:\pjdvv.exe118⤵PID:644
-
\??\c:\xxfxffx.exec:\xxfxffx.exe119⤵PID:1264
-
\??\c:\nthhbb.exec:\nthhbb.exe120⤵PID:2124
-
\??\c:\hbhbbt.exec:\hbhbbt.exe121⤵PID:5052
-
\??\c:\pdpjv.exec:\pdpjv.exe122⤵PID:3668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-