Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe
Resource
win7-20240903-en
General
-
Target
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe
-
Size
454KB
-
MD5
96f45ab61eb7799b9b63ab773675bb61
-
SHA1
b43cf35f1ce8dc07dd3bab5403389b4188155505
-
SHA256
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26
-
SHA512
fa0902c99e5cbf4b3e07e965157071887eb61ed49e4e8502f25101243d0e89b0b424e5bce8c0c468ee888f3cc40f766a2d4cbe162f5f28292bde197ac160828f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4460-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2472-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3536-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4400-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4928-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2504-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/732-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1044-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2764-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2152-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4800-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3700-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2088-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3532-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4160-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/752-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3380-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3120-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/452-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4040-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3184-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4744-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3684-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1736-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2476-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4320-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4396-883-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-962-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1460-1183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-1286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 llfxlll.exe 2472 bbtnhh.exe 3532 jjjjj.exe 4160 rflfxxl.exe 4080 xxfrrrr.exe 2088 bnnntn.exe 2316 jppjj.exe 1548 pjvpv.exe 3448 rrxllrl.exe 3700 nntnbh.exe 3536 nbhtnn.exe 1000 9jjdj.exe 4800 rrffxrl.exe 2152 lrrrfff.exe 4292 tnhnnt.exe 2764 vvvpj.exe 3756 pppjv.exe 5108 lllfxxl.exe 4180 1hnhbt.exe 1044 hhhbhh.exe 4920 pdpjd.exe 3844 5fxrllf.exe 4960 lflfxlf.exe 4168 bbtnhh.exe 732 vjjdd.exe 4540 pddvj.exe 2504 llffflf.exe 644 hnbthh.exe 1504 hnhbnh.exe 1220 jjvdv.exe 912 lrxrlff.exe 948 ffxxrxr.exe 3236 bnnhhb.exe 2308 vjjdp.exe 3224 jvjjv.exe 4372 xlrfxxx.exe 2924 bhnnnn.exe 880 pjdvp.exe 976 jjjdd.exe 3820 3xfxxxx.exe 4996 nnhbnn.exe 4900 bbtnhb.exe 2132 dddvp.exe 4776 xllllll.exe 532 tthtnh.exe 2544 bbtnhb.exe 2604 vvvvv.exe 1944 ffxxrlf.exe 4220 xrxrfxf.exe 4672 tbtnnn.exe 1728 pjvjd.exe 4140 jdjvp.exe 4184 rrfxrlf.exe 3460 btnhbn.exe 4940 hthbtn.exe 32 dpjjd.exe 2408 vdddv.exe 1332 1xfrrrl.exe 2012 1hnhhh.exe 864 tbhhbb.exe 388 jjjjv.exe 1664 xxxrxrx.exe 4400 bbbhbt.exe 2028 1nbthh.exe -
resource yara_rule behavioral2/memory/4460-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2472-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3536-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4400-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4928-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2504-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/732-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1044-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2764-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2152-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4800-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3700-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2088-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3532-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4160-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/752-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3380-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3120-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/452-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4040-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3184-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4744-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3684-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1736-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2700-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2476-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4320-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4396-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-962-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 5036 4460 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 83 PID 4460 wrote to memory of 5036 4460 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 83 PID 4460 wrote to memory of 5036 4460 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 83 PID 5036 wrote to memory of 2472 5036 llfxlll.exe 84 PID 5036 wrote to memory of 2472 5036 llfxlll.exe 84 PID 5036 wrote to memory of 2472 5036 llfxlll.exe 84 PID 2472 wrote to memory of 3532 2472 bbtnhh.exe 85 PID 2472 wrote to memory of 3532 2472 bbtnhh.exe 85 PID 2472 wrote to memory of 3532 2472 bbtnhh.exe 85 PID 3532 wrote to memory of 4160 3532 jjjjj.exe 86 PID 3532 wrote to memory of 4160 3532 jjjjj.exe 86 PID 3532 wrote to memory of 4160 3532 jjjjj.exe 86 PID 4160 wrote to memory of 4080 4160 rflfxxl.exe 87 PID 4160 wrote to memory of 4080 4160 rflfxxl.exe 87 PID 4160 wrote to memory of 4080 4160 rflfxxl.exe 87 PID 4080 wrote to memory of 2088 4080 xxfrrrr.exe 88 PID 4080 wrote to memory of 2088 4080 xxfrrrr.exe 88 PID 4080 wrote to memory of 2088 4080 xxfrrrr.exe 88 PID 2088 wrote to memory of 2316 2088 bnnntn.exe 89 PID 2088 wrote to memory of 2316 2088 bnnntn.exe 89 PID 2088 wrote to memory of 2316 2088 bnnntn.exe 89 PID 2316 wrote to memory of 1548 2316 jppjj.exe 90 PID 2316 wrote to memory of 1548 2316 jppjj.exe 90 PID 2316 wrote to memory of 1548 2316 jppjj.exe 90 PID 1548 wrote to memory of 3448 1548 pjvpv.exe 91 PID 1548 wrote to memory of 3448 1548 pjvpv.exe 91 PID 1548 wrote to memory of 3448 1548 pjvpv.exe 91 PID 3448 wrote to memory of 3700 3448 rrxllrl.exe 92 PID 3448 wrote to memory of 3700 3448 rrxllrl.exe 92 PID 3448 wrote to memory of 3700 3448 rrxllrl.exe 92 PID 3700 wrote to memory of 3536 3700 nntnbh.exe 156 PID 3700 wrote to memory of 3536 3700 nntnbh.exe 156 PID 3700 wrote to memory of 3536 3700 nntnbh.exe 156 PID 3536 wrote to memory of 1000 3536 nbhtnn.exe 94 PID 3536 wrote to memory of 1000 3536 nbhtnn.exe 94 PID 3536 wrote to memory of 1000 3536 nbhtnn.exe 94 PID 1000 wrote to memory of 4800 1000 9jjdj.exe 95 PID 1000 wrote to memory of 4800 1000 9jjdj.exe 95 PID 1000 wrote to memory of 4800 1000 9jjdj.exe 95 PID 4800 wrote to memory of 2152 4800 rrffxrl.exe 96 PID 4800 wrote to memory of 2152 4800 rrffxrl.exe 96 PID 4800 wrote to memory of 2152 4800 rrffxrl.exe 96 PID 2152 wrote to memory of 4292 2152 lrrrfff.exe 97 PID 2152 wrote to memory of 4292 2152 lrrrfff.exe 97 PID 2152 wrote to memory of 4292 2152 lrrrfff.exe 97 PID 4292 wrote to memory of 2764 4292 tnhnnt.exe 98 PID 4292 wrote to memory of 2764 4292 tnhnnt.exe 98 PID 4292 wrote to memory of 2764 4292 tnhnnt.exe 98 PID 2764 wrote to memory of 3756 2764 vvvpj.exe 99 PID 2764 wrote to memory of 3756 2764 vvvpj.exe 99 PID 2764 wrote to memory of 3756 2764 vvvpj.exe 99 PID 3756 wrote to memory of 5108 3756 pppjv.exe 100 PID 3756 wrote to memory of 5108 3756 pppjv.exe 100 PID 3756 wrote to memory of 5108 3756 pppjv.exe 100 PID 5108 wrote to memory of 4180 5108 lllfxxl.exe 101 PID 5108 wrote to memory of 4180 5108 lllfxxl.exe 101 PID 5108 wrote to memory of 4180 5108 lllfxxl.exe 101 PID 4180 wrote to memory of 1044 4180 1hnhbt.exe 102 PID 4180 wrote to memory of 1044 4180 1hnhbt.exe 102 PID 4180 wrote to memory of 1044 4180 1hnhbt.exe 102 PID 1044 wrote to memory of 4920 1044 hhhbhh.exe 103 PID 1044 wrote to memory of 4920 1044 hhhbhh.exe 103 PID 1044 wrote to memory of 4920 1044 hhhbhh.exe 103 PID 4920 wrote to memory of 3844 4920 pdpjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe"C:\Users\Admin\AppData\Local\Temp\400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\llfxlll.exec:\llfxlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\bbtnhh.exec:\bbtnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\jjjjj.exec:\jjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rflfxxl.exec:\rflfxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\bnnntn.exec:\bnnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\jppjj.exec:\jppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\pjvpv.exec:\pjvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rrxllrl.exec:\rrxllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\nntnbh.exec:\nntnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\nbhtnn.exec:\nbhtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\9jjdj.exec:\9jjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\rrffxrl.exec:\rrffxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\lrrrfff.exec:\lrrrfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\tnhnnt.exec:\tnhnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\vvvpj.exec:\vvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pppjv.exec:\pppjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\lllfxxl.exec:\lllfxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\1hnhbt.exec:\1hnhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\hhhbhh.exec:\hhhbhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\pdpjd.exec:\pdpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\5fxrllf.exec:\5fxrllf.exe23⤵
- Executes dropped EXE
PID:3844 -
\??\c:\lflfxlf.exec:\lflfxlf.exe24⤵
- Executes dropped EXE
PID:4960 -
\??\c:\bbtnhh.exec:\bbtnhh.exe25⤵
- Executes dropped EXE
PID:4168 -
\??\c:\vjjdd.exec:\vjjdd.exe26⤵
- Executes dropped EXE
PID:732 -
\??\c:\pddvj.exec:\pddvj.exe27⤵
- Executes dropped EXE
PID:4540 -
\??\c:\llffflf.exec:\llffflf.exe28⤵
- Executes dropped EXE
PID:2504 -
\??\c:\hnbthh.exec:\hnbthh.exe29⤵
- Executes dropped EXE
PID:644 -
\??\c:\hnhbnh.exec:\hnhbnh.exe30⤵
- Executes dropped EXE
PID:1504 -
\??\c:\jjvdv.exec:\jjvdv.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\lrxrlff.exec:\lrxrlff.exe32⤵
- Executes dropped EXE
PID:912 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe33⤵
- Executes dropped EXE
PID:948 -
\??\c:\bnnhhb.exec:\bnnhhb.exe34⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vjjdp.exec:\vjjdp.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jvjjv.exec:\jvjjv.exe36⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xlrfxxx.exec:\xlrfxxx.exe37⤵
- Executes dropped EXE
PID:4372 -
\??\c:\bhnnnn.exec:\bhnnnn.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjdvp.exec:\pjdvp.exe39⤵
- Executes dropped EXE
PID:880 -
\??\c:\jjjdd.exec:\jjjdd.exe40⤵
- Executes dropped EXE
PID:976 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe41⤵
- Executes dropped EXE
PID:3820 -
\??\c:\nnhbnn.exec:\nnhbnn.exe42⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bbtnhb.exec:\bbtnhb.exe43⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dddvp.exec:\dddvp.exe44⤵
- Executes dropped EXE
PID:2132 -
\??\c:\xllllll.exec:\xllllll.exe45⤵
- Executes dropped EXE
PID:4776 -
\??\c:\tthtnh.exec:\tthtnh.exe46⤵
- Executes dropped EXE
PID:532 -
\??\c:\bbtnhb.exec:\bbtnhb.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vvvvv.exec:\vvvvv.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ffxxrlf.exec:\ffxxrlf.exe49⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xrxrfxf.exec:\xrxrfxf.exe50⤵
- Executes dropped EXE
PID:4220 -
\??\c:\tbtnnn.exec:\tbtnnn.exe51⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pjvjd.exec:\pjvjd.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jdjvp.exec:\jdjvp.exe53⤵
- Executes dropped EXE
PID:4140 -
\??\c:\rrfxrlf.exec:\rrfxrlf.exe54⤵
- Executes dropped EXE
PID:4184 -
\??\c:\btnhbn.exec:\btnhbn.exe55⤵
- Executes dropped EXE
PID:3460 -
\??\c:\hthbtn.exec:\hthbtn.exe56⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dpjjd.exec:\dpjjd.exe57⤵
- Executes dropped EXE
PID:32 -
\??\c:\vdddv.exec:\vdddv.exe58⤵
- Executes dropped EXE
PID:2408 -
\??\c:\1xfrrrl.exec:\1xfrrrl.exe59⤵
- Executes dropped EXE
PID:1332 -
\??\c:\1hnhhh.exec:\1hnhhh.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tbhhbb.exec:\tbhhbb.exe61⤵
- Executes dropped EXE
PID:864 -
\??\c:\jjjjv.exec:\jjjjv.exe62⤵
- Executes dropped EXE
PID:388 -
\??\c:\xxxrxrx.exec:\xxxrxrx.exe63⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bbbhbt.exec:\bbbhbt.exe64⤵
- Executes dropped EXE
PID:4400 -
\??\c:\1nbthh.exec:\1nbthh.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3jjdd.exec:\3jjdd.exe66⤵PID:4928
-
\??\c:\lffffll.exec:\lffffll.exe67⤵PID:4564
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe68⤵PID:4612
-
\??\c:\thhbtn.exec:\thhbtn.exe69⤵PID:3780
-
\??\c:\ppjvp.exec:\ppjvp.exe70⤵PID:1596
-
\??\c:\xrxlfxr.exec:\xrxlfxr.exe71⤵PID:212
-
\??\c:\xrrlflf.exec:\xrrlflf.exe72⤵PID:2744
-
\??\c:\frxrllf.exec:\frxrllf.exe73⤵PID:1604
-
\??\c:\7nnhtt.exec:\7nnhtt.exe74⤵PID:1308
-
\??\c:\5vpjd.exec:\5vpjd.exe75⤵PID:3536
-
\??\c:\rxlllrl.exec:\rxlllrl.exe76⤵PID:2904
-
\??\c:\httttt.exec:\httttt.exe77⤵PID:752
-
\??\c:\vvjjp.exec:\vvjjp.exe78⤵PID:3732
-
\??\c:\fllxrrf.exec:\fllxrrf.exe79⤵PID:220
-
\??\c:\tbtnhb.exec:\tbtnhb.exe80⤵PID:4560
-
\??\c:\hnnnnb.exec:\hnnnnb.exe81⤵PID:1712
-
\??\c:\1jjjd.exec:\1jjjd.exe82⤵PID:2592
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe83⤵PID:3380
-
\??\c:\hntttt.exec:\hntttt.exe84⤵PID:3616
-
\??\c:\3ddvv.exec:\3ddvv.exe85⤵PID:3120
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe86⤵PID:1356
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe87⤵PID:3564
-
\??\c:\1hhbtb.exec:\1hhbtb.exe88⤵PID:3672
-
\??\c:\pjpjv.exec:\pjpjv.exe89⤵PID:2420
-
\??\c:\1rlllll.exec:\1rlllll.exe90⤵PID:1120
-
\??\c:\htbttb.exec:\htbttb.exe91⤵PID:1396
-
\??\c:\hhtntt.exec:\hhtntt.exe92⤵PID:4824
-
\??\c:\ppdvp.exec:\ppdvp.exe93⤵PID:452
-
\??\c:\fflfxrr.exec:\fflfxrr.exe94⤵PID:1768
-
\??\c:\9ddvv.exec:\9ddvv.exe95⤵PID:4684
-
\??\c:\flrrllr.exec:\flrrllr.exe96⤵PID:4040
-
\??\c:\bhbtnh.exec:\bhbtnh.exe97⤵PID:2924
-
\??\c:\vddjp.exec:\vddjp.exe98⤵PID:1716
-
\??\c:\ddjjj.exec:\ddjjj.exe99⤵
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\ttbnnb.exec:\ttbnnb.exe100⤵PID:2356
-
\??\c:\hnttnn.exec:\hnttnn.exe101⤵PID:4900
-
\??\c:\rxllflf.exec:\rxllflf.exe102⤵PID:2328
-
\??\c:\5hbtth.exec:\5hbtth.exe103⤵PID:3140
-
\??\c:\vvddj.exec:\vvddj.exe104⤵PID:720
-
\??\c:\5lffxfx.exec:\5lffxfx.exe105⤵PID:2544
-
\??\c:\tntnnn.exec:\tntnnn.exe106⤵PID:2256
-
\??\c:\rflrxxx.exec:\rflrxxx.exe107⤵PID:4556
-
\??\c:\1tntnt.exec:\1tntnt.exe108⤵PID:4164
-
\??\c:\vvvvv.exec:\vvvvv.exe109⤵PID:4404
-
\??\c:\jdddd.exec:\jdddd.exe110⤵PID:4304
-
\??\c:\1rxfxxx.exec:\1rxfxxx.exe111⤵PID:2932
-
\??\c:\tbbhhn.exec:\tbbhhn.exe112⤵PID:1780
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:2736
-
\??\c:\bbbbbb.exec:\bbbbbb.exe114⤵PID:3716
-
\??\c:\3ttttt.exec:\3ttttt.exe115⤵PID:1332
-
\??\c:\fxxrllf.exec:\fxxrllf.exe116⤵PID:2700
-
\??\c:\ttnnhh.exec:\ttnnhh.exe117⤵PID:2012
-
\??\c:\pvddd.exec:\pvddd.exe118⤵PID:4064
-
\??\c:\xxxrfff.exec:\xxxrfff.exe119⤵PID:4576
-
\??\c:\tbhhhn.exec:\tbhhhn.exe120⤵
- System Location Discovery: System Language Discovery
PID:2188 -
\??\c:\5xlrxrr.exec:\5xlrxrr.exe121⤵PID:3028
-
\??\c:\fllfxrr.exec:\fllfxrr.exe122⤵PID:4692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-