Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe
Resource
win7-20240903-en
General
-
Target
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe
-
Size
454KB
-
MD5
96f45ab61eb7799b9b63ab773675bb61
-
SHA1
b43cf35f1ce8dc07dd3bab5403389b4188155505
-
SHA256
400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26
-
SHA512
fa0902c99e5cbf4b3e07e965157071887eb61ed49e4e8502f25101243d0e89b0b424e5bce8c0c468ee888f3cc40f766a2d4cbe162f5f28292bde197ac160828f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/508-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2220-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/756-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1896-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4984-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2984-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2748-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2052-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2456-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4344-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5048-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/696-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2900-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4972-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/636-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2956-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4564-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4828-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3040-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/868-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/388-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/988-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1076-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3664-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2944-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/428-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4428-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4756-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3528-740-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-1111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-1151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-1390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4352 hthbbt.exe 1532 pddpp.exe 1680 lfxrlfx.exe 2220 nthhbt.exe 1896 pdddv.exe 756 dvvvv.exe 388 lffxrrl.exe 4076 3hnhtt.exe 868 dvvpj.exe 3040 lxfxllf.exe 3356 nhhhbb.exe 4828 hbhbbt.exe 4564 jppjd.exe 2956 rxfxrlf.exe 1792 bnnhbb.exe 5012 vppvp.exe 636 7vvpj.exe 4972 frxxrrl.exe 2428 bnhbth.exe 5032 ddjdv.exe 532 ppvjp.exe 3660 flxlrll.exe 3852 nntnbt.exe 1188 djpjd.exe 428 dpdvp.exe 2104 xrlffxx.exe 2900 5bnnhn.exe 696 7vpjd.exe 1068 vdpjd.exe 3528 rrlxflf.exe 4392 tbbtnh.exe 1144 3nnhhb.exe 5048 vppvp.exe 3156 lrrffff.exe 3368 tnnbbb.exe 4344 jvvjd.exe 2456 djpdp.exe 3204 lrxrfrl.exe 3616 hhtnbt.exe 2260 pdvjj.exe 1776 5ppjd.exe 2052 rflfxff.exe 2748 1hnnhh.exe 4488 ddvvp.exe 3032 ppdvp.exe 3940 fxxrlff.exe 2984 tnttnn.exe 3504 vpddv.exe 4964 5pjdv.exe 5072 ffrrllx.exe 4332 jdjpp.exe 940 pvvpj.exe 508 5xfffff.exe 4984 thnhhh.exe 4004 9bhhnn.exe 4768 ddddv.exe 4124 fllfxxr.exe 5060 hhtnnt.exe 1856 btnbhn.exe 3944 jvpjd.exe 388 rlrlllf.exe 1072 xxllflf.exe 372 btnbhh.exe 2536 dvpjd.exe -
resource yara_rule behavioral2/memory/508-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-14-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2220-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/756-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4124-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/508-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2984-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2748-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2052-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2456-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4344-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5048-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/696-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2900-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3852-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/636-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2956-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4564-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4828-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/868-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/388-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4972-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/988-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1076-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3664-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2944-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/428-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4428-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1372-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4756-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3528-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2568-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 508 wrote to memory of 4352 508 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 82 PID 508 wrote to memory of 4352 508 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 82 PID 508 wrote to memory of 4352 508 400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe 82 PID 4352 wrote to memory of 1532 4352 hthbbt.exe 83 PID 4352 wrote to memory of 1532 4352 hthbbt.exe 83 PID 4352 wrote to memory of 1532 4352 hthbbt.exe 83 PID 1532 wrote to memory of 1680 1532 pddpp.exe 84 PID 1532 wrote to memory of 1680 1532 pddpp.exe 84 PID 1532 wrote to memory of 1680 1532 pddpp.exe 84 PID 1680 wrote to memory of 2220 1680 lfxrlfx.exe 85 PID 1680 wrote to memory of 2220 1680 lfxrlfx.exe 85 PID 1680 wrote to memory of 2220 1680 lfxrlfx.exe 85 PID 2220 wrote to memory of 1896 2220 nthhbt.exe 86 PID 2220 wrote to memory of 1896 2220 nthhbt.exe 86 PID 2220 wrote to memory of 1896 2220 nthhbt.exe 86 PID 1896 wrote to memory of 756 1896 pdddv.exe 87 PID 1896 wrote to memory of 756 1896 pdddv.exe 87 PID 1896 wrote to memory of 756 1896 pdddv.exe 87 PID 756 wrote to memory of 388 756 dvvvv.exe 142 PID 756 wrote to memory of 388 756 dvvvv.exe 142 PID 756 wrote to memory of 388 756 dvvvv.exe 142 PID 388 wrote to memory of 4076 388 lffxrrl.exe 89 PID 388 wrote to memory of 4076 388 lffxrrl.exe 89 PID 388 wrote to memory of 4076 388 lffxrrl.exe 89 PID 4076 wrote to memory of 868 4076 3hnhtt.exe 90 PID 4076 wrote to memory of 868 4076 3hnhtt.exe 90 PID 4076 wrote to memory of 868 4076 3hnhtt.exe 90 PID 868 wrote to memory of 3040 868 dvvpj.exe 91 PID 868 wrote to memory of 3040 868 dvvpj.exe 91 PID 868 wrote to memory of 3040 868 dvvpj.exe 91 PID 3040 wrote to memory of 3356 3040 lxfxllf.exe 92 PID 3040 wrote to memory of 3356 3040 lxfxllf.exe 92 PID 3040 wrote to memory of 3356 3040 lxfxllf.exe 92 PID 3356 wrote to memory of 4828 3356 nhhhbb.exe 93 PID 3356 wrote to memory of 4828 3356 nhhhbb.exe 93 PID 3356 wrote to memory of 4828 3356 nhhhbb.exe 93 PID 4828 wrote to memory of 4564 4828 hbhbbt.exe 94 PID 4828 wrote to memory of 4564 4828 hbhbbt.exe 94 PID 4828 wrote to memory of 4564 4828 hbhbbt.exe 94 PID 4564 wrote to memory of 2956 4564 jppjd.exe 95 PID 4564 wrote to memory of 2956 4564 jppjd.exe 95 PID 4564 wrote to memory of 2956 4564 jppjd.exe 95 PID 2956 wrote to memory of 1792 2956 rxfxrlf.exe 96 PID 2956 wrote to memory of 1792 2956 rxfxrlf.exe 96 PID 2956 wrote to memory of 1792 2956 rxfxrlf.exe 96 PID 1792 wrote to memory of 5012 1792 bnnhbb.exe 97 PID 1792 wrote to memory of 5012 1792 bnnhbb.exe 97 PID 1792 wrote to memory of 5012 1792 bnnhbb.exe 97 PID 5012 wrote to memory of 636 5012 vppvp.exe 152 PID 5012 wrote to memory of 636 5012 vppvp.exe 152 PID 5012 wrote to memory of 636 5012 vppvp.exe 152 PID 636 wrote to memory of 4972 636 7vvpj.exe 154 PID 636 wrote to memory of 4972 636 7vvpj.exe 154 PID 636 wrote to memory of 4972 636 7vvpj.exe 154 PID 4972 wrote to memory of 2428 4972 frxxrrl.exe 100 PID 4972 wrote to memory of 2428 4972 frxxrrl.exe 100 PID 4972 wrote to memory of 2428 4972 frxxrrl.exe 100 PID 2428 wrote to memory of 5032 2428 bnhbth.exe 155 PID 2428 wrote to memory of 5032 2428 bnhbth.exe 155 PID 2428 wrote to memory of 5032 2428 bnhbth.exe 155 PID 5032 wrote to memory of 532 5032 ddjdv.exe 102 PID 5032 wrote to memory of 532 5032 ddjdv.exe 102 PID 5032 wrote to memory of 532 5032 ddjdv.exe 102 PID 532 wrote to memory of 3660 532 ppvjp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe"C:\Users\Admin\AppData\Local\Temp\400b1e9e625ec04c50272d14edfa7304e5d11dcbf7ffe02b6f232b1a0a027b26.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\hthbbt.exec:\hthbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\pddpp.exec:\pddpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\nthhbt.exec:\nthhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\pdddv.exec:\pdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\dvvvv.exec:\dvvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\lffxrrl.exec:\lffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\3hnhtt.exec:\3hnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\dvvpj.exec:\dvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\lxfxllf.exec:\lxfxllf.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nhhhbb.exec:\nhhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\hbhbbt.exec:\hbhbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\jppjd.exec:\jppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bnnhbb.exec:\bnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\vppvp.exec:\vppvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7vvpj.exec:\7vvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\frxxrrl.exec:\frxxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bnhbth.exec:\bnhbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\ddjdv.exec:\ddjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\ppvjp.exec:\ppvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\flxlrll.exec:\flxlrll.exe23⤵
- Executes dropped EXE
PID:3660 -
\??\c:\nntnbt.exec:\nntnbt.exe24⤵
- Executes dropped EXE
PID:3852 -
\??\c:\djpjd.exec:\djpjd.exe25⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dpdvp.exec:\dpdvp.exe26⤵
- Executes dropped EXE
PID:428 -
\??\c:\xrlffxx.exec:\xrlffxx.exe27⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5bnnhn.exec:\5bnnhn.exe28⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7vpjd.exec:\7vpjd.exe29⤵
- Executes dropped EXE
PID:696 -
\??\c:\vdpjd.exec:\vdpjd.exe30⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rrlxflf.exec:\rrlxflf.exe31⤵
- Executes dropped EXE
PID:3528 -
\??\c:\tbbtnh.exec:\tbbtnh.exe32⤵
- Executes dropped EXE
PID:4392 -
\??\c:\3nnhhb.exec:\3nnhhb.exe33⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vppvp.exec:\vppvp.exe34⤵
- Executes dropped EXE
PID:5048 -
\??\c:\lrrffff.exec:\lrrffff.exe35⤵
- Executes dropped EXE
PID:3156 -
\??\c:\tnnbbb.exec:\tnnbbb.exe36⤵
- Executes dropped EXE
PID:3368 -
\??\c:\jvvjd.exec:\jvvjd.exe37⤵
- Executes dropped EXE
PID:4344 -
\??\c:\djpdp.exec:\djpdp.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lrxrfrl.exec:\lrxrfrl.exe39⤵
- Executes dropped EXE
PID:3204 -
\??\c:\hhtnbt.exec:\hhtnbt.exe40⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pdvjj.exec:\pdvjj.exe41⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5ppjd.exec:\5ppjd.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rflfxff.exec:\rflfxff.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1hnnhh.exec:\1hnnhh.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ddvvp.exec:\ddvvp.exe45⤵
- Executes dropped EXE
PID:4488 -
\??\c:\ppdvp.exec:\ppdvp.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\fxxrlff.exec:\fxxrlff.exe47⤵
- Executes dropped EXE
PID:3940 -
\??\c:\tnttnn.exec:\tnttnn.exe48⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vpddv.exec:\vpddv.exe49⤵
- Executes dropped EXE
PID:3504 -
\??\c:\5pjdv.exec:\5pjdv.exe50⤵
- Executes dropped EXE
PID:4964 -
\??\c:\ffrrllx.exec:\ffrrllx.exe51⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jdjpp.exec:\jdjpp.exe52⤵
- Executes dropped EXE
PID:4332 -
\??\c:\pvvpj.exec:\pvvpj.exe53⤵
- Executes dropped EXE
PID:940 -
\??\c:\5xfffff.exec:\5xfffff.exe54⤵
- Executes dropped EXE
PID:508 -
\??\c:\thnhhh.exec:\thnhhh.exe55⤵
- Executes dropped EXE
PID:4984 -
\??\c:\9bhhnn.exec:\9bhhnn.exe56⤵
- Executes dropped EXE
PID:4004 -
\??\c:\ddddv.exec:\ddddv.exe57⤵
- Executes dropped EXE
PID:4768 -
\??\c:\fllfxxr.exec:\fllfxxr.exe58⤵
- Executes dropped EXE
PID:4124 -
\??\c:\hhtnnt.exec:\hhtnnt.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\btnbhn.exec:\btnbhn.exe60⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jvpjd.exec:\jvpjd.exe61⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rlrlllf.exec:\rlrlllf.exe62⤵
- Executes dropped EXE
PID:388 -
\??\c:\xxllflf.exec:\xxllflf.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\btnbhh.exec:\btnbhh.exe64⤵
- Executes dropped EXE
PID:372 -
\??\c:\dvpjd.exec:\dvpjd.exe65⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vdvpj.exec:\vdvpj.exe66⤵PID:3040
-
\??\c:\xlxxflx.exec:\xlxxflx.exe67⤵PID:4128
-
\??\c:\5nnbbb.exec:\5nnbbb.exe68⤵PID:2796
-
\??\c:\pvvvv.exec:\pvvvv.exe69⤵PID:4836
-
\??\c:\flffffx.exec:\flffffx.exe70⤵PID:1016
-
\??\c:\bbbttb.exec:\bbbttb.exe71⤵PID:1948
-
\??\c:\vpvvp.exec:\vpvvp.exe72⤵PID:636
-
\??\c:\jdpjp.exec:\jdpjp.exe73⤵PID:4368
-
\??\c:\xllffff.exec:\xllffff.exe74⤵PID:4972
-
\??\c:\tbbhnh.exec:\tbbhnh.exe75⤵PID:5032
-
\??\c:\jjjpj.exec:\jjjpj.exe76⤵PID:988
-
\??\c:\lfrllll.exec:\lfrllll.exe77⤵PID:956
-
\??\c:\7jdvv.exec:\7jdvv.exe78⤵PID:1076
-
\??\c:\5fxrlrx.exec:\5fxrlrx.exe79⤵PID:1276
-
\??\c:\bbhhbh.exec:\bbhhbh.exe80⤵PID:3548
-
\??\c:\9pppj.exec:\9pppj.exe81⤵PID:4376
-
\??\c:\rxffxfx.exec:\rxffxfx.exe82⤵PID:4152
-
\??\c:\5lrlxxf.exec:\5lrlxxf.exe83⤵PID:2684
-
\??\c:\nnttnt.exec:\nnttnt.exe84⤵PID:4392
-
\??\c:\djpjj.exec:\djpjj.exe85⤵PID:3664
-
\??\c:\btbbbb.exec:\btbbbb.exe86⤵PID:3156
-
\??\c:\tnnhhh.exec:\tnnhhh.exe87⤵PID:3180
-
\??\c:\xfrxlxr.exec:\xfrxlxr.exe88⤵PID:5020
-
\??\c:\5bbbtb.exec:\5bbbtb.exe89⤵PID:2940
-
\??\c:\jjdvv.exec:\jjdvv.exe90⤵PID:2944
-
\??\c:\lffxxrr.exec:\lffxxrr.exe91⤵PID:3848
-
\??\c:\nhnnnn.exec:\nhnnnn.exe92⤵PID:3440
-
\??\c:\9tbttt.exec:\9tbttt.exe93⤵PID:552
-
\??\c:\fffxrrl.exec:\fffxrrl.exe94⤵PID:5084
-
\??\c:\ttttnt.exec:\ttttnt.exe95⤵PID:848
-
\??\c:\9nhbtb.exec:\9nhbtb.exe96⤵PID:3940
-
\??\c:\5jppp.exec:\5jppp.exe97⤵PID:2240
-
\??\c:\hntnhh.exec:\hntnhh.exe98⤵PID:3832
-
\??\c:\5pvpp.exec:\5pvpp.exe99⤵PID:4136
-
\??\c:\llrlllr.exec:\llrlllr.exe100⤵PID:2016
-
\??\c:\ffffxxx.exec:\ffffxxx.exe101⤵PID:396
-
\??\c:\vpdvj.exec:\vpdvj.exe102⤵PID:940
-
\??\c:\ffrlxrx.exec:\ffrlxrx.exe103⤵PID:772
-
\??\c:\xxrrrfr.exec:\xxrrrfr.exe104⤵PID:2616
-
\??\c:\jpvvv.exec:\jpvvv.exe105⤵PID:2964
-
\??\c:\nthbtt.exec:\nthbtt.exe106⤵PID:3964
-
\??\c:\jjddj.exec:\jjddj.exe107⤵
- System Location Discovery: System Language Discovery
PID:4768 -
\??\c:\thnhhh.exec:\thnhhh.exe108⤵PID:4024
-
\??\c:\pppvp.exec:\pppvp.exe109⤵PID:2708
-
\??\c:\thbtnn.exec:\thbtnn.exe110⤵
- System Location Discovery: System Language Discovery
PID:4708 -
\??\c:\dvjjj.exec:\dvjjj.exe111⤵PID:4512
-
\??\c:\rfxxlrl.exec:\rfxxlrl.exe112⤵PID:1028
-
\??\c:\ppvpj.exec:\ppvpj.exe113⤵PID:4764
-
\??\c:\nhnhbb.exec:\nhnhbb.exe114⤵PID:388
-
\??\c:\5hhnbn.exec:\5hhnbn.exe115⤵PID:4528
-
\??\c:\nhnnhh.exec:\nhnnhh.exe116⤵PID:856
-
\??\c:\7lfrlxx.exec:\7lfrlxx.exe117⤵PID:1796
-
\??\c:\bttnhb.exec:\bttnhb.exe118⤵PID:3572
-
\??\c:\7vdvj.exec:\7vdvj.exe119⤵PID:2536
-
\??\c:\1rxrlrl.exec:\1rxrlrl.exe120⤵PID:4300
-
\??\c:\tnnnhb.exec:\tnnnhb.exe121⤵PID:4232
-
\??\c:\hhbbnn.exec:\hhbbnn.exe122⤵PID:1920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-