Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:47
Behavioral task
behavioral1
Sample
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe
Resource
win7-20240903-en
General
-
Target
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe
-
Size
333KB
-
MD5
e2ef38dc1e48bdd8345b740d71c59ed1
-
SHA1
4cc3ae307f9190cdeee59eb43a7e34bf1a379ccd
-
SHA256
d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324
-
SHA512
3c1722e62292f1c506abdb37dbe799270d509e4a524b422688b159e01e2e3eed777c476206c7a2b15e1d1ecef75b440707e85b24eccfdc1d674c1dd5f768fb56
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeL:R4wFHoSHYHUrAwfMp3CDL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1936-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/320-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3028-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/460-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1656-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2948-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2896-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1044-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-632-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-666-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-733-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-895-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2120-898-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-1547-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4912 vpdpp.exe 4328 rrxfllx.exe 3020 jdddd.exe 320 flrrlll.exe 4828 djpjj.exe 3976 hbbbnt.exe 2892 lffffff.exe 1036 nnntnb.exe 4892 bbbbbh.exe 3960 vdjdd.exe 5112 nntnhh.exe 4048 1pppj.exe 4104 1pppp.exe 4692 xlrxxxx.exe 5040 nnnnnt.exe 32 vvvvv.exe 4900 frrrlrr.exe 1908 3bhhhn.exe 2908 ppvvp.exe 4576 7lxrxfl.exe 2312 7ttttb.exe 4948 9vddv.exe 3656 9vppp.exe 2852 3bttth.exe 1324 lrxxflr.exe 3720 hhtthh.exe 2264 frllfxr.exe 3028 9bhhbn.exe 4812 frrlrxf.exe 3212 hbttnn.exe 2220 5nbbbh.exe 2776 fxxxxfx.exe 4804 tbnhnn.exe 432 bbbttt.exe 4952 ddvpd.exe 1140 1fxxxxx.exe 832 nthbnn.exe 628 5vjdj.exe 672 1xfffxx.exe 2704 bbhhhn.exe 4592 bbthbn.exe 1616 pdjdv.exe 4652 rxxrrrl.exe 1516 bbhbbn.exe 2856 dvddd.exe 2624 7frllll.exe 460 fxlxxlf.exe 1780 9hnnhn.exe 2096 pvvpj.exe 1656 jvdpp.exe 4672 bttnhb.exe 4292 ffrlxxf.exe 1672 7ffxxfx.exe 2860 nhnhtb.exe 4368 vdvdv.exe 4524 rrfxxrx.exe 4840 1bnhbh.exe 1872 htbbnh.exe 4836 pdpjj.exe 2044 flxrlll.exe 1440 vpvjj.exe 3040 rrlfxxf.exe 320 bhhhbh.exe 2920 vddvp.exe -
resource yara_rule behavioral2/memory/1936-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023bf9-3.dat upx behavioral2/memory/1936-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc0-8.dat upx behavioral2/memory/4912-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc5-11.dat upx behavioral2/memory/3020-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4328-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc6-19.dat upx behavioral2/memory/320-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc7-24.dat upx behavioral2/files/0x0007000000023cc8-28.dat upx behavioral2/memory/4828-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cc9-33.dat upx behavioral2/files/0x0007000000023cca-37.dat upx behavioral2/memory/2892-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccb-42.dat upx behavioral2/memory/4892-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3960-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccc-49.dat upx behavioral2/files/0x0007000000023ccd-53.dat upx behavioral2/memory/3960-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cce-59.dat upx behavioral2/memory/4048-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5112-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ccf-64.dat upx behavioral2/files/0x0007000000023cd0-69.dat upx behavioral2/memory/4692-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd1-72.dat upx behavioral2/memory/5040-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023cc1-77.dat upx behavioral2/files/0x0007000000023cd2-82.dat upx behavioral2/memory/4900-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd3-87.dat upx behavioral2/files/0x0007000000023cd4-93.dat upx behavioral2/memory/1908-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd5-96.dat upx behavioral2/memory/2908-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4576-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd6-102.dat upx behavioral2/files/0x0007000000023cd8-106.dat upx behavioral2/memory/2312-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cd9-112.dat upx behavioral2/memory/3656-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cda-118.dat upx behavioral2/memory/2852-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cdb-122.dat upx behavioral2/files/0x0007000000023cdc-127.dat upx behavioral2/files/0x0007000000023cdd-131.dat upx behavioral2/memory/3720-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023cde-135.dat upx behavioral2/files/0x0007000000023cdf-140.dat upx behavioral2/memory/3028-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce0-144.dat upx behavioral2/files/0x0007000000023ce1-148.dat upx behavioral2/memory/3212-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023ce2-153.dat upx behavioral2/memory/2220-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2776-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/432-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4952-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/628-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1936 wrote to memory of 4912 1936 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 83 PID 1936 wrote to memory of 4912 1936 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 83 PID 1936 wrote to memory of 4912 1936 d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe 83 PID 4912 wrote to memory of 4328 4912 vpdpp.exe 84 PID 4912 wrote to memory of 4328 4912 vpdpp.exe 84 PID 4912 wrote to memory of 4328 4912 vpdpp.exe 84 PID 4328 wrote to memory of 3020 4328 rrxfllx.exe 85 PID 4328 wrote to memory of 3020 4328 rrxfllx.exe 85 PID 4328 wrote to memory of 3020 4328 rrxfllx.exe 85 PID 3020 wrote to memory of 320 3020 jdddd.exe 86 PID 3020 wrote to memory of 320 3020 jdddd.exe 86 PID 3020 wrote to memory of 320 3020 jdddd.exe 86 PID 320 wrote to memory of 4828 320 flrrlll.exe 87 PID 320 wrote to memory of 4828 320 flrrlll.exe 87 PID 320 wrote to memory of 4828 320 flrrlll.exe 87 PID 4828 wrote to memory of 3976 4828 djpjj.exe 88 PID 4828 wrote to memory of 3976 4828 djpjj.exe 88 PID 4828 wrote to memory of 3976 4828 djpjj.exe 88 PID 3976 wrote to memory of 2892 3976 hbbbnt.exe 89 PID 3976 wrote to memory of 2892 3976 hbbbnt.exe 89 PID 3976 wrote to memory of 2892 3976 hbbbnt.exe 89 PID 2892 wrote to memory of 1036 2892 lffffff.exe 90 PID 2892 wrote to memory of 1036 2892 lffffff.exe 90 PID 2892 wrote to memory of 1036 2892 lffffff.exe 90 PID 1036 wrote to memory of 4892 1036 nnntnb.exe 91 PID 1036 wrote to memory of 4892 1036 nnntnb.exe 91 PID 1036 wrote to memory of 4892 1036 nnntnb.exe 91 PID 4892 wrote to memory of 3960 4892 bbbbbh.exe 92 PID 4892 wrote to memory of 3960 4892 bbbbbh.exe 92 PID 4892 wrote to memory of 3960 4892 bbbbbh.exe 92 PID 3960 wrote to memory of 5112 3960 vdjdd.exe 93 PID 3960 wrote to memory of 5112 3960 vdjdd.exe 93 PID 3960 wrote to memory of 5112 3960 vdjdd.exe 93 PID 5112 wrote to memory of 4048 5112 nntnhh.exe 94 PID 5112 wrote to memory of 4048 5112 nntnhh.exe 94 PID 5112 wrote to memory of 4048 5112 nntnhh.exe 94 PID 4048 wrote to memory of 4104 4048 1pppj.exe 95 PID 4048 wrote to memory of 4104 4048 1pppj.exe 95 PID 4048 wrote to memory of 4104 4048 1pppj.exe 95 PID 4104 wrote to memory of 4692 4104 1pppp.exe 96 PID 4104 wrote to memory of 4692 4104 1pppp.exe 96 PID 4104 wrote to memory of 4692 4104 1pppp.exe 96 PID 4692 wrote to memory of 5040 4692 xlrxxxx.exe 97 PID 4692 wrote to memory of 5040 4692 xlrxxxx.exe 97 PID 4692 wrote to memory of 5040 4692 xlrxxxx.exe 97 PID 5040 wrote to memory of 32 5040 nnnnnt.exe 98 PID 5040 wrote to memory of 32 5040 nnnnnt.exe 98 PID 5040 wrote to memory of 32 5040 nnnnnt.exe 98 PID 32 wrote to memory of 4900 32 vvvvv.exe 99 PID 32 wrote to memory of 4900 32 vvvvv.exe 99 PID 32 wrote to memory of 4900 32 vvvvv.exe 99 PID 4900 wrote to memory of 1908 4900 frrrlrr.exe 100 PID 4900 wrote to memory of 1908 4900 frrrlrr.exe 100 PID 4900 wrote to memory of 1908 4900 frrrlrr.exe 100 PID 1908 wrote to memory of 2908 1908 3bhhhn.exe 101 PID 1908 wrote to memory of 2908 1908 3bhhhn.exe 101 PID 1908 wrote to memory of 2908 1908 3bhhhn.exe 101 PID 2908 wrote to memory of 4576 2908 ppvvp.exe 102 PID 2908 wrote to memory of 4576 2908 ppvvp.exe 102 PID 2908 wrote to memory of 4576 2908 ppvvp.exe 102 PID 4576 wrote to memory of 2312 4576 7lxrxfl.exe 103 PID 4576 wrote to memory of 2312 4576 7lxrxfl.exe 103 PID 4576 wrote to memory of 2312 4576 7lxrxfl.exe 103 PID 2312 wrote to memory of 4948 2312 7ttttb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe"C:\Users\Admin\AppData\Local\Temp\d0b4647d03db916ae44171aca59be5a5f2668e05a1df94899a520fb42324a324.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vpdpp.exec:\vpdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\rrxfllx.exec:\rrxfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\jdddd.exec:\jdddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\flrrlll.exec:\flrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\djpjj.exec:\djpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\hbbbnt.exec:\hbbbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\lffffff.exec:\lffffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nnntnb.exec:\nnntnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\bbbbbh.exec:\bbbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\vdjdd.exec:\vdjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\nntnhh.exec:\nntnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\1pppj.exec:\1pppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\1pppp.exec:\1pppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\nnnnnt.exec:\nnnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vvvvv.exec:\vvvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\frrrlrr.exec:\frrrlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\3bhhhn.exec:\3bhhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\ppvvp.exec:\ppvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\7lxrxfl.exec:\7lxrxfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\7ttttb.exec:\7ttttb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\9vddv.exec:\9vddv.exe23⤵
- Executes dropped EXE
PID:4948 -
\??\c:\9vppp.exec:\9vppp.exe24⤵
- Executes dropped EXE
PID:3656 -
\??\c:\3bttth.exec:\3bttth.exe25⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lrxxflr.exec:\lrxxflr.exe26⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hhtthh.exec:\hhtthh.exe27⤵
- Executes dropped EXE
PID:3720 -
\??\c:\frllfxr.exec:\frllfxr.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9bhhbn.exec:\9bhhbn.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\frrlrxf.exec:\frrlrxf.exe30⤵
- Executes dropped EXE
PID:4812 -
\??\c:\hbttnn.exec:\hbttnn.exe31⤵
- Executes dropped EXE
PID:3212 -
\??\c:\5nbbbh.exec:\5nbbbh.exe32⤵
- Executes dropped EXE
PID:2220 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tbnhnn.exec:\tbnhnn.exe34⤵
- Executes dropped EXE
PID:4804 -
\??\c:\bbbttt.exec:\bbbttt.exe35⤵
- Executes dropped EXE
PID:432 -
\??\c:\ddvpd.exec:\ddvpd.exe36⤵
- Executes dropped EXE
PID:4952 -
\??\c:\1fxxxxx.exec:\1fxxxxx.exe37⤵
- Executes dropped EXE
PID:1140 -
\??\c:\nthbnn.exec:\nthbnn.exe38⤵
- Executes dropped EXE
PID:832 -
\??\c:\5vjdj.exec:\5vjdj.exe39⤵
- Executes dropped EXE
PID:628 -
\??\c:\1xfffxx.exec:\1xfffxx.exe40⤵
- Executes dropped EXE
PID:672 -
\??\c:\bbhhhn.exec:\bbhhhn.exe41⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbthbn.exec:\bbthbn.exe42⤵
- Executes dropped EXE
PID:4592 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe44⤵
- Executes dropped EXE
PID:4652 -
\??\c:\bbhbbn.exec:\bbhbbn.exe45⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvddd.exec:\dvddd.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\7frllll.exec:\7frllll.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxlxxlf.exec:\fxlxxlf.exe48⤵
- Executes dropped EXE
PID:460 -
\??\c:\9hnnhn.exec:\9hnnhn.exe49⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pvvpj.exec:\pvvpj.exe50⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jvdpp.exec:\jvdpp.exe51⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bttnhb.exec:\bttnhb.exe52⤵
- Executes dropped EXE
PID:4672 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe53⤵
- Executes dropped EXE
PID:4292 -
\??\c:\7ffxxfx.exec:\7ffxxfx.exe54⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nhnhtb.exec:\nhnhtb.exe55⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vdvdv.exec:\vdvdv.exe56⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe57⤵
- Executes dropped EXE
PID:4524 -
\??\c:\1bnhbh.exec:\1bnhbh.exe58⤵
- Executes dropped EXE
PID:4840 -
\??\c:\htbbnh.exec:\htbbnh.exe59⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pdpjj.exec:\pdpjj.exe60⤵
- Executes dropped EXE
PID:4836 -
\??\c:\flxrlll.exec:\flxrlll.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vpvjj.exec:\vpvjj.exe62⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rrlfxxf.exec:\rrlfxxf.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\bhhhbh.exec:\bhhhbh.exe64⤵
- Executes dropped EXE
PID:320 -
\??\c:\vddvp.exec:\vddvp.exe65⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7jvvp.exec:\7jvvp.exe66⤵PID:4764
-
\??\c:\9xfffff.exec:\9xfffff.exe67⤵PID:4560
-
\??\c:\hnbhnn.exec:\hnbhnn.exe68⤵PID:860
-
\??\c:\ttthbb.exec:\ttthbb.exe69⤵PID:2800
-
\??\c:\jjvvj.exec:\jjvvj.exe70⤵PID:2948
-
\??\c:\xffffff.exec:\xffffff.exe71⤵PID:3160
-
\??\c:\xrffllr.exec:\xrffllr.exe72⤵PID:2000
-
\??\c:\tnhhbb.exec:\tnhhbb.exe73⤵PID:3960
-
\??\c:\pjdvj.exec:\pjdvj.exe74⤵PID:2828
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe75⤵PID:2484
-
\??\c:\bttttt.exec:\bttttt.exe76⤵PID:228
-
\??\c:\9jdvp.exec:\9jdvp.exe77⤵PID:4680
-
\??\c:\djppd.exec:\djppd.exe78⤵PID:2288
-
\??\c:\9rxrllf.exec:\9rxrllf.exe79⤵PID:1456
-
\??\c:\3nnnnh.exec:\3nnnnh.exe80⤵PID:5056
-
\??\c:\9hbhbb.exec:\9hbhbb.exe81⤵PID:3280
-
\??\c:\3dvpj.exec:\3dvpj.exe82⤵PID:1692
-
\??\c:\7xrrrxx.exec:\7xrrrxx.exe83⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\9tbbhb.exec:\9tbbhb.exe84⤵PID:3344
-
\??\c:\vvppd.exec:\vvppd.exe85⤵PID:1908
-
\??\c:\1ddpp.exec:\1ddpp.exe86⤵PID:1464
-
\??\c:\xxflrrl.exec:\xxflrrl.exe87⤵PID:3564
-
\??\c:\httntn.exec:\httntn.exe88⤵PID:1196
-
\??\c:\ntbbhh.exec:\ntbbhh.exe89⤵PID:2236
-
\??\c:\7jdvj.exec:\7jdvj.exe90⤵PID:2320
-
\??\c:\rxffrrf.exec:\rxffrrf.exe91⤵PID:4948
-
\??\c:\bbbhtt.exec:\bbbhtt.exe92⤵PID:1744
-
\??\c:\ttbbtt.exec:\ttbbtt.exe93⤵PID:4076
-
\??\c:\vpvpj.exec:\vpvpj.exe94⤵PID:4796
-
\??\c:\9xlfrrl.exec:\9xlfrrl.exe95⤵PID:5108
-
\??\c:\rxfllxf.exec:\rxfllxf.exe96⤵PID:1992
-
\??\c:\btbtnn.exec:\btbtnn.exe97⤵PID:948
-
\??\c:\vjvvp.exec:\vjvvp.exe98⤵PID:2208
-
\??\c:\lxxrxrl.exec:\lxxrxrl.exe99⤵PID:4568
-
\??\c:\lffxxfr.exec:\lffxxfr.exe100⤵PID:1044
-
\??\c:\5nnhtt.exec:\5nnhtt.exe101⤵PID:5100
-
\??\c:\pjjjv.exec:\pjjjv.exe102⤵
- System Location Discovery: System Language Discovery
PID:4228 -
\??\c:\pppjd.exec:\pppjd.exe103⤵PID:2940
-
\??\c:\5fllffx.exec:\5fllffx.exe104⤵PID:2224
-
\??\c:\tnthtt.exec:\tnthtt.exe105⤵PID:3644
-
\??\c:\nhnhhb.exec:\nhnhhb.exe106⤵PID:4960
-
\??\c:\ppvpp.exec:\ppvpp.exe107⤵PID:884
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe108⤵PID:3236
-
\??\c:\5hntnh.exec:\5hntnh.exe109⤵PID:1752
-
\??\c:\hhhtnh.exec:\hhhtnh.exe110⤵PID:3032
-
\??\c:\dvvvp.exec:\dvvvp.exe111⤵PID:4200
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe112⤵PID:220
-
\??\c:\7lrrxff.exec:\7lrrxff.exe113⤵PID:1336
-
\??\c:\nhtnnt.exec:\nhtnnt.exe114⤵PID:1912
-
\??\c:\pjpjv.exec:\pjpjv.exe115⤵PID:3444
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe116⤵PID:1708
-
\??\c:\rrrlflx.exec:\rrrlflx.exe117⤵PID:3228
-
\??\c:\tnhbtn.exec:\tnhbtn.exe118⤵PID:1660
-
\??\c:\pjpjj.exec:\pjpjj.exe119⤵PID:1808
-
\??\c:\dvddv.exec:\dvddv.exe120⤵PID:2872
-
\??\c:\xrlfrrl.exec:\xrlfrrl.exe121⤵PID:3004
-
\??\c:\ntbbnt.exec:\ntbbnt.exe122⤵PID:4544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-