Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2025, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe
Resource
win7-20241010-en
General
-
Target
d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe
-
Size
455KB
-
MD5
53a6cdd492f8ead98218e2b6e3ab91e0
-
SHA1
32ea91ce0116c682913522d6ab5e56a7a7379c9b
-
SHA256
d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16
-
SHA512
cd531a810203efd5b366fa6aaf0267060894efc70c2715a015923bd2cc2908dc9d813b66ab313bc10077fd0cba835ee018af4717c93e319efac46f4c7c32b0a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/5024-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3068-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4868-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1204-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4764-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3512-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3712-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4640-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3616-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4188-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/952-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4580-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/764-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2132-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1352-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1400-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1856-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2744-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2940-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3448-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1712-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2352-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5016-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1964-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3888-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4996-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3168-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4388-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2028-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3280-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4876-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5040-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3688-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-744-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4140-842-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3244-864-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4816-1213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5024 hthbtn.exe 3904 ddjjd.exe 3068 3vvjj.exe 3280 llffxxx.exe 2744 xxxfxxx.exe 1936 ttnhtt.exe 1204 7nbhnn.exe 4868 pvvjv.exe 4572 lrxrllf.exe 4764 pjdpp.exe 3124 jvvpp.exe 4376 rfllfxr.exe 4560 jjvpj.exe 3512 rfrrlll.exe 3712 bhtnnn.exe 2140 fxxffff.exe 4640 nhbtnn.exe 5040 pvpjd.exe 3616 hbbthb.exe 5016 pjdvj.exe 4540 lffxrll.exe 4192 nnhhbh.exe 644 xfxxxll.exe 1504 5hhbbb.exe 4744 pjvvp.exe 4040 5pvpj.exe 4188 hhnhbb.exe 952 flfxrrl.exe 3224 hnbtnn.exe 4580 1nnnhn.exe 764 pvppp.exe 976 3llllrr.exe 4816 pvjjp.exe 4528 rlfxrrl.exe 2132 tbbbtn.exe 3664 7nttnn.exe 1180 7nbhtb.exe 1584 5dvvv.exe 1780 xrrrllf.exe 3912 nhnnnn.exe 4672 3tbttb.exe 1352 jpvpv.exe 4436 xflfxff.exe 5100 7ntthh.exe 4940 1pdvp.exe 32 llrrlxr.exe 2540 9nhbtt.exe 1400 5bhbth.exe 5112 dvvdd.exe 1856 lrrlffx.exe 3476 lfllfff.exe 4852 vjppp.exe 2264 rrfxxxr.exe 4612 1ntnhh.exe 840 1tnhbb.exe 4700 jvjjv.exe 4676 fllflll.exe 1424 tnbttt.exe 3184 vjjdd.exe 2744 5djdp.exe 3028 xlllffr.exe 2940 nbhbhh.exe 3448 5nttbb.exe 2952 rrxxlrx.exe -
resource yara_rule behavioral2/memory/5024-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3068-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4868-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1204-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4764-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3512-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3712-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4640-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3616-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4188-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/952-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4580-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/764-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4816-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2132-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1352-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1400-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1856-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2940-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3448-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1712-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2352-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5016-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1964-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3888-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4996-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3168-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2028-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3280-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4876-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5040-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3688-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-787-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxlfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4852 wrote to memory of 5024 4852 d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe 83 PID 4852 wrote to memory of 5024 4852 d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe 83 PID 4852 wrote to memory of 5024 4852 d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe 83 PID 5024 wrote to memory of 3904 5024 hthbtn.exe 84 PID 5024 wrote to memory of 3904 5024 hthbtn.exe 84 PID 5024 wrote to memory of 3904 5024 hthbtn.exe 84 PID 3904 wrote to memory of 3068 3904 ddjjd.exe 85 PID 3904 wrote to memory of 3068 3904 ddjjd.exe 85 PID 3904 wrote to memory of 3068 3904 ddjjd.exe 85 PID 3068 wrote to memory of 3280 3068 3vvjj.exe 86 PID 3068 wrote to memory of 3280 3068 3vvjj.exe 86 PID 3068 wrote to memory of 3280 3068 3vvjj.exe 86 PID 3280 wrote to memory of 2744 3280 llffxxx.exe 87 PID 3280 wrote to memory of 2744 3280 llffxxx.exe 87 PID 3280 wrote to memory of 2744 3280 llffxxx.exe 87 PID 2744 wrote to memory of 1936 2744 xxxfxxx.exe 88 PID 2744 wrote to memory of 1936 2744 xxxfxxx.exe 88 PID 2744 wrote to memory of 1936 2744 xxxfxxx.exe 88 PID 1936 wrote to memory of 1204 1936 ttnhtt.exe 89 PID 1936 wrote to memory of 1204 1936 ttnhtt.exe 89 PID 1936 wrote to memory of 1204 1936 ttnhtt.exe 89 PID 1204 wrote to memory of 4868 1204 7nbhnn.exe 90 PID 1204 wrote to memory of 4868 1204 7nbhnn.exe 90 PID 1204 wrote to memory of 4868 1204 7nbhnn.exe 90 PID 4868 wrote to memory of 4572 4868 pvvjv.exe 91 PID 4868 wrote to memory of 4572 4868 pvvjv.exe 91 PID 4868 wrote to memory of 4572 4868 pvvjv.exe 91 PID 4572 wrote to memory of 4764 4572 lrxrllf.exe 92 PID 4572 wrote to memory of 4764 4572 lrxrllf.exe 92 PID 4572 wrote to memory of 4764 4572 lrxrllf.exe 92 PID 4764 wrote to memory of 3124 4764 pjdpp.exe 93 PID 4764 wrote to memory of 3124 4764 pjdpp.exe 93 PID 4764 wrote to memory of 3124 4764 pjdpp.exe 93 PID 3124 wrote to memory of 4376 3124 jvvpp.exe 94 PID 3124 wrote to memory of 4376 3124 jvvpp.exe 94 PID 3124 wrote to memory of 4376 3124 jvvpp.exe 94 PID 4376 wrote to memory of 4560 4376 rfllfxr.exe 95 PID 4376 wrote to memory of 4560 4376 rfllfxr.exe 95 PID 4376 wrote to memory of 4560 4376 rfllfxr.exe 95 PID 4560 wrote to memory of 3512 4560 jjvpj.exe 96 PID 4560 wrote to memory of 3512 4560 jjvpj.exe 96 PID 4560 wrote to memory of 3512 4560 jjvpj.exe 96 PID 3512 wrote to memory of 3712 3512 rfrrlll.exe 97 PID 3512 wrote to memory of 3712 3512 rfrrlll.exe 97 PID 3512 wrote to memory of 3712 3512 rfrrlll.exe 97 PID 3712 wrote to memory of 2140 3712 bhtnnn.exe 98 PID 3712 wrote to memory of 2140 3712 bhtnnn.exe 98 PID 3712 wrote to memory of 2140 3712 bhtnnn.exe 98 PID 2140 wrote to memory of 4640 2140 fxxffff.exe 99 PID 2140 wrote to memory of 4640 2140 fxxffff.exe 99 PID 2140 wrote to memory of 4640 2140 fxxffff.exe 99 PID 4640 wrote to memory of 5040 4640 nhbtnn.exe 100 PID 4640 wrote to memory of 5040 4640 nhbtnn.exe 100 PID 4640 wrote to memory of 5040 4640 nhbtnn.exe 100 PID 5040 wrote to memory of 3616 5040 pvpjd.exe 101 PID 5040 wrote to memory of 3616 5040 pvpjd.exe 101 PID 5040 wrote to memory of 3616 5040 pvpjd.exe 101 PID 3616 wrote to memory of 5016 3616 hbbthb.exe 102 PID 3616 wrote to memory of 5016 3616 hbbthb.exe 102 PID 3616 wrote to memory of 5016 3616 hbbthb.exe 102 PID 5016 wrote to memory of 4540 5016 pjdvj.exe 103 PID 5016 wrote to memory of 4540 5016 pjdvj.exe 103 PID 5016 wrote to memory of 4540 5016 pjdvj.exe 103 PID 4540 wrote to memory of 4192 4540 lffxrll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe"C:\Users\Admin\AppData\Local\Temp\d7445ede4110fbbf9e2d56f5ada2a5e3160431462481f33f48a8a728ca1e6a16N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\hthbtn.exec:\hthbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\ddjjd.exec:\ddjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\3vvjj.exec:\3vvjj.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\llffxxx.exec:\llffxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\xxxfxxx.exec:\xxxfxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ttnhtt.exec:\ttnhtt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7nbhnn.exec:\7nbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\pvvjv.exec:\pvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\lrxrllf.exec:\lrxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\pjdpp.exec:\pjdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\jvvpp.exec:\jvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\rfllfxr.exec:\rfllfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\jjvpj.exec:\jjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rfrrlll.exec:\rfrrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\bhtnnn.exec:\bhtnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\fxxffff.exec:\fxxffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\nhbtnn.exec:\nhbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\pvpjd.exec:\pvpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\hbbthb.exec:\hbbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\pjdvj.exec:\pjdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\lffxrll.exec:\lffxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\nnhhbh.exec:\nnhhbh.exe23⤵
- Executes dropped EXE
PID:4192 -
\??\c:\xfxxxll.exec:\xfxxxll.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\5hhbbb.exec:\5hhbbb.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\pjvvp.exec:\pjvvp.exe26⤵
- Executes dropped EXE
PID:4744 -
\??\c:\5pvpj.exec:\5pvpj.exe27⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hhnhbb.exec:\hhnhbb.exe28⤵
- Executes dropped EXE
PID:4188 -
\??\c:\flfxrrl.exec:\flfxrrl.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\hnbtnn.exec:\hnbtnn.exe30⤵
- Executes dropped EXE
PID:3224 -
\??\c:\1nnnhn.exec:\1nnnhn.exe31⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pvppp.exec:\pvppp.exe32⤵
- Executes dropped EXE
PID:764 -
\??\c:\3llllrr.exec:\3llllrr.exe33⤵
- Executes dropped EXE
PID:976 -
\??\c:\pvjjp.exec:\pvjjp.exe34⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe35⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tbbbtn.exec:\tbbbtn.exe36⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7nttnn.exec:\7nttnn.exe37⤵
- Executes dropped EXE
PID:3664 -
\??\c:\7nbhtb.exec:\7nbhtb.exe38⤵
- Executes dropped EXE
PID:1180 -
\??\c:\5dvvv.exec:\5dvvv.exe39⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrrrllf.exec:\xrrrllf.exe40⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nhnnnn.exec:\nhnnnn.exe41⤵
- Executes dropped EXE
PID:3912 -
\??\c:\3tbttb.exec:\3tbttb.exe42⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jpvpv.exec:\jpvpv.exe43⤵
- Executes dropped EXE
PID:1352 -
\??\c:\xflfxff.exec:\xflfxff.exe44⤵
- Executes dropped EXE
PID:4436 -
\??\c:\7ntthh.exec:\7ntthh.exe45⤵
- Executes dropped EXE
PID:5100 -
\??\c:\1pdvp.exec:\1pdvp.exe46⤵
- Executes dropped EXE
PID:4940 -
\??\c:\llrrlxr.exec:\llrrlxr.exe47⤵
- Executes dropped EXE
PID:32 -
\??\c:\9nhbtt.exec:\9nhbtt.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5bhbth.exec:\5bhbth.exe49⤵
- Executes dropped EXE
PID:1400 -
\??\c:\dvvdd.exec:\dvvdd.exe50⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lrrlffx.exec:\lrrlffx.exe51⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lfllfff.exec:\lfllfff.exe52⤵
- Executes dropped EXE
PID:3476 -
\??\c:\jjdvp.exec:\jjdvp.exe53⤵PID:4440
-
\??\c:\vjppp.exec:\vjppp.exe54⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\1ntnhh.exec:\1ntnhh.exe56⤵
- Executes dropped EXE
PID:4612 -
\??\c:\1tnhbb.exec:\1tnhbb.exe57⤵
- Executes dropped EXE
PID:840 -
\??\c:\jvjjv.exec:\jvjjv.exe58⤵
- Executes dropped EXE
PID:4700 -
\??\c:\fllflll.exec:\fllflll.exe59⤵
- Executes dropped EXE
PID:4676 -
\??\c:\tnbttt.exec:\tnbttt.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vjjdd.exec:\vjjdd.exe61⤵
- Executes dropped EXE
PID:3184 -
\??\c:\5djdp.exec:\5djdp.exe62⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlllffr.exec:\xlllffr.exe63⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nbhbhh.exec:\nbhbhh.exe64⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5nttbb.exec:\5nttbb.exe65⤵
- Executes dropped EXE
PID:3448 -
\??\c:\rrxxlrx.exec:\rrxxlrx.exe66⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xfxllff.exec:\xfxllff.exe67⤵PID:1308
-
\??\c:\3tnnnt.exec:\3tnnnt.exe68⤵PID:1000
-
\??\c:\jvvvp.exec:\jvvvp.exe69⤵PID:4764
-
\??\c:\rllllfx.exec:\rllllfx.exe70⤵PID:2736
-
\??\c:\ttbttt.exec:\ttbttt.exe71⤵PID:2956
-
\??\c:\hhnnht.exec:\hhnnht.exe72⤵PID:4376
-
\??\c:\vpjdp.exec:\vpjdp.exe73⤵PID:772
-
\??\c:\7rllffx.exec:\7rllffx.exe74⤵PID:3756
-
\??\c:\bbbbhh.exec:\bbbbhh.exe75⤵PID:2628
-
\??\c:\tthhnn.exec:\tthhnn.exe76⤵PID:1712
-
\??\c:\pvppj.exec:\pvppj.exe77⤵PID:2352
-
\??\c:\xfxffxf.exec:\xfxffxf.exe78⤵PID:3844
-
\??\c:\3ntnhh.exec:\3ntnhh.exe79⤵PID:2164
-
\??\c:\jpjdv.exec:\jpjdv.exe80⤵PID:3616
-
\??\c:\9ffllll.exec:\9ffllll.exe81⤵PID:1612
-
\??\c:\htthbn.exec:\htthbn.exe82⤵PID:2420
-
\??\c:\5jdvv.exec:\5jdvv.exe83⤵PID:5016
-
\??\c:\vpvpj.exec:\vpvpj.exe84⤵PID:1516
-
\??\c:\fxxrrlf.exec:\fxxrrlf.exe85⤵PID:1964
-
\??\c:\btbbbb.exec:\btbbbb.exe86⤵PID:4768
-
\??\c:\vvpjv.exec:\vvpjv.exe87⤵PID:1220
-
\??\c:\llffrrf.exec:\llffrrf.exe88⤵PID:1504
-
\??\c:\nnnnhh.exec:\nnnnhh.exe89⤵PID:4356
-
\??\c:\1bthbh.exec:\1bthbh.exe90⤵PID:948
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:3612
-
\??\c:\lxfffff.exec:\lxfffff.exe92⤵PID:4532
-
\??\c:\hnhbtn.exec:\hnhbtn.exe93⤵PID:4472
-
\??\c:\jppjj.exec:\jppjj.exe94⤵PID:4848
-
\??\c:\vjjjv.exec:\vjjjv.exe95⤵PID:3160
-
\??\c:\rlrrllf.exec:\rlrrllf.exe96⤵PID:3976
-
\??\c:\tnnhbh.exec:\tnnhbh.exe97⤵PID:5032
-
\??\c:\ddjdd.exec:\ddjdd.exe98⤵PID:3888
-
\??\c:\pppjv.exec:\pppjv.exe99⤵PID:4996
-
\??\c:\fxxlrfx.exec:\fxxlrfx.exe100⤵PID:5052
-
\??\c:\pvddj.exec:\pvddj.exe101⤵PID:5080
-
\??\c:\fxxrfrl.exec:\fxxrfrl.exe102⤵PID:3168
-
\??\c:\5rllffx.exec:\5rllffx.exe103⤵PID:2604
-
\??\c:\3hhtnh.exec:\3hhtnh.exe104⤵PID:4956
-
\??\c:\vdjdv.exec:\vdjdv.exe105⤵PID:4316
-
\??\c:\lllxrrl.exec:\lllxrrl.exe106⤵PID:3912
-
\??\c:\9bbbtn.exec:\9bbbtn.exe107⤵PID:4904
-
\??\c:\hthhbn.exec:\hthhbn.exe108⤵PID:2196
-
\??\c:\ddvpj.exec:\ddvpj.exe109⤵PID:4052
-
\??\c:\xfxlrfx.exec:\xfxlrfx.exe110⤵PID:2872
-
\??\c:\nnhhnn.exec:\nnhhnn.exe111⤵PID:2476
-
\??\c:\5vdvj.exec:\5vdvj.exe112⤵PID:2912
-
\??\c:\lxfxlrl.exec:\lxfxlrl.exe113⤵PID:4388
-
\??\c:\rxrllll.exec:\rxrllll.exe114⤵PID:2252
-
\??\c:\nnttbh.exec:\nnttbh.exe115⤵PID:5112
-
\??\c:\vjjvv.exec:\vjjvv.exe116⤵PID:4500
-
\??\c:\fffxrxr.exec:\fffxrxr.exe117⤵PID:2028
-
\??\c:\hbtnbt.exec:\hbtnbt.exe118⤵PID:4564
-
\??\c:\bhttnn.exec:\bhttnn.exe119⤵PID:5024
-
\??\c:\jdddv.exec:\jdddv.exe120⤵PID:2904
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe121⤵PID:3660
-
\??\c:\flxrrrf.exec:\flxrrrf.exe122⤵PID:3040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-