Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2025, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
Resource
win7-20240903-en
General
-
Target
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe
-
Size
454KB
-
MD5
34cd1863be9d6312e65dea806126112d
-
SHA1
8442565f46a1e04be775c81bf36f94e252322619
-
SHA256
ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678
-
SHA512
7e06db0c05569305711c9826bb91eb4fdbe4179b0c5f7261204d77fdf24a430d92d617119d6113060f9ec89f0d8aaf9e3548f72dd4540db6111ca9f1c6ee945a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3180-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3296-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2412-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/404-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/532-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4460-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3488-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2612-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3264-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1604-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3424-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2648-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1796-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4740-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4600-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2624-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4352-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2768-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4644-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2368-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3500-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1608-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/836-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/208-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4736-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1260-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3436-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2960-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3596-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2752-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1572-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3332-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2104-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-606-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2668-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1648-725-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3816-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1516-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-895-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3296 xrxrrrr.exe 2412 jdpdj.exe 404 3lrlffx.exe 532 ntbttb.exe 4460 tbnhbb.exe 3184 jdpdj.exe 3488 lrxrlxr.exe 1972 5jpjj.exe 2612 jdjjp.exe 3264 lfrrrxx.exe 1604 bnhbnb.exe 3424 jjpjd.exe 1884 9bhhbb.exe 3060 tthnnh.exe 3116 dvppj.exe 4668 fxxrllf.exe 5024 5djjj.exe 5008 xllxrxx.exe 2104 7jjpv.exe 1260 dpvpj.exe 2648 9jjjj.exe 4080 ppppj.exe 4336 7vjdv.exe 1796 9nnnhh.exe 4900 ppppp.exe 724 1htttb.exe 2720 lxllrxx.exe 2100 jvvvv.exe 4740 hhttbh.exe 760 lfffffl.exe 4600 llrrxxl.exe 2624 jdpjv.exe 1080 frxrlll.exe 1688 hbnnnt.exe 4352 vvpvv.exe 3980 9frlllf.exe 2228 tbhttt.exe 2768 nbhnnt.exe 4644 jvjpv.exe 4468 rlrxrfx.exe 2368 rfxxlll.exe 2972 ttbttb.exe 3352 vdppj.exe 3500 frxrrxf.exe 1864 nnttht.exe 2328 jdjjj.exe 5092 rflllrx.exe 2112 rllxrxr.exe 4376 thhhhh.exe 1608 ppddj.exe 2708 3vdvv.exe 1180 xxllrrf.exe 836 hnthhn.exe 4556 ddvpj.exe 1980 flfxrrr.exe 1120 htbtth.exe 208 pjjjp.exe 212 xrxxfll.exe 2172 fxffxfr.exe 1448 3bbtnn.exe 1784 jvpdd.exe 4924 rxffflr.exe 220 lxxxxxx.exe 1680 nhnnnn.exe -
resource yara_rule behavioral2/memory/3180-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3296-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2412-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/404-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/532-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4460-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3488-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2612-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3264-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1604-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3424-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2648-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4080-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1796-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4740-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2624-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2768-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4644-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2368-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3500-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1608-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/836-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/208-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4736-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1260-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3436-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2960-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3596-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2752-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1200-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1572-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4104-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3332-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2104-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1672-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1648-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2668-655-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3296 3180 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 83 PID 3180 wrote to memory of 3296 3180 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 83 PID 3180 wrote to memory of 3296 3180 ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe 83 PID 3296 wrote to memory of 2412 3296 xrxrrrr.exe 84 PID 3296 wrote to memory of 2412 3296 xrxrrrr.exe 84 PID 3296 wrote to memory of 2412 3296 xrxrrrr.exe 84 PID 2412 wrote to memory of 404 2412 jdpdj.exe 85 PID 2412 wrote to memory of 404 2412 jdpdj.exe 85 PID 2412 wrote to memory of 404 2412 jdpdj.exe 85 PID 404 wrote to memory of 532 404 3lrlffx.exe 86 PID 404 wrote to memory of 532 404 3lrlffx.exe 86 PID 404 wrote to memory of 532 404 3lrlffx.exe 86 PID 532 wrote to memory of 4460 532 ntbttb.exe 87 PID 532 wrote to memory of 4460 532 ntbttb.exe 87 PID 532 wrote to memory of 4460 532 ntbttb.exe 87 PID 4460 wrote to memory of 3184 4460 tbnhbb.exe 88 PID 4460 wrote to memory of 3184 4460 tbnhbb.exe 88 PID 4460 wrote to memory of 3184 4460 tbnhbb.exe 88 PID 3184 wrote to memory of 3488 3184 jdpdj.exe 89 PID 3184 wrote to memory of 3488 3184 jdpdj.exe 89 PID 3184 wrote to memory of 3488 3184 jdpdj.exe 89 PID 3488 wrote to memory of 1972 3488 lrxrlxr.exe 90 PID 3488 wrote to memory of 1972 3488 lrxrlxr.exe 90 PID 3488 wrote to memory of 1972 3488 lrxrlxr.exe 90 PID 1972 wrote to memory of 2612 1972 5jpjj.exe 91 PID 1972 wrote to memory of 2612 1972 5jpjj.exe 91 PID 1972 wrote to memory of 2612 1972 5jpjj.exe 91 PID 2612 wrote to memory of 3264 2612 jdjjp.exe 92 PID 2612 wrote to memory of 3264 2612 jdjjp.exe 92 PID 2612 wrote to memory of 3264 2612 jdjjp.exe 92 PID 3264 wrote to memory of 1604 3264 lfrrrxx.exe 93 PID 3264 wrote to memory of 1604 3264 lfrrrxx.exe 93 PID 3264 wrote to memory of 1604 3264 lfrrrxx.exe 93 PID 1604 wrote to memory of 3424 1604 bnhbnb.exe 94 PID 1604 wrote to memory of 3424 1604 bnhbnb.exe 94 PID 1604 wrote to memory of 3424 1604 bnhbnb.exe 94 PID 3424 wrote to memory of 1884 3424 jjpjd.exe 95 PID 3424 wrote to memory of 1884 3424 jjpjd.exe 95 PID 3424 wrote to memory of 1884 3424 jjpjd.exe 95 PID 1884 wrote to memory of 3060 1884 9bhhbb.exe 96 PID 1884 wrote to memory of 3060 1884 9bhhbb.exe 96 PID 1884 wrote to memory of 3060 1884 9bhhbb.exe 96 PID 3060 wrote to memory of 3116 3060 tthnnh.exe 97 PID 3060 wrote to memory of 3116 3060 tthnnh.exe 97 PID 3060 wrote to memory of 3116 3060 tthnnh.exe 97 PID 3116 wrote to memory of 4668 3116 dvppj.exe 98 PID 3116 wrote to memory of 4668 3116 dvppj.exe 98 PID 3116 wrote to memory of 4668 3116 dvppj.exe 98 PID 4668 wrote to memory of 5024 4668 fxxrllf.exe 99 PID 4668 wrote to memory of 5024 4668 fxxrllf.exe 99 PID 4668 wrote to memory of 5024 4668 fxxrllf.exe 99 PID 5024 wrote to memory of 5008 5024 5djjj.exe 100 PID 5024 wrote to memory of 5008 5024 5djjj.exe 100 PID 5024 wrote to memory of 5008 5024 5djjj.exe 100 PID 5008 wrote to memory of 2104 5008 xllxrxx.exe 101 PID 5008 wrote to memory of 2104 5008 xllxrxx.exe 101 PID 5008 wrote to memory of 2104 5008 xllxrxx.exe 101 PID 2104 wrote to memory of 1260 2104 7jjpv.exe 102 PID 2104 wrote to memory of 1260 2104 7jjpv.exe 102 PID 2104 wrote to memory of 1260 2104 7jjpv.exe 102 PID 1260 wrote to memory of 2648 1260 dpvpj.exe 103 PID 1260 wrote to memory of 2648 1260 dpvpj.exe 103 PID 1260 wrote to memory of 2648 1260 dpvpj.exe 103 PID 2648 wrote to memory of 4080 2648 9jjjj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"C:\Users\Admin\AppData\Local\Temp\ae592a168b5ea08cebf3bb5a17eaaa89369eb300fa4a849a7efb8f7e65a03678.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\jdpdj.exec:\jdpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\3lrlffx.exec:\3lrlffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\ntbttb.exec:\ntbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\tbnhbb.exec:\tbnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\jdpdj.exec:\jdpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\lrxrlxr.exec:\lrxrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\5jpjj.exec:\5jpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\jdjjp.exec:\jdjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\bnhbnb.exec:\bnhbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\jjpjd.exec:\jjpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\9bhhbb.exec:\9bhhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tthnnh.exec:\tthnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dvppj.exec:\dvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\fxxrllf.exec:\fxxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\5djjj.exec:\5djjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\xllxrxx.exec:\xllxrxx.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\7jjpv.exec:\7jjpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\dpvpj.exec:\dpvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\9jjjj.exec:\9jjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ppppj.exec:\ppppj.exe23⤵
- Executes dropped EXE
PID:4080 -
\??\c:\7vjdv.exec:\7vjdv.exe24⤵
- Executes dropped EXE
PID:4336 -
\??\c:\9nnnhh.exec:\9nnnhh.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ppppp.exec:\ppppp.exe26⤵
- Executes dropped EXE
PID:4900 -
\??\c:\1htttb.exec:\1htttb.exe27⤵
- Executes dropped EXE
PID:724 -
\??\c:\lxllrxx.exec:\lxllrxx.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\jvvvv.exec:\jvvvv.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hhttbh.exec:\hhttbh.exe30⤵
- Executes dropped EXE
PID:4740 -
\??\c:\lfffffl.exec:\lfffffl.exe31⤵
- Executes dropped EXE
PID:760 -
\??\c:\llrrxxl.exec:\llrrxxl.exe32⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jdpjv.exec:\jdpjv.exe33⤵
- Executes dropped EXE
PID:2624 -
\??\c:\frxrlll.exec:\frxrlll.exe34⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hbnnnt.exec:\hbnnnt.exe35⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vvpvv.exec:\vvpvv.exe36⤵
- Executes dropped EXE
PID:4352 -
\??\c:\9frlllf.exec:\9frlllf.exe37⤵
- Executes dropped EXE
PID:3980 -
\??\c:\tbhttt.exec:\tbhttt.exe38⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nbhnnt.exec:\nbhnnt.exe39⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvjpv.exec:\jvjpv.exe40⤵
- Executes dropped EXE
PID:4644 -
\??\c:\rlrxrfx.exec:\rlrxrfx.exe41⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rfxxlll.exec:\rfxxlll.exe42⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ttbttb.exec:\ttbttb.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\vdppj.exec:\vdppj.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3352 -
\??\c:\frxrrxf.exec:\frxrrxf.exe45⤵
- Executes dropped EXE
PID:3500 -
\??\c:\nnttht.exec:\nnttht.exe46⤵
- Executes dropped EXE
PID:1864 -
\??\c:\jdjjj.exec:\jdjjj.exe47⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rflllrx.exec:\rflllrx.exe48⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rllxrxr.exec:\rllxrxr.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\thhhhh.exec:\thhhhh.exe50⤵
- Executes dropped EXE
PID:4376 -
\??\c:\ppddj.exec:\ppddj.exe51⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3vdvv.exec:\3vdvv.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xxllrrf.exec:\xxllrrf.exe53⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hnthhn.exec:\hnthhn.exe54⤵
- Executes dropped EXE
PID:836 -
\??\c:\ddvpj.exec:\ddvpj.exe55⤵
- Executes dropped EXE
PID:4556 -
\??\c:\flfxrrr.exec:\flfxrrr.exe56⤵
- Executes dropped EXE
PID:1980 -
\??\c:\htbtth.exec:\htbtth.exe57⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pjjjp.exec:\pjjjp.exe58⤵
- Executes dropped EXE
PID:208 -
\??\c:\xrxxfll.exec:\xrxxfll.exe59⤵
- Executes dropped EXE
PID:212 -
\??\c:\fxffxfr.exec:\fxffxfr.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3bbtnn.exec:\3bbtnn.exe61⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jvpdd.exec:\jvpdd.exe62⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rxffflr.exec:\rxffflr.exe63⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe64⤵
- Executes dropped EXE
PID:220 -
\??\c:\nhnnnn.exec:\nhnnnn.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjvvj.exec:\pjvvj.exe66⤵PID:4780
-
\??\c:\rlxfxlx.exec:\rlxfxlx.exe67⤵PID:4544
-
\??\c:\tntnhh.exec:\tntnhh.exe68⤵PID:4164
-
\??\c:\ppjjp.exec:\ppjjp.exe69⤵PID:4736
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe70⤵PID:3116
-
\??\c:\ppdpp.exec:\ppdpp.exe71⤵PID:2540
-
\??\c:\jvdvp.exec:\jvdvp.exe72⤵PID:4764
-
\??\c:\rrrrfxl.exec:\rrrrfxl.exe73⤵PID:5008
-
\??\c:\9tbtbb.exec:\9tbtbb.exe74⤵PID:3640
-
\??\c:\pddjj.exec:\pddjj.exe75⤵PID:3572
-
\??\c:\1xrxrlx.exec:\1xrxrlx.exe76⤵PID:4628
-
\??\c:\tnhnbb.exec:\tnhnbb.exe77⤵PID:1260
-
\??\c:\pdjjj.exec:\pdjjj.exe78⤵PID:4308
-
\??\c:\fxxxffl.exec:\fxxxffl.exe79⤵PID:3012
-
\??\c:\9xxrrff.exec:\9xxrrff.exe80⤵PID:8
-
\??\c:\nbtnhb.exec:\nbtnhb.exe81⤵PID:392
-
\??\c:\9jvpp.exec:\9jvpp.exe82⤵PID:1456
-
\??\c:\lfxxffx.exec:\lfxxffx.exe83⤵PID:4488
-
\??\c:\hntttt.exec:\hntttt.exe84⤵PID:4500
-
\??\c:\3bhbbb.exec:\3bhbbb.exe85⤵PID:4004
-
\??\c:\jvdvd.exec:\jvdvd.exe86⤵PID:1396
-
\??\c:\xxfrlll.exec:\xxfrlll.exe87⤵PID:2720
-
\??\c:\btbbtn.exec:\btbbtn.exe88⤵PID:1664
-
\??\c:\vpjvp.exec:\vpjvp.exe89⤵PID:2084
-
\??\c:\pdddv.exec:\pdddv.exe90⤵PID:5100
-
\??\c:\fxffrxx.exec:\fxffrxx.exe91⤵PID:4320
-
\??\c:\bbnnhh.exec:\bbnnhh.exe92⤵PID:4888
-
\??\c:\tthhtt.exec:\tthhtt.exe93⤵PID:4960
-
\??\c:\dvdpd.exec:\dvdpd.exe94⤵PID:3436
-
\??\c:\ffxrffr.exec:\ffxrffr.exe95⤵PID:4968
-
\??\c:\bnhbbb.exec:\bnhbbb.exe96⤵PID:1688
-
\??\c:\vppjd.exec:\vppjd.exe97⤵PID:464
-
\??\c:\vjppp.exec:\vjppp.exe98⤵PID:2960
-
\??\c:\xlrlrxr.exec:\xlrlrxr.exe99⤵PID:3596
-
\??\c:\7nhhbh.exec:\7nhhbh.exe100⤵PID:2752
-
\??\c:\7vvvp.exec:\7vvvp.exe101⤵PID:4644
-
\??\c:\3rxrllx.exec:\3rxrllx.exe102⤵PID:1788
-
\??\c:\fxrrrxr.exec:\fxrrrxr.exe103⤵PID:1168
-
\??\c:\nhthhh.exec:\nhthhh.exe104⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\ddpjv.exec:\ddpjv.exe105⤵PID:5096
-
\??\c:\9rrlffx.exec:\9rrlffx.exe106⤵PID:3304
-
\??\c:\hhtbnt.exec:\hhtbnt.exe107⤵PID:4312
-
\??\c:\nbnhhh.exec:\nbnhhh.exe108⤵PID:3212
-
\??\c:\pddvd.exec:\pddvd.exe109⤵PID:2596
-
\??\c:\rfrlflf.exec:\rfrlflf.exe110⤵PID:4388
-
\??\c:\lffflff.exec:\lffflff.exe111⤵PID:1200
-
\??\c:\tnnbtt.exec:\tnnbtt.exe112⤵PID:1572
-
\??\c:\rlfxfxr.exec:\rlfxfxr.exe113⤵
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe114⤵PID:660
-
\??\c:\dpjvj.exec:\dpjvj.exe115⤵PID:408
-
\??\c:\jpvpj.exec:\jpvpj.exe116⤵PID:1384
-
\??\c:\tbbtnn.exec:\tbbtnn.exe117⤵PID:1904
-
\??\c:\btbttn.exec:\btbttn.exe118⤵PID:1460
-
\??\c:\vvdpj.exec:\vvdpj.exe119⤵PID:1728
-
\??\c:\rrxxffl.exec:\rrxxffl.exe120⤵PID:1924
-
\??\c:\tbnnht.exec:\tbnnht.exe121⤵PID:3972
-
\??\c:\jvdvv.exec:\jvdvv.exe122⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-