Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:50
Behavioral task
behavioral1
Sample
38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe
Resource
win7-20240903-en
General
-
Target
38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe
-
Size
333KB
-
MD5
7463d03cadf9eea782f073cf012ded7a
-
SHA1
7bf02e441a967185ecf7fe2da1da87093c29b8d6
-
SHA256
38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d
-
SHA512
8f313bee8aa0ac5d2ffe8e8b96d4da54433d9892c5cff8af7500d0a5e635a569c70be0e2ec81f049d61d6c611fc951caaff3c7d956a9ea40f74732558ec53fcf
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbem:R4wFHoSHYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3712-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1476-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4488-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3632-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2704-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1448-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4800-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/692-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-840-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-949-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1132 ntbtbh.exe 1948 lxlfxxx.exe 4708 tnnhbn.exe 3540 htbbtt.exe 3400 fflfxxr.exe 4720 nntthh.exe 1524 pjjdd.exe 5024 nnbbbb.exe 3868 fxxfxrx.exe 1800 hhhbnn.exe 1428 dpjjp.exe 4064 5rfxrrl.exe 3348 jdddv.exe 980 tttnbb.exe 4388 vpdpj.exe 2592 jvddj.exe 1188 hhbttt.exe 3228 9lfrrrr.exe 3696 dpdvp.exe 1476 pjvpd.exe 3924 rlrlffx.exe 4476 bthbhh.exe 5044 bttnbb.exe 4656 ppvpd.exe 1396 rlxxrlx.exe 4940 nhhttt.exe 4908 hbnhbt.exe 3408 vpjpj.exe 2184 pjjdv.exe 4488 5ffxffx.exe 1820 xfrlfxl.exe 2276 nbhbbt.exe 4652 tnbhbn.exe 3632 vpdvv.exe 3664 fxllfxf.exe 3532 hnnnnn.exe 3688 jjvpj.exe 1736 vdpjd.exe 432 9frrrff.exe 1680 hbttnn.exe 4016 nhtnhn.exe 4928 jdjdd.exe 3152 rrxxxxr.exe 3620 hhnhbh.exe 4060 hbnnbt.exe 3496 jpppp.exe 4732 lrxrlll.exe 4372 bbbnnb.exe 4356 ddjvj.exe 2520 fllfrrl.exe 1512 bhbhhb.exe 4580 pdpvv.exe 1632 pjjvp.exe 920 lfllrrl.exe 916 nbtntt.exe 5096 hbnhnt.exe 3184 pdvdd.exe 1912 vvvvd.exe 2704 3xlfrff.exe 2860 rfxxxxx.exe 3436 hhtnht.exe 3276 dvdvp.exe 1692 jddvj.exe 3064 frlfxxr.exe -
resource yara_rule behavioral2/memory/3712-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023b4e-3.dat upx behavioral2/memory/3712-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c46-8.dat upx behavioral2/memory/1948-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c47-11.dat upx behavioral2/memory/4708-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1132-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c48-19.dat upx behavioral2/memory/4708-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c49-24.dat upx behavioral2/memory/3540-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c4a-29.dat upx behavioral2/memory/3400-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c4b-34.dat upx behavioral2/memory/1524-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4720-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c4c-40.dat upx behavioral2/memory/1524-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c4d-45.dat upx behavioral2/memory/5024-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3868-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c4e-50.dat upx behavioral2/files/0x0007000000023c4f-56.dat upx behavioral2/memory/1800-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c50-60.dat upx behavioral2/memory/1428-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c51-65.dat upx behavioral2/memory/4064-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023c40-70.dat upx behavioral2/memory/3348-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c52-77.dat upx behavioral2/files/0x0007000000023c53-81.dat upx behavioral2/memory/980-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000300000001e4ba-84.dat upx behavioral2/memory/2592-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c54-90.dat upx behavioral2/memory/1188-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3696-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c56-100.dat upx behavioral2/memory/3228-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c57-105.dat upx behavioral2/memory/4476-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5044-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5a-120.dat upx behavioral2/memory/1396-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c5c-131.dat upx behavioral2/files/0x0007000000023c5e-138.dat upx behavioral2/files/0x0007000000023c5f-142.dat upx behavioral2/files/0x0007000000023c5d-135.dat upx behavioral2/files/0x0007000000023c5b-126.dat upx behavioral2/memory/4656-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c59-116.dat upx behavioral2/files/0x0007000000023c58-111.dat upx behavioral2/memory/3924-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1476-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023c55-95.dat upx behavioral2/files/0x0007000000023c60-146.dat upx behavioral2/memory/4488-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023c63-155.dat upx behavioral2/files/0x0009000000023c61-152.dat upx behavioral2/memory/3632-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3688-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1736-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3712 wrote to memory of 1132 3712 38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe 84 PID 3712 wrote to memory of 1132 3712 38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe 84 PID 3712 wrote to memory of 1132 3712 38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe 84 PID 1132 wrote to memory of 1948 1132 ntbtbh.exe 85 PID 1132 wrote to memory of 1948 1132 ntbtbh.exe 85 PID 1132 wrote to memory of 1948 1132 ntbtbh.exe 85 PID 1948 wrote to memory of 4708 1948 lxlfxxx.exe 86 PID 1948 wrote to memory of 4708 1948 lxlfxxx.exe 86 PID 1948 wrote to memory of 4708 1948 lxlfxxx.exe 86 PID 4708 wrote to memory of 3540 4708 tnnhbn.exe 89 PID 4708 wrote to memory of 3540 4708 tnnhbn.exe 89 PID 4708 wrote to memory of 3540 4708 tnnhbn.exe 89 PID 3540 wrote to memory of 3400 3540 htbbtt.exe 90 PID 3540 wrote to memory of 3400 3540 htbbtt.exe 90 PID 3540 wrote to memory of 3400 3540 htbbtt.exe 90 PID 3400 wrote to memory of 4720 3400 fflfxxr.exe 91 PID 3400 wrote to memory of 4720 3400 fflfxxr.exe 91 PID 3400 wrote to memory of 4720 3400 fflfxxr.exe 91 PID 4720 wrote to memory of 1524 4720 nntthh.exe 92 PID 4720 wrote to memory of 1524 4720 nntthh.exe 92 PID 4720 wrote to memory of 1524 4720 nntthh.exe 92 PID 1524 wrote to memory of 5024 1524 pjjdd.exe 93 PID 1524 wrote to memory of 5024 1524 pjjdd.exe 93 PID 1524 wrote to memory of 5024 1524 pjjdd.exe 93 PID 5024 wrote to memory of 3868 5024 nnbbbb.exe 94 PID 5024 wrote to memory of 3868 5024 nnbbbb.exe 94 PID 5024 wrote to memory of 3868 5024 nnbbbb.exe 94 PID 3868 wrote to memory of 1800 3868 fxxfxrx.exe 95 PID 3868 wrote to memory of 1800 3868 fxxfxrx.exe 95 PID 3868 wrote to memory of 1800 3868 fxxfxrx.exe 95 PID 1800 wrote to memory of 1428 1800 hhhbnn.exe 96 PID 1800 wrote to memory of 1428 1800 hhhbnn.exe 96 PID 1800 wrote to memory of 1428 1800 hhhbnn.exe 96 PID 1428 wrote to memory of 4064 1428 dpjjp.exe 97 PID 1428 wrote to memory of 4064 1428 dpjjp.exe 97 PID 1428 wrote to memory of 4064 1428 dpjjp.exe 97 PID 4064 wrote to memory of 3348 4064 5rfxrrl.exe 98 PID 4064 wrote to memory of 3348 4064 5rfxrrl.exe 98 PID 4064 wrote to memory of 3348 4064 5rfxrrl.exe 98 PID 3348 wrote to memory of 980 3348 jdddv.exe 99 PID 3348 wrote to memory of 980 3348 jdddv.exe 99 PID 3348 wrote to memory of 980 3348 jdddv.exe 99 PID 980 wrote to memory of 4388 980 tttnbb.exe 100 PID 980 wrote to memory of 4388 980 tttnbb.exe 100 PID 980 wrote to memory of 4388 980 tttnbb.exe 100 PID 4388 wrote to memory of 2592 4388 vpdpj.exe 101 PID 4388 wrote to memory of 2592 4388 vpdpj.exe 101 PID 4388 wrote to memory of 2592 4388 vpdpj.exe 101 PID 2592 wrote to memory of 1188 2592 jvddj.exe 102 PID 2592 wrote to memory of 1188 2592 jvddj.exe 102 PID 2592 wrote to memory of 1188 2592 jvddj.exe 102 PID 1188 wrote to memory of 3228 1188 hhbttt.exe 103 PID 1188 wrote to memory of 3228 1188 hhbttt.exe 103 PID 1188 wrote to memory of 3228 1188 hhbttt.exe 103 PID 3228 wrote to memory of 3696 3228 9lfrrrr.exe 104 PID 3228 wrote to memory of 3696 3228 9lfrrrr.exe 104 PID 3228 wrote to memory of 3696 3228 9lfrrrr.exe 104 PID 3696 wrote to memory of 1476 3696 dpdvp.exe 105 PID 3696 wrote to memory of 1476 3696 dpdvp.exe 105 PID 3696 wrote to memory of 1476 3696 dpdvp.exe 105 PID 1476 wrote to memory of 3924 1476 pjvpd.exe 106 PID 1476 wrote to memory of 3924 1476 pjvpd.exe 106 PID 1476 wrote to memory of 3924 1476 pjvpd.exe 106 PID 3924 wrote to memory of 4476 3924 rlrlffx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe"C:\Users\Admin\AppData\Local\Temp\38e3386e6d8470980cd0d3db13c98f7f1c8dba785f95d9bd856f72131949d83d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\ntbtbh.exec:\ntbtbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\tnnhbn.exec:\tnnhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\htbbtt.exec:\htbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\fflfxxr.exec:\fflfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\nntthh.exec:\nntthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\pjjdd.exec:\pjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\nnbbbb.exec:\nnbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\fxxfxrx.exec:\fxxfxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\hhhbnn.exec:\hhhbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dpjjp.exec:\dpjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\jdddv.exec:\jdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\tttnbb.exec:\tttnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\vpdpj.exec:\vpdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\jvddj.exec:\jvddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\hhbttt.exec:\hhbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\9lfrrrr.exec:\9lfrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\dpdvp.exec:\dpdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\pjvpd.exec:\pjvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\rlrlffx.exec:\rlrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\bthbhh.exec:\bthbhh.exe23⤵
- Executes dropped EXE
PID:4476 -
\??\c:\bttnbb.exec:\bttnbb.exe24⤵
- Executes dropped EXE
PID:5044 -
\??\c:\ppvpd.exec:\ppvpd.exe25⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rlxxrlx.exec:\rlxxrlx.exe26⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nhhttt.exec:\nhhttt.exe27⤵
- Executes dropped EXE
PID:4940 -
\??\c:\hbnhbt.exec:\hbnhbt.exe28⤵
- Executes dropped EXE
PID:4908 -
\??\c:\vpjpj.exec:\vpjpj.exe29⤵
- Executes dropped EXE
PID:3408 -
\??\c:\pjjdv.exec:\pjjdv.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5ffxffx.exec:\5ffxffx.exe31⤵
- Executes dropped EXE
PID:4488 -
\??\c:\xfrlfxl.exec:\xfrlfxl.exe32⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nbhbbt.exec:\nbhbbt.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tnbhbn.exec:\tnbhbn.exe34⤵
- Executes dropped EXE
PID:4652 -
\??\c:\vpdvv.exec:\vpdvv.exe35⤵
- Executes dropped EXE
PID:3632 -
\??\c:\fxllfxf.exec:\fxllfxf.exe36⤵
- Executes dropped EXE
PID:3664 -
\??\c:\hnnnnn.exec:\hnnnnn.exe37⤵
- Executes dropped EXE
PID:3532 -
\??\c:\jjvpj.exec:\jjvpj.exe38⤵
- Executes dropped EXE
PID:3688 -
\??\c:\vdpjd.exec:\vdpjd.exe39⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9frrrff.exec:\9frrrff.exe40⤵
- Executes dropped EXE
PID:432 -
\??\c:\hbttnn.exec:\hbttnn.exe41⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhtnhn.exec:\nhtnhn.exe42⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jdjdd.exec:\jdjdd.exe43⤵
- Executes dropped EXE
PID:4928 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe44⤵
- Executes dropped EXE
PID:3152 -
\??\c:\hhnhbh.exec:\hhnhbh.exe45⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hbnnbt.exec:\hbnnbt.exe46⤵
- Executes dropped EXE
PID:4060 -
\??\c:\jpppp.exec:\jpppp.exe47⤵
- Executes dropped EXE
PID:3496 -
\??\c:\lrxrlll.exec:\lrxrlll.exe48⤵
- Executes dropped EXE
PID:4732 -
\??\c:\bbbnnb.exec:\bbbnnb.exe49⤵
- Executes dropped EXE
PID:4372 -
\??\c:\ddjvj.exec:\ddjvj.exe50⤵
- Executes dropped EXE
PID:4356 -
\??\c:\fllfrrl.exec:\fllfrrl.exe51⤵
- Executes dropped EXE
PID:2520 -
\??\c:\bhbhhb.exec:\bhbhhb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\pdpvv.exec:\pdpvv.exe53⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pjjvp.exec:\pjjvp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1632 -
\??\c:\lfllrrl.exec:\lfllrrl.exe55⤵
- Executes dropped EXE
PID:920 -
\??\c:\nbtntt.exec:\nbtntt.exe56⤵
- Executes dropped EXE
PID:916 -
\??\c:\hbnhnt.exec:\hbnhnt.exe57⤵
- Executes dropped EXE
PID:5096 -
\??\c:\pdvdd.exec:\pdvdd.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\vvvvd.exec:\vvvvd.exe59⤵
- Executes dropped EXE
PID:1912 -
\??\c:\3xlfrff.exec:\3xlfrff.exe60⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfxxxxx.exec:\rfxxxxx.exe61⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hhtnht.exec:\hhtnht.exe62⤵
- Executes dropped EXE
PID:3436 -
\??\c:\dvdvp.exec:\dvdvp.exe63⤵
- Executes dropped EXE
PID:3276 -
\??\c:\jddvj.exec:\jddvj.exe64⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frlfxxr.exec:\frlfxxr.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nhhhhh.exec:\nhhhhh.exe66⤵PID:3868
-
\??\c:\bhttnn.exec:\bhttnn.exe67⤵PID:664
-
\??\c:\vpvvd.exec:\vpvvd.exe68⤵PID:3692
-
\??\c:\lfrffll.exec:\lfrffll.exe69⤵PID:4056
-
\??\c:\fxxrllf.exec:\fxxrllf.exe70⤵PID:4620
-
\??\c:\nhbttb.exec:\nhbttb.exe71⤵PID:5108
-
\??\c:\thbbbt.exec:\thbbbt.exe72⤵PID:4388
-
\??\c:\pvvvv.exec:\pvvvv.exe73⤵PID:1448
-
\??\c:\rrllfff.exec:\rrllfff.exe74⤵PID:2784
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe75⤵PID:4404
-
\??\c:\thnhbb.exec:\thnhbb.exe76⤵
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\vvjjj.exec:\vvjjj.exe77⤵PID:5056
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe78⤵PID:4784
-
\??\c:\5lxxfff.exec:\5lxxfff.exe79⤵PID:3728
-
\??\c:\hhnnhh.exec:\hhnnhh.exe80⤵PID:3208
-
\??\c:\vjpjd.exec:\vjpjd.exe81⤵PID:3820
-
\??\c:\pjppp.exec:\pjppp.exe82⤵PID:1072
-
\??\c:\lfllfff.exec:\lfllfff.exe83⤵PID:3196
-
\??\c:\llxrrrl.exec:\llxrrrl.exe84⤵PID:2640
-
\??\c:\hbhhnn.exec:\hbhhnn.exe85⤵PID:1312
-
\??\c:\pvvvv.exec:\pvvvv.exe86⤵PID:4800
-
\??\c:\jpjpj.exec:\jpjpj.exe87⤵PID:4920
-
\??\c:\frxrfxx.exec:\frxrfxx.exe88⤵PID:4584
-
\??\c:\hbbbbb.exec:\hbbbbb.exe89⤵PID:1180
-
\??\c:\frxrlll.exec:\frxrlll.exe90⤵PID:1320
-
\??\c:\9bnhbb.exec:\9bnhbb.exe91⤵PID:4972
-
\??\c:\3dddv.exec:\3dddv.exe92⤵PID:1120
-
\??\c:\flfrxfl.exec:\flfrxfl.exe93⤵PID:2560
-
\??\c:\tbhnnb.exec:\tbhnnb.exe94⤵PID:4844
-
\??\c:\dddvj.exec:\dddvj.exe95⤵PID:2276
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:692
-
\??\c:\flfflrr.exec:\flfflrr.exe97⤵PID:3480
-
\??\c:\hnthbb.exec:\hnthbb.exe98⤵PID:1592
-
\??\c:\tnnhhb.exec:\tnnhhb.exe99⤵PID:3140
-
\??\c:\9ppjj.exec:\9ppjj.exe100⤵
- System Location Discovery: System Language Discovery
PID:752 -
\??\c:\vvvvv.exec:\vvvvv.exe101⤵PID:2912
-
\??\c:\xlrxrxr.exec:\xlrxrxr.exe102⤵PID:432
-
\??\c:\tnbnnn.exec:\tnbnnn.exe103⤵PID:1680
-
\??\c:\nnbbtt.exec:\nnbbtt.exe104⤵PID:2428
-
\??\c:\vjpjd.exec:\vjpjd.exe105⤵PID:2400
-
\??\c:\vjjdd.exec:\vjjdd.exe106⤵PID:4520
-
\??\c:\7fffffx.exec:\7fffffx.exe107⤵PID:3076
-
\??\c:\thtnnn.exec:\thtnnn.exe108⤵PID:4060
-
\??\c:\jpdvp.exec:\jpdvp.exe109⤵PID:3496
-
\??\c:\pjdpd.exec:\pjdpd.exe110⤵PID:4732
-
\??\c:\1xfxrfx.exec:\1xfxrfx.exe111⤵PID:4372
-
\??\c:\flxxlrr.exec:\flxxlrr.exe112⤵PID:4356
-
\??\c:\nbhhhh.exec:\nbhhhh.exe113⤵PID:2520
-
\??\c:\3ppjd.exec:\3ppjd.exe114⤵PID:1512
-
\??\c:\dppjj.exec:\dppjj.exe115⤵PID:2432
-
\??\c:\rxrrrxx.exec:\rxrrrxx.exe116⤵PID:848
-
\??\c:\lllfxrl.exec:\lllfxrl.exe117⤵PID:4704
-
\??\c:\hhtnnn.exec:\hhtnnn.exe118⤵PID:1644
-
\??\c:\1vvpj.exec:\1vvpj.exe119⤵PID:4444
-
\??\c:\lrfrlll.exec:\lrfrlll.exe120⤵PID:1912
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe121⤵PID:2396
-
\??\c:\hbntnt.exec:\hbntnt.exe122⤵PID:4900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-