Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe
Resource
win7-20240903-en
General
-
Target
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe
-
Size
455KB
-
MD5
118da336b0a5021d33536d287ff7e018
-
SHA1
2028603cd133533c33645dbb104279451f2bf746
-
SHA256
120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb
-
SHA512
88c3d08d2ed1de4f928da28d1c7b837ff9793561051f76057d982208ced836cb4e1cb34e3185f05744ea2b5b6aa9be04cf60c29fb0cce3aff61a176cb1265c20
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJKPI:q7Tc2NYHUrAwfMp3CDJKPI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3356-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3916-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4836-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3780-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2452-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3524-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3828-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1468-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1496-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2548-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4224-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1792-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5036-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1064-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4376-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1824-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1324-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/872-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2988-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4664-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3932-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4884-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1536-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3444-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3856-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2844-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2832-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4956-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4440-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3636-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3588-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1684-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3908-755-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2216-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3680-968-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4124-1048-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4328-1073-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-1667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2808 frfrfxl.exe 3916 9hbthh.exe 4836 dvdjv.exe 3908 jjpdp.exe 3904 ffrrrrl.exe 3944 ppvpj.exe 4448 pdjdd.exe 1684 bhtntn.exe 2192 ddvpp.exe 4516 1ntbhn.exe 3780 fxrxxff.exe 1676 3hhntb.exe 2452 3vddj.exe 2212 9llfxfx.exe 4468 ttbbbb.exe 3524 dvvvv.exe 3828 fxxxxxx.exe 3004 ddvvv.exe 1468 xrffxff.exe 2372 bbtttb.exe 4932 jjddv.exe 4508 htnhhh.exe 1496 ffllfll.exe 2548 hnhhbb.exe 4224 xxxrrrl.exe 1100 httttb.exe 4492 xrrrrrl.exe 1792 tnnnhh.exe 2216 3vjjj.exe 5036 xlrlfrl.exe 2872 fflrrxx.exe 5108 rxfflrl.exe 544 ppjvp.exe 1064 5lxrlfx.exe 4248 nnhbnn.exe 1020 jpdvp.exe 4376 xxffrrl.exe 2832 ntnbtb.exe 4832 3vvpp.exe 4288 lxlfxxx.exe 1824 bnhbnn.exe 1324 ntnhhh.exe 4628 1pjdv.exe 4960 lfxrlfx.exe 4836 nnbnhb.exe 872 ddvjv.exe 3088 rllfffr.exe 2484 tnbtnt.exe 4652 1pjjj.exe 3928 jvvdj.exe 4888 rxfflfr.exe 420 nttnhn.exe 2988 pjjjd.exe 4872 jjjjp.exe 4664 xrllfll.exe 436 9ntttt.exe 964 pjppp.exe 4980 flxlfll.exe 4280 5lrllrr.exe 4108 nhhbht.exe 3012 ppppp.exe 4360 lllllll.exe 1596 lxxxxff.exe 548 7djvv.exe -
resource yara_rule behavioral2/memory/3356-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3916-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3904-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3780-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2452-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3524-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3828-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1468-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2548-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4224-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1792-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4376-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1824-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1324-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/872-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2988-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4664-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3932-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4884-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1536-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3444-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3856-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2844-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2832-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4956-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4440-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2868-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3636-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3588-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1684-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4468-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1500-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3908-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2216-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3680-968-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 2808 3356 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 83 PID 3356 wrote to memory of 2808 3356 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 83 PID 3356 wrote to memory of 2808 3356 120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe 83 PID 2808 wrote to memory of 3916 2808 frfrfxl.exe 84 PID 2808 wrote to memory of 3916 2808 frfrfxl.exe 84 PID 2808 wrote to memory of 3916 2808 frfrfxl.exe 84 PID 3916 wrote to memory of 4836 3916 9hbthh.exe 86 PID 3916 wrote to memory of 4836 3916 9hbthh.exe 86 PID 3916 wrote to memory of 4836 3916 9hbthh.exe 86 PID 4836 wrote to memory of 3908 4836 dvdjv.exe 89 PID 4836 wrote to memory of 3908 4836 dvdjv.exe 89 PID 4836 wrote to memory of 3908 4836 dvdjv.exe 89 PID 3908 wrote to memory of 3904 3908 jjpdp.exe 90 PID 3908 wrote to memory of 3904 3908 jjpdp.exe 90 PID 3908 wrote to memory of 3904 3908 jjpdp.exe 90 PID 3904 wrote to memory of 3944 3904 ffrrrrl.exe 91 PID 3904 wrote to memory of 3944 3904 ffrrrrl.exe 91 PID 3904 wrote to memory of 3944 3904 ffrrrrl.exe 91 PID 3944 wrote to memory of 4448 3944 ppvpj.exe 92 PID 3944 wrote to memory of 4448 3944 ppvpj.exe 92 PID 3944 wrote to memory of 4448 3944 ppvpj.exe 92 PID 4448 wrote to memory of 1684 4448 pdjdd.exe 93 PID 4448 wrote to memory of 1684 4448 pdjdd.exe 93 PID 4448 wrote to memory of 1684 4448 pdjdd.exe 93 PID 1684 wrote to memory of 2192 1684 bhtntn.exe 94 PID 1684 wrote to memory of 2192 1684 bhtntn.exe 94 PID 1684 wrote to memory of 2192 1684 bhtntn.exe 94 PID 2192 wrote to memory of 4516 2192 ddvpp.exe 95 PID 2192 wrote to memory of 4516 2192 ddvpp.exe 95 PID 2192 wrote to memory of 4516 2192 ddvpp.exe 95 PID 4516 wrote to memory of 3780 4516 1ntbhn.exe 96 PID 4516 wrote to memory of 3780 4516 1ntbhn.exe 96 PID 4516 wrote to memory of 3780 4516 1ntbhn.exe 96 PID 3780 wrote to memory of 1676 3780 fxrxxff.exe 97 PID 3780 wrote to memory of 1676 3780 fxrxxff.exe 97 PID 3780 wrote to memory of 1676 3780 fxrxxff.exe 97 PID 1676 wrote to memory of 2452 1676 3hhntb.exe 98 PID 1676 wrote to memory of 2452 1676 3hhntb.exe 98 PID 1676 wrote to memory of 2452 1676 3hhntb.exe 98 PID 2452 wrote to memory of 2212 2452 3vddj.exe 99 PID 2452 wrote to memory of 2212 2452 3vddj.exe 99 PID 2452 wrote to memory of 2212 2452 3vddj.exe 99 PID 2212 wrote to memory of 4468 2212 9llfxfx.exe 100 PID 2212 wrote to memory of 4468 2212 9llfxfx.exe 100 PID 2212 wrote to memory of 4468 2212 9llfxfx.exe 100 PID 4468 wrote to memory of 3524 4468 ttbbbb.exe 101 PID 4468 wrote to memory of 3524 4468 ttbbbb.exe 101 PID 4468 wrote to memory of 3524 4468 ttbbbb.exe 101 PID 3524 wrote to memory of 3828 3524 dvvvv.exe 102 PID 3524 wrote to memory of 3828 3524 dvvvv.exe 102 PID 3524 wrote to memory of 3828 3524 dvvvv.exe 102 PID 3828 wrote to memory of 3004 3828 fxxxxxx.exe 103 PID 3828 wrote to memory of 3004 3828 fxxxxxx.exe 103 PID 3828 wrote to memory of 3004 3828 fxxxxxx.exe 103 PID 3004 wrote to memory of 1468 3004 ddvvv.exe 104 PID 3004 wrote to memory of 1468 3004 ddvvv.exe 104 PID 3004 wrote to memory of 1468 3004 ddvvv.exe 104 PID 1468 wrote to memory of 2372 1468 xrffxff.exe 105 PID 1468 wrote to memory of 2372 1468 xrffxff.exe 105 PID 1468 wrote to memory of 2372 1468 xrffxff.exe 105 PID 2372 wrote to memory of 4932 2372 bbtttb.exe 106 PID 2372 wrote to memory of 4932 2372 bbtttb.exe 106 PID 2372 wrote to memory of 4932 2372 bbtttb.exe 106 PID 4932 wrote to memory of 4508 4932 jjddv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe"C:\Users\Admin\AppData\Local\Temp\120b1ccb5ed4bab613afb928fae44ccc917837561cccc39c6ec0f828c510d2cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\frfrfxl.exec:\frfrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9hbthh.exec:\9hbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\dvdjv.exec:\dvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jjpdp.exec:\jjpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\ppvpj.exec:\ppvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\pdjdd.exec:\pdjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\bhtntn.exec:\bhtntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\ddvpp.exec:\ddvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\1ntbhn.exec:\1ntbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\fxrxxff.exec:\fxrxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\3hhntb.exec:\3hhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3vddj.exec:\3vddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\9llfxfx.exec:\9llfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\ttbbbb.exec:\ttbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\dvvvv.exec:\dvvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\ddvvv.exec:\ddvvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xrffxff.exec:\xrffxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\bbtttb.exec:\bbtttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jjddv.exec:\jjddv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\htnhhh.exec:\htnhhh.exe23⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ffllfll.exec:\ffllfll.exe24⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hnhhbb.exec:\hnhhbb.exe25⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe26⤵
- Executes dropped EXE
PID:4224 -
\??\c:\httttb.exec:\httttb.exe27⤵
- Executes dropped EXE
PID:1100 -
\??\c:\xrrrrrl.exec:\xrrrrrl.exe28⤵
- Executes dropped EXE
PID:4492 -
\??\c:\tnnnhh.exec:\tnnnhh.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3vjjj.exec:\3vjjj.exe30⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xlrlfrl.exec:\xlrlfrl.exe31⤵
- Executes dropped EXE
PID:5036 -
\??\c:\fflrrxx.exec:\fflrrxx.exe32⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rxfflrl.exec:\rxfflrl.exe33⤵
- Executes dropped EXE
PID:5108 -
\??\c:\ppjvp.exec:\ppjvp.exe34⤵
- Executes dropped EXE
PID:544 -
\??\c:\5lxrlfx.exec:\5lxrlfx.exe35⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nnhbnn.exec:\nnhbnn.exe36⤵
- Executes dropped EXE
PID:4248 -
\??\c:\jpdvp.exec:\jpdvp.exe37⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xxffrrl.exec:\xxffrrl.exe38⤵
- Executes dropped EXE
PID:4376 -
\??\c:\ntnbtb.exec:\ntnbtb.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3vvpp.exec:\3vvpp.exe40⤵
- Executes dropped EXE
PID:4832 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe41⤵
- Executes dropped EXE
PID:4288 -
\??\c:\bnhbnn.exec:\bnhbnn.exe42⤵
- Executes dropped EXE
PID:1824 -
\??\c:\ntnhhh.exec:\ntnhhh.exe43⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1pjdv.exec:\1pjdv.exe44⤵
- Executes dropped EXE
PID:4628 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe45⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nnbnhb.exec:\nnbnhb.exe46⤵
- Executes dropped EXE
PID:4836 -
\??\c:\ddvjv.exec:\ddvjv.exe47⤵
- Executes dropped EXE
PID:872 -
\??\c:\rllfffr.exec:\rllfffr.exe48⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnbtnt.exec:\tnbtnt.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1pjjj.exec:\1pjjj.exe50⤵
- Executes dropped EXE
PID:4652 -
\??\c:\jvvdj.exec:\jvvdj.exe51⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rxfflfr.exec:\rxfflfr.exe52⤵
- Executes dropped EXE
PID:4888 -
\??\c:\nttnhn.exec:\nttnhn.exe53⤵
- Executes dropped EXE
PID:420 -
\??\c:\pjjjd.exec:\pjjjd.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jjjjp.exec:\jjjjp.exe55⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xrllfll.exec:\xrllfll.exe56⤵
- Executes dropped EXE
PID:4664 -
\??\c:\9ntttt.exec:\9ntttt.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\pjppp.exec:\pjppp.exe58⤵
- Executes dropped EXE
PID:964 -
\??\c:\flxlfll.exec:\flxlfll.exe59⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5lrllrr.exec:\5lrllrr.exe60⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nhhbht.exec:\nhhbht.exe61⤵
- Executes dropped EXE
PID:4108 -
\??\c:\ppppp.exec:\ppppp.exe62⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lllllll.exec:\lllllll.exe63⤵
- Executes dropped EXE
PID:4360 -
\??\c:\lxxxxff.exec:\lxxxxff.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\7djvv.exec:\7djvv.exe65⤵
- Executes dropped EXE
PID:548 -
\??\c:\pppvd.exec:\pppvd.exe66⤵PID:3932
-
\??\c:\rrxffll.exec:\rrxffll.exe67⤵PID:1468
-
\??\c:\1hnnnn.exec:\1hnnnn.exe68⤵PID:116
-
\??\c:\vjpvj.exec:\vjpvj.exe69⤵PID:960
-
\??\c:\llrllxx.exec:\llrllxx.exe70⤵PID:4884
-
\??\c:\3tbbtt.exec:\3tbbtt.exe71⤵PID:1536
-
\??\c:\5dvvp.exec:\5dvvp.exe72⤵PID:4984
-
\??\c:\dpvpp.exec:\dpvpp.exe73⤵PID:3444
-
\??\c:\bhtttb.exec:\bhtttb.exe74⤵PID:3856
-
\??\c:\vdppj.exec:\vdppj.exe75⤵PID:412
-
\??\c:\rflffxr.exec:\rflffxr.exe76⤵PID:2256
-
\??\c:\7bbtnt.exec:\7bbtnt.exe77⤵PID:4492
-
\??\c:\pvpvd.exec:\pvpvd.exe78⤵PID:3600
-
\??\c:\flxxxxl.exec:\flxxxxl.exe79⤵PID:3160
-
\??\c:\lflrlfr.exec:\lflrlfr.exe80⤵PID:2124
-
\??\c:\bbhnnn.exec:\bbhnnn.exe81⤵PID:3620
-
\??\c:\djpjv.exec:\djpjv.exe82⤵PID:3032
-
\??\c:\llrllrl.exec:\llrllrl.exe83⤵PID:3740
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe84⤵PID:2148
-
\??\c:\tbhnnn.exec:\tbhnnn.exe85⤵PID:3320
-
\??\c:\3dvvd.exec:\3dvvd.exe86⤵PID:3948
-
\??\c:\xxfrrrr.exec:\xxfrrrr.exe87⤵PID:1092
-
\??\c:\lrrlflx.exec:\lrrlflx.exe88⤵PID:2844
-
\??\c:\bhbttb.exec:\bhbttb.exe89⤵PID:2120
-
\??\c:\jpjdv.exec:\jpjdv.exe90⤵PID:4376
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe91⤵PID:2832
-
\??\c:\7xxxlll.exec:\7xxxlll.exe92⤵PID:4832
-
\??\c:\3tthhh.exec:\3tthhh.exe93⤵PID:4388
-
\??\c:\djvvp.exec:\djvvp.exe94⤵PID:1824
-
\??\c:\7lfffff.exec:\7lfffff.exe95⤵PID:3616
-
\??\c:\nhhbbb.exec:\nhhbbb.exe96⤵PID:3988
-
\??\c:\5dppp.exec:\5dppp.exe97⤵PID:4576
-
\??\c:\vdvdp.exec:\vdvdp.exe98⤵PID:3908
-
\??\c:\llxrfxx.exec:\llxrfxx.exe99⤵PID:2944
-
\??\c:\hhnnnb.exec:\hhnnnb.exe100⤵PID:4488
-
\??\c:\3pddp.exec:\3pddp.exe101⤵PID:4652
-
\??\c:\pvjjj.exec:\pvjjj.exe102⤵PID:3928
-
\??\c:\fxfffll.exec:\fxfffll.exe103⤵PID:2192
-
\??\c:\ntbbnn.exec:\ntbbnn.exe104⤵PID:2412
-
\??\c:\vvppp.exec:\vvppp.exe105⤵PID:2660
-
\??\c:\lxllffx.exec:\lxllffx.exe106⤵PID:3780
-
\??\c:\hnnnnn.exec:\hnnnnn.exe107⤵PID:244
-
\??\c:\hhtnbb.exec:\hhtnbb.exe108⤵PID:436
-
\??\c:\ddpvp.exec:\ddpvp.exe109⤵PID:3992
-
\??\c:\rlrlfff.exec:\rlrlfff.exe110⤵
- System Location Discovery: System Language Discovery
PID:4980 -
\??\c:\flllffx.exec:\flllffx.exe111⤵PID:4956
-
\??\c:\nhbtbb.exec:\nhbtbb.exe112⤵PID:1760
-
\??\c:\jpvpv.exec:\jpvpv.exe113⤵PID:3664
-
\??\c:\xfffxrr.exec:\xfffxrr.exe114⤵PID:4004
-
\??\c:\nnbbbb.exec:\nnbbbb.exe115⤵PID:4440
-
\??\c:\3bhhbb.exec:\3bhhbb.exe116⤵PID:3800
-
\??\c:\jjjjd.exec:\jjjjd.exe117⤵PID:3492
-
\??\c:\rrlxxlr.exec:\rrlxxlr.exe118⤵PID:4528
-
\??\c:\7ttttb.exec:\7ttttb.exe119⤵PID:4932
-
\??\c:\dvddd.exec:\dvddd.exe120⤵PID:376
-
\??\c:\3pdvv.exec:\3pdvv.exe121⤵PID:3148
-
\??\c:\rflrfll.exec:\rflrfll.exe122⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-