Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe
Resource
win7-20241010-en
General
-
Target
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe
-
Size
455KB
-
MD5
d957c7df21012ad14533b6be5e41378e
-
SHA1
f1cb66aebad7cbd9981756f0a77be00ff7c471b7
-
SHA256
e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa
-
SHA512
91e1036ac142dc94753c72a070b36663e4259eecb5b3ef706ba806908763e2185e7d521f538c80af1453ffde646bdb8f44593a4c96089be984d3cc9111776426
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeK:q7Tc2NYHUrAwfMp3CDK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1508-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2808-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2632-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4052-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3848-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3840-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3720-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2536-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2740-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2756-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2848-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/368-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/544-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1676-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2572-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2256-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2448-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4688-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1168-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2992-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3308-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2372-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3832-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2272-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3732-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2888-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1760-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2164-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/800-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3212-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/464-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4148-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2544-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/448-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3208-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3416-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4256-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3992-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2696-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1508-711-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1512-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1836-861-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3928-977-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-1470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1508 lxxxllf.exe 2788 nhnhhh.exe 2632 82226.exe 1876 nbbbtt.exe 2808 rlfxffl.exe 4052 i020002.exe 3840 jvjdp.exe 3848 66642.exe 4444 1frlffx.exe 3720 9tbnhh.exe 3108 i048604.exe 2536 tnhbtn.exe 692 28660.exe 5068 5hbtnh.exe 2740 nnnbbh.exe 4492 2286004.exe 2756 48088.exe 368 jjdjv.exe 2848 i442648.exe 868 xfrrlfx.exe 544 bbbnhh.exe 1676 vpvpd.exe 2572 4244462.exe 2256 g0206.exe 2448 a8482.exe 4688 8848860.exe 1168 2026044.exe 60 3nhbtn.exe 3308 nhnbhh.exe 4968 0460666.exe 2992 800048.exe 2140 vdpdv.exe 1052 rlfrfxl.exe 5052 62260.exe 2372 7tthbb.exe 1664 pjpjd.exe 1636 1xrrrxr.exe 4380 9lflfxr.exe 3832 e66426.exe 2272 7xxrllf.exe 3496 20048.exe 3732 frxxrrr.exe 4076 5pjjp.exe 2888 00660.exe 1760 i060442.exe 3880 flfxrrl.exe 4072 xrflfrl.exe 64 3rxrrrf.exe 2164 dvvpj.exe 3624 xrxflfr.exe 800 068266.exe 2720 26060.exe 3108 88826.exe 3212 i686600.exe 464 860000.exe 4872 488048.exe 5072 btbbbb.exe 4960 0842604.exe 664 i240268.exe 4008 888226.exe 4736 flrxxxl.exe 1532 08024.exe 4448 804488.exe 2444 fxfxxxx.exe -
resource yara_rule behavioral2/memory/1508-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2808-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2632-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4052-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3848-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4444-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3840-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3720-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/692-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2536-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2740-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2756-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2848-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/368-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/544-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1676-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2572-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2256-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2448-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4688-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1168-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2992-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3308-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2372-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1664-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3832-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2272-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3732-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2888-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1760-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2164-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/800-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3212-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/464-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4148-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2544-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/448-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3208-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3416-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4256-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/336-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4924-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2824-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3992-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2696-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1508-711-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02826.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e02600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o460244.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6400404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 284848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 86622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8620040.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 064204.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648268.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8408226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 1508 3508 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 83 PID 3508 wrote to memory of 1508 3508 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 83 PID 3508 wrote to memory of 1508 3508 e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe 83 PID 1508 wrote to memory of 2788 1508 lxxxllf.exe 84 PID 1508 wrote to memory of 2788 1508 lxxxllf.exe 84 PID 1508 wrote to memory of 2788 1508 lxxxllf.exe 84 PID 2788 wrote to memory of 2632 2788 nhnhhh.exe 85 PID 2788 wrote to memory of 2632 2788 nhnhhh.exe 85 PID 2788 wrote to memory of 2632 2788 nhnhhh.exe 85 PID 2632 wrote to memory of 1876 2632 82226.exe 86 PID 2632 wrote to memory of 1876 2632 82226.exe 86 PID 2632 wrote to memory of 1876 2632 82226.exe 86 PID 1876 wrote to memory of 2808 1876 nbbbtt.exe 87 PID 1876 wrote to memory of 2808 1876 nbbbtt.exe 87 PID 1876 wrote to memory of 2808 1876 nbbbtt.exe 87 PID 2808 wrote to memory of 4052 2808 rlfxffl.exe 88 PID 2808 wrote to memory of 4052 2808 rlfxffl.exe 88 PID 2808 wrote to memory of 4052 2808 rlfxffl.exe 88 PID 4052 wrote to memory of 3840 4052 i020002.exe 89 PID 4052 wrote to memory of 3840 4052 i020002.exe 89 PID 4052 wrote to memory of 3840 4052 i020002.exe 89 PID 3840 wrote to memory of 3848 3840 jvjdp.exe 90 PID 3840 wrote to memory of 3848 3840 jvjdp.exe 90 PID 3840 wrote to memory of 3848 3840 jvjdp.exe 90 PID 3848 wrote to memory of 4444 3848 66642.exe 92 PID 3848 wrote to memory of 4444 3848 66642.exe 92 PID 3848 wrote to memory of 4444 3848 66642.exe 92 PID 4444 wrote to memory of 3720 4444 1frlffx.exe 93 PID 4444 wrote to memory of 3720 4444 1frlffx.exe 93 PID 4444 wrote to memory of 3720 4444 1frlffx.exe 93 PID 3720 wrote to memory of 3108 3720 9tbnhh.exe 94 PID 3720 wrote to memory of 3108 3720 9tbnhh.exe 94 PID 3720 wrote to memory of 3108 3720 9tbnhh.exe 94 PID 3108 wrote to memory of 2536 3108 i048604.exe 95 PID 3108 wrote to memory of 2536 3108 i048604.exe 95 PID 3108 wrote to memory of 2536 3108 i048604.exe 95 PID 2536 wrote to memory of 692 2536 tnhbtn.exe 96 PID 2536 wrote to memory of 692 2536 tnhbtn.exe 96 PID 2536 wrote to memory of 692 2536 tnhbtn.exe 96 PID 692 wrote to memory of 5068 692 28660.exe 98 PID 692 wrote to memory of 5068 692 28660.exe 98 PID 692 wrote to memory of 5068 692 28660.exe 98 PID 5068 wrote to memory of 2740 5068 5hbtnh.exe 99 PID 5068 wrote to memory of 2740 5068 5hbtnh.exe 99 PID 5068 wrote to memory of 2740 5068 5hbtnh.exe 99 PID 2740 wrote to memory of 4492 2740 nnnbbh.exe 101 PID 2740 wrote to memory of 4492 2740 nnnbbh.exe 101 PID 2740 wrote to memory of 4492 2740 nnnbbh.exe 101 PID 4492 wrote to memory of 2756 4492 2286004.exe 102 PID 4492 wrote to memory of 2756 4492 2286004.exe 102 PID 4492 wrote to memory of 2756 4492 2286004.exe 102 PID 2756 wrote to memory of 368 2756 48088.exe 103 PID 2756 wrote to memory of 368 2756 48088.exe 103 PID 2756 wrote to memory of 368 2756 48088.exe 103 PID 368 wrote to memory of 2848 368 jjdjv.exe 104 PID 368 wrote to memory of 2848 368 jjdjv.exe 104 PID 368 wrote to memory of 2848 368 jjdjv.exe 104 PID 2848 wrote to memory of 868 2848 i442648.exe 105 PID 2848 wrote to memory of 868 2848 i442648.exe 105 PID 2848 wrote to memory of 868 2848 i442648.exe 105 PID 868 wrote to memory of 544 868 xfrrlfx.exe 106 PID 868 wrote to memory of 544 868 xfrrlfx.exe 106 PID 868 wrote to memory of 544 868 xfrrlfx.exe 106 PID 544 wrote to memory of 1676 544 bbbnhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe"C:\Users\Admin\AppData\Local\Temp\e34f7b9c8bc5fda9c1011102469871e418eeebc8db41939077cfd8c459f327fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\lxxxllf.exec:\lxxxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\nhnhhh.exec:\nhnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\82226.exec:\82226.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\nbbbtt.exec:\nbbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rlfxffl.exec:\rlfxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\i020002.exec:\i020002.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\jvjdp.exec:\jvjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\66642.exec:\66642.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\1frlffx.exec:\1frlffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\9tbnhh.exec:\9tbnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\i048604.exec:\i048604.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\tnhbtn.exec:\tnhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\28660.exec:\28660.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\5hbtnh.exec:\5hbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\nnnbbh.exec:\nnnbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\2286004.exec:\2286004.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\48088.exec:\48088.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jjdjv.exec:\jjdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\i442648.exec:\i442648.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xfrrlfx.exec:\xfrrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\bbbnhh.exec:\bbbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\vpvpd.exec:\vpvpd.exe23⤵
- Executes dropped EXE
PID:1676 -
\??\c:\4244462.exec:\4244462.exe24⤵
- Executes dropped EXE
PID:2572 -
\??\c:\g0206.exec:\g0206.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\a8482.exec:\a8482.exe26⤵
- Executes dropped EXE
PID:2448 -
\??\c:\8848860.exec:\8848860.exe27⤵
- Executes dropped EXE
PID:4688 -
\??\c:\2026044.exec:\2026044.exe28⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3nhbtn.exec:\3nhbtn.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\nhnbhh.exec:\nhnbhh.exe30⤵
- Executes dropped EXE
PID:3308 -
\??\c:\0460666.exec:\0460666.exe31⤵
- Executes dropped EXE
PID:4968 -
\??\c:\800048.exec:\800048.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vdpdv.exec:\vdpdv.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1052 -
\??\c:\62260.exec:\62260.exe35⤵
- Executes dropped EXE
PID:5052 -
\??\c:\7tthbb.exec:\7tthbb.exe36⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjpjd.exec:\pjpjd.exe37⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1xrrrxr.exec:\1xrrrxr.exe38⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9lflfxr.exec:\9lflfxr.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\e66426.exec:\e66426.exe40⤵
- Executes dropped EXE
PID:3832 -
\??\c:\7xxrllf.exec:\7xxrllf.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\20048.exec:\20048.exe42⤵
- Executes dropped EXE
PID:3496 -
\??\c:\frxxrrr.exec:\frxxrrr.exe43⤵
- Executes dropped EXE
PID:3732 -
\??\c:\5pjjp.exec:\5pjjp.exe44⤵
- Executes dropped EXE
PID:4076 -
\??\c:\00660.exec:\00660.exe45⤵
- Executes dropped EXE
PID:2888 -
\??\c:\i060442.exec:\i060442.exe46⤵
- Executes dropped EXE
PID:1760 -
\??\c:\flfxrrl.exec:\flfxrrl.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3880 -
\??\c:\xrflfrl.exec:\xrflfrl.exe48⤵
- Executes dropped EXE
PID:4072 -
\??\c:\3rxrrrf.exec:\3rxrrrf.exe49⤵
- Executes dropped EXE
PID:64 -
\??\c:\dvvpj.exec:\dvvpj.exe50⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrxflfr.exec:\xrxflfr.exe51⤵
- Executes dropped EXE
PID:3624 -
\??\c:\068266.exec:\068266.exe52⤵
- Executes dropped EXE
PID:800 -
\??\c:\26060.exec:\26060.exe53⤵
- Executes dropped EXE
PID:2720 -
\??\c:\88826.exec:\88826.exe54⤵
- Executes dropped EXE
PID:3108 -
\??\c:\i686600.exec:\i686600.exe55⤵
- Executes dropped EXE
PID:3212 -
\??\c:\860000.exec:\860000.exe56⤵
- Executes dropped EXE
PID:464 -
\??\c:\488048.exec:\488048.exe57⤵
- Executes dropped EXE
PID:4872 -
\??\c:\btbbbb.exec:\btbbbb.exe58⤵
- Executes dropped EXE
PID:5072 -
\??\c:\0842604.exec:\0842604.exe59⤵
- Executes dropped EXE
PID:4960 -
\??\c:\i240268.exec:\i240268.exe60⤵
- Executes dropped EXE
PID:664 -
\??\c:\888226.exec:\888226.exe61⤵
- Executes dropped EXE
PID:4008 -
\??\c:\flrxxxl.exec:\flrxxxl.exe62⤵
- Executes dropped EXE
PID:4736 -
\??\c:\08024.exec:\08024.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\804488.exec:\804488.exe64⤵
- Executes dropped EXE
PID:4448 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe65⤵
- Executes dropped EXE
PID:2444 -
\??\c:\s0604.exec:\s0604.exe66⤵PID:4148
-
\??\c:\84000.exec:\84000.exe67⤵PID:2544
-
\??\c:\46620.exec:\46620.exe68⤵PID:448
-
\??\c:\vpjpv.exec:\vpjpv.exe69⤵PID:3364
-
\??\c:\xrrxrll.exec:\xrrxrll.exe70⤵PID:4924
-
\??\c:\tnbnnn.exec:\tnbnnn.exe71⤵PID:1428
-
\??\c:\662466.exec:\662466.exe72⤵PID:3208
-
\??\c:\ffxxrxl.exec:\ffxxrxl.exe73⤵PID:4420
-
\??\c:\k60046.exec:\k60046.exe74⤵PID:5012
-
\??\c:\2466048.exec:\2466048.exe75⤵PID:5100
-
\??\c:\jjjdv.exec:\jjjdv.exe76⤵PID:4836
-
\??\c:\5ttnhb.exec:\5ttnhb.exe77⤵PID:2912
-
\??\c:\1vppj.exec:\1vppj.exe78⤵PID:3416
-
\??\c:\440860.exec:\440860.exe79⤵PID:4508
-
\??\c:\nnnbtt.exec:\nnnbtt.exe80⤵PID:2696
-
\??\c:\0648226.exec:\0648226.exe81⤵PID:1988
-
\??\c:\jvdvj.exec:\jvdvj.exe82⤵PID:2660
-
\??\c:\s0486.exec:\s0486.exe83⤵PID:2208
-
\??\c:\bnnhnb.exec:\bnnhnb.exe84⤵PID:5052
-
\??\c:\bttnht.exec:\bttnht.exe85⤵PID:3068
-
\??\c:\bnthbt.exec:\bnthbt.exe86⤵PID:3748
-
\??\c:\888204.exec:\888204.exe87⤵PID:5076
-
\??\c:\pvvpd.exec:\pvvpd.exe88⤵PID:2692
-
\??\c:\xffrxlf.exec:\xffrxlf.exe89⤵PID:2264
-
\??\c:\9thnbb.exec:\9thnbb.exe90⤵PID:3188
-
\??\c:\u820828.exec:\u820828.exe91⤵PID:4680
-
\??\c:\0686048.exec:\0686048.exe92⤵PID:3200
-
\??\c:\i660488.exec:\i660488.exe93⤵PID:2012
-
\??\c:\62826.exec:\62826.exe94⤵PID:4264
-
\??\c:\nntntt.exec:\nntntt.exe95⤵PID:4256
-
\??\c:\4626088.exec:\4626088.exe96⤵PID:216
-
\??\c:\ntbbtb.exec:\ntbbtb.exe97⤵PID:3880
-
\??\c:\xllfrlf.exec:\xllfrlf.exe98⤵PID:2060
-
\??\c:\frxlfxr.exec:\frxlfxr.exe99⤵PID:64
-
\??\c:\60042.exec:\60042.exe100⤵PID:2164
-
\??\c:\o020044.exec:\o020044.exe101⤵PID:816
-
\??\c:\ppdpd.exec:\ppdpd.exe102⤵PID:1572
-
\??\c:\ppvpp.exec:\ppvpp.exe103⤵PID:3960
-
\??\c:\60082.exec:\60082.exe104⤵PID:224
-
\??\c:\btnhbt.exec:\btnhbt.exe105⤵PID:1940
-
\??\c:\828608.exec:\828608.exe106⤵PID:4944
-
\??\c:\lxrlxxl.exec:\lxrlxxl.exe107⤵PID:392
-
\??\c:\g8488.exec:\g8488.exe108⤵PID:3176
-
\??\c:\htbhhn.exec:\htbhhn.exe109⤵PID:336
-
\??\c:\8406048.exec:\8406048.exe110⤵PID:4960
-
\??\c:\bthtbb.exec:\bthtbb.exe111⤵PID:4724
-
\??\c:\i842686.exec:\i842686.exe112⤵PID:2368
-
\??\c:\rlrlllx.exec:\rlrlllx.exe113⤵PID:4492
-
\??\c:\9fxrffr.exec:\9fxrffr.exe114⤵PID:4456
-
\??\c:\8848886.exec:\8848886.exe115⤵PID:3616
-
\??\c:\08040.exec:\08040.exe116⤵PID:3952
-
\??\c:\vppdp.exec:\vppdp.exe117⤵PID:4040
-
\??\c:\hntbbh.exec:\hntbbh.exe118⤵PID:2380
-
\??\c:\jpvjv.exec:\jpvjv.exe119⤵PID:4808
-
\??\c:\fflxlfr.exec:\fflxlfr.exe120⤵PID:1576
-
\??\c:\u626262.exec:\u626262.exe121⤵PID:4488
-
\??\c:\9jjvp.exec:\9jjvp.exe122⤵PID:4924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-