Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2025, 20:51
Static task
static1
Behavioral task
behavioral1
Sample
4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe
Resource
win7-20240708-en
General
-
Target
4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe
-
Size
455KB
-
MD5
e878d3d06259c8c05d9ca007f582f1d4
-
SHA1
00326b2c406b6a69cce410523d1d06d505c88dec
-
SHA256
4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637
-
SHA512
930e644baca687b940b388453bc768cda5f4a5a5c9e5958a167909858fd25f155e203436bf4474498cd8116df7d3342da68fe90566927117d6dd2ecc181ce27f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRd:q7Tc2NYHUrAwfMp3CDRd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3984-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3612-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3108-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/844-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/436-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1208-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4556-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1228-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1356-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1944-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3356-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3844-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1180-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3384-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4016-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/848-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1128-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5024-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3268-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/384-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/644-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/116-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5112-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2040-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2896-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4732-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3408-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/332-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4508-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2496-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3204-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1008-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2188-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2116-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3240-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3256-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5000-906-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2688-916-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4924-959-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-1774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4512 xrxrfxl.exe 384 7bbtnn.exe 3612 pvvpj.exe 3108 frlfrrr.exe 4920 dvvpp.exe 4324 rlffxxx.exe 844 hhnnnn.exe 2420 ffffllr.exe 1520 tbtttb.exe 1364 pjdvp.exe 436 vddpv.exe 4940 1bhbtt.exe 4476 tbthbt.exe 4788 pjpjd.exe 3476 lrxrrrl.exe 3056 dvjdd.exe 1208 rlrxrlf.exe 4560 1vpjv.exe 3016 bhhtbt.exe 5000 9jjjd.exe 4556 htthnh.exe 1228 hnnbbn.exe 1356 xrlxrrf.exe 1944 thhbnn.exe 1212 5xxrrxf.exe 3600 9jdvj.exe 3356 3xrfrlx.exe 4824 7tnbbb.exe 3844 1hhtnn.exe 1180 lflxrlx.exe 408 7ddpv.exe 3384 7xlxxrf.exe 1688 nbbnnh.exe 2120 7jvjv.exe 3448 vddpd.exe 4648 xllrfxl.exe 4016 7thtbt.exe 2940 9vjdv.exe 848 ddjpv.exe 4508 5rlxlfr.exe 1128 1nhbnb.exe 5024 dpvjd.exe 4316 vpjvj.exe 3268 7fxlrlx.exe 3480 bhhtnb.exe 2316 tbnbnn.exe 384 rfxxlfx.exe 2596 fxfrrlx.exe 4000 bhbtnh.exe 4572 pjjvp.exe 876 pddvp.exe 644 lllffxx.exe 3432 3ttntt.exe 3116 pddpd.exe 1592 lxlrflx.exe 1232 xffrffr.exe 1844 1nhtbh.exe 372 djdpd.exe 116 lflxrll.exe 4704 fllxlfx.exe 2140 tbbthb.exe 4964 vjdpd.exe 4476 rrrlxrf.exe 1600 fllxlfx.exe -
resource yara_rule behavioral2/memory/3984-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3612-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3108-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4324-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/844-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1364-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/436-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1208-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3016-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4556-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1228-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1356-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3356-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3844-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1180-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3384-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4648-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4016-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/848-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1128-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5024-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3268-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/384-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/644-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/116-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4476-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5112-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2040-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2688-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2896-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4732-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3408-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/332-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4508-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3160-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2496-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3204-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1008-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3220-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2188-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2116-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3240-745-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3984 wrote to memory of 4512 3984 4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe 82 PID 3984 wrote to memory of 4512 3984 4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe 82 PID 3984 wrote to memory of 4512 3984 4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe 82 PID 4512 wrote to memory of 384 4512 xrxrfxl.exe 83 PID 4512 wrote to memory of 384 4512 xrxrfxl.exe 83 PID 4512 wrote to memory of 384 4512 xrxrfxl.exe 83 PID 384 wrote to memory of 3612 384 7bbtnn.exe 84 PID 384 wrote to memory of 3612 384 7bbtnn.exe 84 PID 384 wrote to memory of 3612 384 7bbtnn.exe 84 PID 3612 wrote to memory of 3108 3612 pvvpj.exe 85 PID 3612 wrote to memory of 3108 3612 pvvpj.exe 85 PID 3612 wrote to memory of 3108 3612 pvvpj.exe 85 PID 3108 wrote to memory of 4920 3108 frlfrrr.exe 86 PID 3108 wrote to memory of 4920 3108 frlfrrr.exe 86 PID 3108 wrote to memory of 4920 3108 frlfrrr.exe 86 PID 4920 wrote to memory of 4324 4920 dvvpp.exe 87 PID 4920 wrote to memory of 4324 4920 dvvpp.exe 87 PID 4920 wrote to memory of 4324 4920 dvvpp.exe 87 PID 4324 wrote to memory of 844 4324 rlffxxx.exe 88 PID 4324 wrote to memory of 844 4324 rlffxxx.exe 88 PID 4324 wrote to memory of 844 4324 rlffxxx.exe 88 PID 844 wrote to memory of 2420 844 hhnnnn.exe 89 PID 844 wrote to memory of 2420 844 hhnnnn.exe 89 PID 844 wrote to memory of 2420 844 hhnnnn.exe 89 PID 2420 wrote to memory of 1520 2420 ffffllr.exe 90 PID 2420 wrote to memory of 1520 2420 ffffllr.exe 90 PID 2420 wrote to memory of 1520 2420 ffffllr.exe 90 PID 1520 wrote to memory of 1364 1520 tbtttb.exe 91 PID 1520 wrote to memory of 1364 1520 tbtttb.exe 91 PID 1520 wrote to memory of 1364 1520 tbtttb.exe 91 PID 1364 wrote to memory of 436 1364 pjdvp.exe 92 PID 1364 wrote to memory of 436 1364 pjdvp.exe 92 PID 1364 wrote to memory of 436 1364 pjdvp.exe 92 PID 436 wrote to memory of 4940 436 vddpv.exe 93 PID 436 wrote to memory of 4940 436 vddpv.exe 93 PID 436 wrote to memory of 4940 436 vddpv.exe 93 PID 4940 wrote to memory of 4476 4940 1bhbtt.exe 94 PID 4940 wrote to memory of 4476 4940 1bhbtt.exe 94 PID 4940 wrote to memory of 4476 4940 1bhbtt.exe 94 PID 4476 wrote to memory of 4788 4476 tbthbt.exe 95 PID 4476 wrote to memory of 4788 4476 tbthbt.exe 95 PID 4476 wrote to memory of 4788 4476 tbthbt.exe 95 PID 4788 wrote to memory of 3476 4788 pjpjd.exe 96 PID 4788 wrote to memory of 3476 4788 pjpjd.exe 96 PID 4788 wrote to memory of 3476 4788 pjpjd.exe 96 PID 3476 wrote to memory of 3056 3476 lrxrrrl.exe 97 PID 3476 wrote to memory of 3056 3476 lrxrrrl.exe 97 PID 3476 wrote to memory of 3056 3476 lrxrrrl.exe 97 PID 3056 wrote to memory of 1208 3056 dvjdd.exe 98 PID 3056 wrote to memory of 1208 3056 dvjdd.exe 98 PID 3056 wrote to memory of 1208 3056 dvjdd.exe 98 PID 1208 wrote to memory of 4560 1208 rlrxrlf.exe 99 PID 1208 wrote to memory of 4560 1208 rlrxrlf.exe 99 PID 1208 wrote to memory of 4560 1208 rlrxrlf.exe 99 PID 4560 wrote to memory of 3016 4560 1vpjv.exe 100 PID 4560 wrote to memory of 3016 4560 1vpjv.exe 100 PID 4560 wrote to memory of 3016 4560 1vpjv.exe 100 PID 3016 wrote to memory of 5000 3016 bhhtbt.exe 101 PID 3016 wrote to memory of 5000 3016 bhhtbt.exe 101 PID 3016 wrote to memory of 5000 3016 bhhtbt.exe 101 PID 5000 wrote to memory of 4556 5000 9jjjd.exe 102 PID 5000 wrote to memory of 4556 5000 9jjjd.exe 102 PID 5000 wrote to memory of 4556 5000 9jjjd.exe 102 PID 4556 wrote to memory of 1228 4556 htthnh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe"C:\Users\Admin\AppData\Local\Temp\4335b1476747773fcea4ec6c7568d3ac1950344e48d734873a7a20d096e01637.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\xrxrfxl.exec:\xrxrfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\7bbtnn.exec:\7bbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\pvvpj.exec:\pvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\frlfrrr.exec:\frlfrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\dvvpp.exec:\dvvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\rlffxxx.exec:\rlffxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\hhnnnn.exec:\hhnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\ffffllr.exec:\ffffllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\tbtttb.exec:\tbtttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\pjdvp.exec:\pjdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\vddpv.exec:\vddpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\1bhbtt.exec:\1bhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\tbthbt.exec:\tbthbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\dvjdd.exec:\dvjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\rlrxrlf.exec:\rlrxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\1vpjv.exec:\1vpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\bhhtbt.exec:\bhhtbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\9jjjd.exec:\9jjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\htthnh.exec:\htthnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\hnnbbn.exec:\hnnbbn.exe23⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xrlxrrf.exec:\xrlxrrf.exe24⤵
- Executes dropped EXE
PID:1356 -
\??\c:\thhbnn.exec:\thhbnn.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5xxrrxf.exec:\5xxrrxf.exe26⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9jdvj.exec:\9jdvj.exe27⤵
- Executes dropped EXE
PID:3600 -
\??\c:\3xrfrlx.exec:\3xrfrlx.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3356 -
\??\c:\7tnbbb.exec:\7tnbbb.exe29⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1hhtnn.exec:\1hhtnn.exe30⤵
- Executes dropped EXE
PID:3844 -
\??\c:\lflxrlx.exec:\lflxrlx.exe31⤵
- Executes dropped EXE
PID:1180 -
\??\c:\7ddpv.exec:\7ddpv.exe32⤵
- Executes dropped EXE
PID:408 -
\??\c:\7xlxxrf.exec:\7xlxxrf.exe33⤵
- Executes dropped EXE
PID:3384 -
\??\c:\nbbnnh.exec:\nbbnnh.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7jvjv.exec:\7jvjv.exe35⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vddpd.exec:\vddpd.exe36⤵
- Executes dropped EXE
PID:3448 -
\??\c:\xllrfxl.exec:\xllrfxl.exe37⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7thtbt.exec:\7thtbt.exe38⤵
- Executes dropped EXE
PID:4016 -
\??\c:\9vjdv.exec:\9vjdv.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddjpv.exec:\ddjpv.exe40⤵
- Executes dropped EXE
PID:848 -
\??\c:\5rlxlfr.exec:\5rlxlfr.exe41⤵
- Executes dropped EXE
PID:4508 -
\??\c:\1nhbnb.exec:\1nhbnb.exe42⤵
- Executes dropped EXE
PID:1128 -
\??\c:\dpvjd.exec:\dpvjd.exe43⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vpjvj.exec:\vpjvj.exe44⤵
- Executes dropped EXE
PID:4316 -
\??\c:\7fxlrlx.exec:\7fxlrlx.exe45⤵
- Executes dropped EXE
PID:3268 -
\??\c:\bhhtnb.exec:\bhhtnb.exe46⤵
- Executes dropped EXE
PID:3480 -
\??\c:\tbnbnn.exec:\tbnbnn.exe47⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rfxxlfx.exec:\rfxxlfx.exe48⤵
- Executes dropped EXE
PID:384 -
\??\c:\fxfrrlx.exec:\fxfrrlx.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bhbtnh.exec:\bhbtnh.exe50⤵
- Executes dropped EXE
PID:4000 -
\??\c:\pjjvp.exec:\pjjvp.exe51⤵
- Executes dropped EXE
PID:4572 -
\??\c:\pddvp.exec:\pddvp.exe52⤵
- Executes dropped EXE
PID:876 -
\??\c:\lllffxx.exec:\lllffxx.exe53⤵
- Executes dropped EXE
PID:644 -
\??\c:\3ttntt.exec:\3ttntt.exe54⤵
- Executes dropped EXE
PID:3432 -
\??\c:\pddpd.exec:\pddpd.exe55⤵
- Executes dropped EXE
PID:3116 -
\??\c:\lxlrflx.exec:\lxlrflx.exe56⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xffrffr.exec:\xffrffr.exe57⤵
- Executes dropped EXE
PID:1232 -
\??\c:\1nhtbh.exec:\1nhtbh.exe58⤵
- Executes dropped EXE
PID:1844 -
\??\c:\djdpd.exec:\djdpd.exe59⤵
- Executes dropped EXE
PID:372 -
\??\c:\lflxrll.exec:\lflxrll.exe60⤵
- Executes dropped EXE
PID:116 -
\??\c:\fllxlfx.exec:\fllxlfx.exe61⤵
- Executes dropped EXE
PID:4704 -
\??\c:\tbbthb.exec:\tbbthb.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\vjdpd.exec:\vjdpd.exe63⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rrrlxrf.exec:\rrrlxrf.exe64⤵
- Executes dropped EXE
PID:4476 -
\??\c:\fllxlfx.exec:\fllxlfx.exe65⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nhnthb.exec:\nhnthb.exe66⤵PID:1372
-
\??\c:\vpvpd.exec:\vpvpd.exe67⤵PID:4080
-
\??\c:\jvdpp.exec:\jvdpp.exe68⤵PID:1484
-
\??\c:\9xrfrfr.exec:\9xrfrfr.exe69⤵PID:3560
-
\??\c:\hhnhtn.exec:\hhnhtn.exe70⤵PID:5112
-
\??\c:\bbbbth.exec:\bbbbth.exe71⤵PID:4560
-
\??\c:\vddpd.exec:\vddpd.exe72⤵PID:2040
-
\??\c:\frlffxr.exec:\frlffxr.exe73⤵PID:1280
-
\??\c:\1bhthb.exec:\1bhthb.exe74⤵PID:460
-
\??\c:\vvpdv.exec:\vvpdv.exe75⤵PID:4212
-
\??\c:\pdddj.exec:\pdddj.exe76⤵PID:1644
-
\??\c:\3rfrxrf.exec:\3rfrxrf.exe77⤵PID:3852
-
\??\c:\hbbnbh.exec:\hbbnbh.exe78⤵PID:4968
-
\??\c:\pdjvp.exec:\pdjvp.exe79⤵PID:2488
-
\??\c:\pdvjp.exec:\pdvjp.exe80⤵PID:4384
-
\??\c:\lffxrlf.exec:\lffxrlf.exe81⤵PID:4644
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe82⤵PID:2688
-
\??\c:\bnthtn.exec:\bnthtn.exe83⤵PID:4692
-
\??\c:\vjdjv.exec:\vjdjv.exe84⤵PID:1984
-
\??\c:\1vvpd.exec:\1vvpd.exe85⤵PID:3484
-
\??\c:\5lxlrlx.exec:\5lxlrlx.exe86⤵PID:60
-
\??\c:\7thhtt.exec:\7thhtt.exe87⤵PID:1968
-
\??\c:\dvdvd.exec:\dvdvd.exe88⤵PID:2896
-
\??\c:\7ppjd.exec:\7ppjd.exe89⤵PID:2212
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe90⤵PID:468
-
\??\c:\fxllfrx.exec:\fxllfrx.exe91⤵PID:3516
-
\??\c:\bhhbnh.exec:\bhhbnh.exe92⤵PID:2576
-
\??\c:\dpjjv.exec:\dpjjv.exe93⤵PID:4864
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe94⤵PID:1936
-
\??\c:\thhthb.exec:\thhthb.exe95⤵PID:5084
-
\??\c:\nbnbhb.exec:\nbnbhb.exe96⤵
- System Location Discovery: System Language Discovery
PID:3420 -
\??\c:\vjddp.exec:\vjddp.exe97⤵PID:3384
-
\??\c:\rrrxlfl.exec:\rrrxlfl.exe98⤵PID:4732
-
\??\c:\7bthtn.exec:\7bthtn.exe99⤵PID:3408
-
\??\c:\7vpdp.exec:\7vpdp.exe100⤵PID:3448
-
\??\c:\frllrlf.exec:\frllrlf.exe101⤵PID:1572
-
\??\c:\nhbtnh.exec:\nhbtnh.exe102⤵PID:4016
-
\??\c:\tbbbnh.exec:\tbbbnh.exe103⤵PID:332
-
\??\c:\vpdpd.exec:\vpdpd.exe104⤵PID:2620
-
\??\c:\fxrfxlx.exec:\fxrfxlx.exe105⤵PID:4508
-
\??\c:\3tnhtn.exec:\3tnhtn.exe106⤵PID:2492
-
\??\c:\htbtnt.exec:\htbtnt.exe107⤵PID:2304
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe108⤵PID:3160
-
\??\c:\lrfrlfr.exec:\lrfrlfr.exe109⤵PID:4308
-
\??\c:\httnbt.exec:\httnbt.exe110⤵PID:2736
-
\??\c:\djdpd.exec:\djdpd.exe111⤵PID:2612
-
\??\c:\dpdjv.exec:\dpdjv.exe112⤵PID:4828
-
\??\c:\lrflfrl.exec:\lrflfrl.exe113⤵PID:3324
-
\??\c:\htthtn.exec:\htthtn.exe114⤵PID:2996
-
\??\c:\htttth.exec:\htttth.exe115⤵PID:2740
-
\??\c:\djjjd.exec:\djjjd.exe116⤵PID:1932
-
\??\c:\jvjdj.exec:\jvjdj.exe117⤵PID:876
-
\??\c:\rflrrll.exec:\rflrrll.exe118⤵PID:1448
-
\??\c:\thbtnh.exec:\thbtnh.exe119⤵PID:1196
-
\??\c:\pjdpd.exec:\pjdpd.exe120⤵PID:1068
-
\??\c:\5vvjd.exec:\5vvjd.exe121⤵PID:4504
-
\??\c:\5ffrxrx.exec:\5ffrxrx.exe122⤵PID:1076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-