Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2025, 00:26
Behavioral task
behavioral1
Sample
df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe
Resource
win7-20240903-en
General
-
Target
df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe
-
Size
334KB
-
MD5
e53c87bd86b6a5fd6a9e270e7f6592c0
-
SHA1
69d4d183d4e120183baf6b965f5ea9111eae3b9d
-
SHA256
df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5
-
SHA512
fe8db81ecf3bd76546cf631b2caaf12236fd26e00890c855b7e0db3328e7c476eae841a1b3c8d1cda98144df61ccf2b7a475fc8323a6ff2a81023e802a143104
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbeg:R4wFHoSHYHUrAwfMp3CDg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3400-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1796-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3556-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3836-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-637-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3400 c848260.exe 2552 a2860.exe 4756 rlrrxll.exe 2484 6626448.exe 1684 i048208.exe 1968 e28660.exe 2884 1xfxrrr.exe 3636 dvvpj.exe 3840 ffxxrlx.exe 1136 6244860.exe 2244 u488602.exe 5076 2200606.exe 4744 rffxxxr.exe 4272 648680.exe 1832 4604044.exe 3120 g2004.exe 2388 xrxlfxr.exe 4716 0268080.exe 4252 frrlffx.exe 4928 22880.exe 2332 602420.exe 1924 04606.exe 4616 jjpdd.exe 4516 7pvvj.exe 632 ffllrff.exe 3164 804260.exe 452 60660.exe 4844 xfffrlr.exe 3692 ppvpv.exe 3588 fxrfxrl.exe 4996 flllfff.exe 1716 666422.exe 4456 rrfxrrl.exe 3556 3ddvp.exe 4888 dppjv.exe 2740 lxffxxr.exe 4360 jvdpd.exe 1160 pjjdv.exe 1388 5pjvj.exe 3668 m2860.exe 1668 442082.exe 2912 62204.exe 3980 m4682.exe 2084 rxlxrfx.exe 1220 1vpjv.exe 3172 flfrflf.exe 4580 bttbbh.exe 2592 2084848.exe 412 0480000.exe 984 llxxxlf.exe 3108 82488.exe 4152 i242620.exe 1860 644882.exe 3836 5xxrlfx.exe 1664 484082.exe 3864 rlfrfrf.exe 2104 5dpjd.exe 3792 dppdp.exe 1364 4600466.exe 3208 82840.exe 4964 6228484.exe 3736 w26262.exe 2388 flrrrfr.exe 2168 6402800.exe -
resource yara_rule behavioral2/memory/1796-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000229ea-3.dat upx behavioral2/memory/3400-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1796-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023f66-9.dat upx behavioral2/files/0x000700000002406e-13.dat upx behavioral2/memory/4756-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024070-24.dat upx behavioral2/files/0x0007000000024072-30.dat upx behavioral2/files/0x0007000000024073-35.dat upx behavioral2/memory/2884-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024075-45.dat upx behavioral2/memory/3840-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024074-40.dat upx behavioral2/memory/1968-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1684-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2484-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002406f-20.dat upx behavioral2/memory/2552-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024076-50.dat upx behavioral2/memory/1136-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024077-55.dat upx behavioral2/files/0x0007000000024078-59.dat upx behavioral2/memory/2244-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024079-64.dat upx behavioral2/memory/5076-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002407a-69.dat upx behavioral2/memory/4744-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002406b-75.dat upx behavioral2/memory/4272-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1832-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002407b-79.dat upx behavioral2/files/0x000700000002407c-84.dat upx behavioral2/memory/3120-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002407d-89.dat upx behavioral2/memory/2388-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002407e-95.dat upx behavioral2/files/0x0007000000024080-101.dat upx behavioral2/memory/4252-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024081-105.dat upx behavioral2/files/0x0007000000024082-109.dat upx behavioral2/memory/2332-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1924-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4516-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000024084-120.dat upx behavioral2/files/0x0007000000024083-115.dat upx behavioral2/files/0x0007000000024085-125.dat upx behavioral2/files/0x0007000000024086-129.dat upx behavioral2/files/0x0007000000024087-134.dat upx behavioral2/files/0x0007000000024088-137.dat upx behavioral2/files/0x0007000000024089-141.dat upx behavioral2/files/0x000700000002408a-146.dat upx behavioral2/memory/632-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3588-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002408b-149.dat upx behavioral2/files/0x000700000002408c-154.dat upx behavioral2/memory/1716-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4456-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3556-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4888-167-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 444680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 080460.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u604046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4622006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e28260.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6244440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2860.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1796 wrote to memory of 3400 1796 df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe 86 PID 1796 wrote to memory of 3400 1796 df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe 86 PID 1796 wrote to memory of 3400 1796 df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe 86 PID 3400 wrote to memory of 2552 3400 c848260.exe 87 PID 3400 wrote to memory of 2552 3400 c848260.exe 87 PID 3400 wrote to memory of 2552 3400 c848260.exe 87 PID 2552 wrote to memory of 4756 2552 a2860.exe 88 PID 2552 wrote to memory of 4756 2552 a2860.exe 88 PID 2552 wrote to memory of 4756 2552 a2860.exe 88 PID 4756 wrote to memory of 2484 4756 rlrrxll.exe 89 PID 4756 wrote to memory of 2484 4756 rlrrxll.exe 89 PID 4756 wrote to memory of 2484 4756 rlrrxll.exe 89 PID 2484 wrote to memory of 1684 2484 6626448.exe 90 PID 2484 wrote to memory of 1684 2484 6626448.exe 90 PID 2484 wrote to memory of 1684 2484 6626448.exe 90 PID 1684 wrote to memory of 1968 1684 i048208.exe 91 PID 1684 wrote to memory of 1968 1684 i048208.exe 91 PID 1684 wrote to memory of 1968 1684 i048208.exe 91 PID 1968 wrote to memory of 2884 1968 e28660.exe 92 PID 1968 wrote to memory of 2884 1968 e28660.exe 92 PID 1968 wrote to memory of 2884 1968 e28660.exe 92 PID 2884 wrote to memory of 3636 2884 1xfxrrr.exe 93 PID 2884 wrote to memory of 3636 2884 1xfxrrr.exe 93 PID 2884 wrote to memory of 3636 2884 1xfxrrr.exe 93 PID 3636 wrote to memory of 3840 3636 dvvpj.exe 94 PID 3636 wrote to memory of 3840 3636 dvvpj.exe 94 PID 3636 wrote to memory of 3840 3636 dvvpj.exe 94 PID 3840 wrote to memory of 1136 3840 ffxxrlx.exe 95 PID 3840 wrote to memory of 1136 3840 ffxxrlx.exe 95 PID 3840 wrote to memory of 1136 3840 ffxxrlx.exe 95 PID 1136 wrote to memory of 2244 1136 6244860.exe 96 PID 1136 wrote to memory of 2244 1136 6244860.exe 96 PID 1136 wrote to memory of 2244 1136 6244860.exe 96 PID 2244 wrote to memory of 5076 2244 u488602.exe 97 PID 2244 wrote to memory of 5076 2244 u488602.exe 97 PID 2244 wrote to memory of 5076 2244 u488602.exe 97 PID 5076 wrote to memory of 4744 5076 2200606.exe 98 PID 5076 wrote to memory of 4744 5076 2200606.exe 98 PID 5076 wrote to memory of 4744 5076 2200606.exe 98 PID 4744 wrote to memory of 4272 4744 rffxxxr.exe 100 PID 4744 wrote to memory of 4272 4744 rffxxxr.exe 100 PID 4744 wrote to memory of 4272 4744 rffxxxr.exe 100 PID 4272 wrote to memory of 1832 4272 648680.exe 101 PID 4272 wrote to memory of 1832 4272 648680.exe 101 PID 4272 wrote to memory of 1832 4272 648680.exe 101 PID 1832 wrote to memory of 3120 1832 4604044.exe 103 PID 1832 wrote to memory of 3120 1832 4604044.exe 103 PID 1832 wrote to memory of 3120 1832 4604044.exe 103 PID 3120 wrote to memory of 2388 3120 g2004.exe 104 PID 3120 wrote to memory of 2388 3120 g2004.exe 104 PID 3120 wrote to memory of 2388 3120 g2004.exe 104 PID 2388 wrote to memory of 4716 2388 xrxlfxr.exe 105 PID 2388 wrote to memory of 4716 2388 xrxlfxr.exe 105 PID 2388 wrote to memory of 4716 2388 xrxlfxr.exe 105 PID 4716 wrote to memory of 4252 4716 0268080.exe 106 PID 4716 wrote to memory of 4252 4716 0268080.exe 106 PID 4716 wrote to memory of 4252 4716 0268080.exe 106 PID 4252 wrote to memory of 4928 4252 frrlffx.exe 107 PID 4252 wrote to memory of 4928 4252 frrlffx.exe 107 PID 4252 wrote to memory of 4928 4252 frrlffx.exe 107 PID 4928 wrote to memory of 2332 4928 22880.exe 108 PID 4928 wrote to memory of 2332 4928 22880.exe 108 PID 4928 wrote to memory of 2332 4928 22880.exe 108 PID 2332 wrote to memory of 1924 2332 602420.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe"C:\Users\Admin\AppData\Local\Temp\df59f6767fad34e61b12b4a5bef64c39ff87edb3c66dc09dc15e72c9c9088fd5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\c848260.exec:\c848260.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\a2860.exec:\a2860.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\rlrrxll.exec:\rlrrxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\6626448.exec:\6626448.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\i048208.exec:\i048208.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\e28660.exec:\e28660.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvvpj.exec:\dvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\ffxxrlx.exec:\ffxxrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\6244860.exec:\6244860.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\u488602.exec:\u488602.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\2200606.exec:\2200606.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\rffxxxr.exec:\rffxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\648680.exec:\648680.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\4604044.exec:\4604044.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\g2004.exec:\g2004.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\0268080.exec:\0268080.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\frrlffx.exec:\frrlffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\22880.exec:\22880.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\602420.exec:\602420.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\04606.exec:\04606.exe23⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjpdd.exec:\jjpdd.exe24⤵
- Executes dropped EXE
PID:4616 -
\??\c:\7pvvj.exec:\7pvvj.exe25⤵
- Executes dropped EXE
PID:4516 -
\??\c:\ffllrff.exec:\ffllrff.exe26⤵
- Executes dropped EXE
PID:632 -
\??\c:\804260.exec:\804260.exe27⤵
- Executes dropped EXE
PID:3164 -
\??\c:\60660.exec:\60660.exe28⤵
- Executes dropped EXE
PID:452 -
\??\c:\xfffrlr.exec:\xfffrlr.exe29⤵
- Executes dropped EXE
PID:4844 -
\??\c:\ppvpv.exec:\ppvpv.exe30⤵
- Executes dropped EXE
PID:3692 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe31⤵
- Executes dropped EXE
PID:3588 -
\??\c:\flllfff.exec:\flllfff.exe32⤵
- Executes dropped EXE
PID:4996 -
\??\c:\666422.exec:\666422.exe33⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe34⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3ddvp.exec:\3ddvp.exe35⤵
- Executes dropped EXE
PID:3556 -
\??\c:\dppjv.exec:\dppjv.exe36⤵
- Executes dropped EXE
PID:4888 -
\??\c:\lxffxxr.exec:\lxffxxr.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jvdpd.exec:\jvdpd.exe38⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pjjdv.exec:\pjjdv.exe39⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5pjvj.exec:\5pjvj.exe40⤵
- Executes dropped EXE
PID:1388 -
\??\c:\m2860.exec:\m2860.exe41⤵
- Executes dropped EXE
PID:3668 -
\??\c:\442082.exec:\442082.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\62204.exec:\62204.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\m4682.exec:\m4682.exe44⤵
- Executes dropped EXE
PID:3980 -
\??\c:\rxlxrfx.exec:\rxlxrfx.exe45⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1vpjv.exec:\1vpjv.exe46⤵
- Executes dropped EXE
PID:1220 -
\??\c:\flfrflf.exec:\flfrflf.exe47⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bttbbh.exec:\bttbbh.exe48⤵
- Executes dropped EXE
PID:4580 -
\??\c:\2084848.exec:\2084848.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\0480000.exec:\0480000.exe50⤵
- Executes dropped EXE
PID:412 -
\??\c:\llxxxlf.exec:\llxxxlf.exe51⤵
- Executes dropped EXE
PID:984 -
\??\c:\82488.exec:\82488.exe52⤵
- Executes dropped EXE
PID:3108 -
\??\c:\i242620.exec:\i242620.exe53⤵
- Executes dropped EXE
PID:4152 -
\??\c:\644882.exec:\644882.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5xxrlfx.exec:\5xxrlfx.exe55⤵
- Executes dropped EXE
PID:3836 -
\??\c:\484082.exec:\484082.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe57⤵
- Executes dropped EXE
PID:3864 -
\??\c:\5dpjd.exec:\5dpjd.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\dppdp.exec:\dppdp.exe59⤵
- Executes dropped EXE
PID:3792 -
\??\c:\4600466.exec:\4600466.exe60⤵
- Executes dropped EXE
PID:1364 -
\??\c:\82840.exec:\82840.exe61⤵
- Executes dropped EXE
PID:3208 -
\??\c:\6228484.exec:\6228484.exe62⤵
- Executes dropped EXE
PID:4964 -
\??\c:\w26262.exec:\w26262.exe63⤵
- Executes dropped EXE
PID:3736 -
\??\c:\flrrrfr.exec:\flrrrfr.exe64⤵
- Executes dropped EXE
PID:2388 -
\??\c:\6402800.exec:\6402800.exe65⤵
- Executes dropped EXE
PID:2168 -
\??\c:\frxffxx.exec:\frxffxx.exe66⤵PID:2360
-
\??\c:\hntnhh.exec:\hntnhh.exe67⤵PID:4872
-
\??\c:\i266880.exec:\i266880.exe68⤵PID:2500
-
\??\c:\jjjjj.exec:\jjjjj.exe69⤵PID:1892
-
\??\c:\086222.exec:\086222.exe70⤵PID:3924
-
\??\c:\flxrlll.exec:\flxrlll.exe71⤵PID:3664
-
\??\c:\pjvpj.exec:\pjvpj.exe72⤵PID:3132
-
\??\c:\000604.exec:\000604.exe73⤵PID:4912
-
\??\c:\lxfflfr.exec:\lxfflfr.exe74⤵PID:640
-
\??\c:\bhbttt.exec:\bhbttt.exe75⤵PID:4732
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe76⤵PID:2372
-
\??\c:\626666.exec:\626666.exe77⤵PID:3164
-
\??\c:\4648226.exec:\4648226.exe78⤵PID:4992
-
\??\c:\008444.exec:\008444.exe79⤵PID:2776
-
\??\c:\9pppd.exec:\9pppd.exe80⤵PID:1680
-
\??\c:\tntttt.exec:\tntttt.exe81⤵PID:3572
-
\??\c:\xrxllfx.exec:\xrxllfx.exe82⤵PID:2880
-
\??\c:\628888.exec:\628888.exe83⤵PID:4996
-
\??\c:\fxflllf.exec:\fxflllf.exe84⤵PID:2200
-
\??\c:\bnnhbb.exec:\bnnhbb.exe85⤵PID:4456
-
\??\c:\vpdvv.exec:\vpdvv.exe86⤵PID:4136
-
\??\c:\6688226.exec:\6688226.exe87⤵PID:4340
-
\??\c:\rxxfrlx.exec:\rxxfrlx.exe88⤵PID:2000
-
\??\c:\vvdpd.exec:\vvdpd.exe89⤵PID:3564
-
\??\c:\68408.exec:\68408.exe90⤵PID:2016
-
\??\c:\lffllll.exec:\lffllll.exe91⤵PID:3404
-
\??\c:\60262.exec:\60262.exe92⤵PID:3668
-
\??\c:\jjvpp.exec:\jjvpp.exe93⤵PID:2060
-
\??\c:\26664.exec:\26664.exe94⤵PID:3396
-
\??\c:\42844.exec:\42844.exe95⤵PID:4092
-
\??\c:\fllxxxf.exec:\fllxxxf.exe96⤵PID:5116
-
\??\c:\vdjjj.exec:\vdjjj.exe97⤵PID:1500
-
\??\c:\0480062.exec:\0480062.exe98⤵PID:4848
-
\??\c:\thtnnt.exec:\thtnnt.exe99⤵PID:4580
-
\??\c:\jjpdp.exec:\jjpdp.exe100⤵PID:2952
-
\??\c:\jjppj.exec:\jjppj.exe101⤵PID:468
-
\??\c:\44288.exec:\44288.exe102⤵PID:4256
-
\??\c:\424488.exec:\424488.exe103⤵PID:3776
-
\??\c:\9jjdj.exec:\9jjdj.exe104⤵PID:1688
-
\??\c:\pvjpj.exec:\pvjpj.exe105⤵PID:4664
-
\??\c:\xxxxrfx.exec:\xxxxrfx.exe106⤵PID:4176
-
\??\c:\nnbbhh.exec:\nnbbhh.exe107⤵PID:4964
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe108⤵PID:1372
-
\??\c:\vpddv.exec:\vpddv.exe109⤵PID:2428
-
\??\c:\jjppj.exec:\jjppj.exe110⤵PID:2020
-
\??\c:\4860226.exec:\4860226.exe111⤵PID:860
-
\??\c:\9fxxrrr.exec:\9fxxrrr.exe112⤵PID:2736
-
\??\c:\rxlfflr.exec:\rxlfflr.exe113⤵PID:4928
-
\??\c:\04048.exec:\04048.exe114⤵PID:4112
-
\??\c:\dvpjj.exec:\dvpjj.exe115⤵PID:4568
-
\??\c:\9nttnn.exec:\9nttnn.exe116⤵PID:1924
-
\??\c:\hhthhn.exec:\hhthhn.exe117⤵PID:4328
-
\??\c:\468600.exec:\468600.exe118⤵PID:1516
-
\??\c:\w42666.exec:\w42666.exe119⤵PID:992
-
\??\c:\jjvvd.exec:\jjvvd.exe120⤵PID:4832
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe121⤵PID:5108
-
\??\c:\28260.exec:\28260.exe122⤵PID:2276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-