Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/08/2024, 21:18
Static task
static1
Behavioral task
behavioral1
Sample
09ef099ba4c7ca2701e5d8428607d3d0N.exe
Resource
win7-20240708-en
General
-
Target
09ef099ba4c7ca2701e5d8428607d3d0N.exe
-
Size
257KB
-
MD5
09ef099ba4c7ca2701e5d8428607d3d0
-
SHA1
e4a91ecd18149c1f75b9bc1d5cdc27975c35e89c
-
SHA256
d092cd692c6c4f6317cd0be126a7cbe574c0f4597e9fb6e62eda8667cf8d89d0
-
SHA512
b9b3ee8a40d0268994335c1f38893d3e1fac9457f2a31740895ccf8740e5fe177a6d61d7dce03683e9c5b9cc2808117898fbce3486b384695517b1cdcffd787c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmc51+GqekBJCvr6zJBUDMu7rr60UI:n3C9BRIG0asYFm71m8+GdkB9yMu7P
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2372-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2492-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2860 1flfffx.exe 872 tttthh.exe 3880 nnbtnn.exe 3908 dpjdv.exe 2532 3btbtn.exe 3344 9pvvp.exe 3336 1lllrrx.exe 5040 tbthnb.exe 4504 dvjdp.exe 5048 lrrlfxr.exe 2144 hhhhtn.exe 4540 vvvpj.exe 4704 fxxrrrr.exe 1448 bnbtnh.exe 3600 vpjdv.exe 2044 lrxrllf.exe 4832 5xfxrxr.exe 4928 thnhbb.exe 2056 djpjd.exe 1152 xrrrrrr.exe 3468 bntnnn.exe 2692 pvvvp.exe 1016 vjpjv.exe 3232 lflfxxr.exe 3432 bntbth.exe 3928 jddjj.exe 4112 rffrllf.exe 2628 nbhbbh.exe 2468 pddvj.exe 2492 pjddd.exe 1004 xflfrrl.exe 4984 nbttbt.exe 3752 vvppj.exe 4632 rlrxxff.exe 5020 frrrrrl.exe 4468 tthbtt.exe 4916 7tbtbn.exe 4612 vjjdp.exe 3676 5fxrlfl.exe 820 xrxrffx.exe 2976 nbhthb.exe 3476 pvddp.exe 1732 frrlrxx.exe 4528 hhhnhb.exe 3104 1ppjd.exe 4820 pvvpp.exe 3684 rfxfxff.exe 2212 bttnnh.exe 2672 lffxrlf.exe 1820 llxrllf.exe 3184 bhnhbt.exe 4204 pvvvj.exe 2280 vpdpv.exe 116 lffxffx.exe 4292 3nnhbb.exe 2144 bnnhhh.exe 5032 3lfxlfx.exe 3412 rrxxrrr.exe 2876 tbnhbb.exe 3508 7vvjv.exe 3600 rxfxxrr.exe 4728 tnnhht.exe 4832 jddvj.exe 1476 dpdvp.exe -
resource yara_rule behavioral2/memory/2372-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2492-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2860 2372 09ef099ba4c7ca2701e5d8428607d3d0N.exe 82 PID 2372 wrote to memory of 2860 2372 09ef099ba4c7ca2701e5d8428607d3d0N.exe 82 PID 2372 wrote to memory of 2860 2372 09ef099ba4c7ca2701e5d8428607d3d0N.exe 82 PID 2860 wrote to memory of 872 2860 1flfffx.exe 83 PID 2860 wrote to memory of 872 2860 1flfffx.exe 83 PID 2860 wrote to memory of 872 2860 1flfffx.exe 83 PID 872 wrote to memory of 3880 872 tttthh.exe 84 PID 872 wrote to memory of 3880 872 tttthh.exe 84 PID 872 wrote to memory of 3880 872 tttthh.exe 84 PID 3880 wrote to memory of 3908 3880 nnbtnn.exe 85 PID 3880 wrote to memory of 3908 3880 nnbtnn.exe 85 PID 3880 wrote to memory of 3908 3880 nnbtnn.exe 85 PID 3908 wrote to memory of 2532 3908 dpjdv.exe 86 PID 3908 wrote to memory of 2532 3908 dpjdv.exe 86 PID 3908 wrote to memory of 2532 3908 dpjdv.exe 86 PID 2532 wrote to memory of 3344 2532 3btbtn.exe 88 PID 2532 wrote to memory of 3344 2532 3btbtn.exe 88 PID 2532 wrote to memory of 3344 2532 3btbtn.exe 88 PID 3344 wrote to memory of 3336 3344 9pvvp.exe 89 PID 3344 wrote to memory of 3336 3344 9pvvp.exe 89 PID 3344 wrote to memory of 3336 3344 9pvvp.exe 89 PID 3336 wrote to memory of 5040 3336 1lllrrx.exe 90 PID 3336 wrote to memory of 5040 3336 1lllrrx.exe 90 PID 3336 wrote to memory of 5040 3336 1lllrrx.exe 90 PID 5040 wrote to memory of 4504 5040 tbthnb.exe 92 PID 5040 wrote to memory of 4504 5040 tbthnb.exe 92 PID 5040 wrote to memory of 4504 5040 tbthnb.exe 92 PID 4504 wrote to memory of 5048 4504 dvjdp.exe 93 PID 4504 wrote to memory of 5048 4504 dvjdp.exe 93 PID 4504 wrote to memory of 5048 4504 dvjdp.exe 93 PID 5048 wrote to memory of 2144 5048 lrrlfxr.exe 95 PID 5048 wrote to memory of 2144 5048 lrrlfxr.exe 95 PID 5048 wrote to memory of 2144 5048 lrrlfxr.exe 95 PID 2144 wrote to memory of 4540 2144 hhhhtn.exe 96 PID 2144 wrote to memory of 4540 2144 hhhhtn.exe 96 PID 2144 wrote to memory of 4540 2144 hhhhtn.exe 96 PID 4540 wrote to memory of 4704 4540 vvvpj.exe 97 PID 4540 wrote to memory of 4704 4540 vvvpj.exe 97 PID 4540 wrote to memory of 4704 4540 vvvpj.exe 97 PID 4704 wrote to memory of 1448 4704 fxxrrrr.exe 98 PID 4704 wrote to memory of 1448 4704 fxxrrrr.exe 98 PID 4704 wrote to memory of 1448 4704 fxxrrrr.exe 98 PID 1448 wrote to memory of 3600 1448 bnbtnh.exe 99 PID 1448 wrote to memory of 3600 1448 bnbtnh.exe 99 PID 1448 wrote to memory of 3600 1448 bnbtnh.exe 99 PID 3600 wrote to memory of 2044 3600 vpjdv.exe 100 PID 3600 wrote to memory of 2044 3600 vpjdv.exe 100 PID 3600 wrote to memory of 2044 3600 vpjdv.exe 100 PID 2044 wrote to memory of 4832 2044 lrxrllf.exe 101 PID 2044 wrote to memory of 4832 2044 lrxrllf.exe 101 PID 2044 wrote to memory of 4832 2044 lrxrllf.exe 101 PID 4832 wrote to memory of 4928 4832 5xfxrxr.exe 102 PID 4832 wrote to memory of 4928 4832 5xfxrxr.exe 102 PID 4832 wrote to memory of 4928 4832 5xfxrxr.exe 102 PID 4928 wrote to memory of 2056 4928 thnhbb.exe 103 PID 4928 wrote to memory of 2056 4928 thnhbb.exe 103 PID 4928 wrote to memory of 2056 4928 thnhbb.exe 103 PID 2056 wrote to memory of 1152 2056 djpjd.exe 104 PID 2056 wrote to memory of 1152 2056 djpjd.exe 104 PID 2056 wrote to memory of 1152 2056 djpjd.exe 104 PID 1152 wrote to memory of 3468 1152 xrrrrrr.exe 105 PID 1152 wrote to memory of 3468 1152 xrrrrrr.exe 105 PID 1152 wrote to memory of 3468 1152 xrrrrrr.exe 105 PID 3468 wrote to memory of 2692 3468 bntnnn.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\09ef099ba4c7ca2701e5d8428607d3d0N.exe"C:\Users\Admin\AppData\Local\Temp\09ef099ba4c7ca2701e5d8428607d3d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1flfffx.exec:\1flfffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\tttthh.exec:\tttthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\nnbtnn.exec:\nnbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\dpjdv.exec:\dpjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\3btbtn.exec:\3btbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9pvvp.exec:\9pvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\1lllrrx.exec:\1lllrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\tbthnb.exec:\tbthnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\dvjdp.exec:\dvjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\hhhhtn.exec:\hhhhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\vvvpj.exec:\vvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\bnbtnh.exec:\bnbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\vpjdv.exec:\vpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\lrxrllf.exec:\lrxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\5xfxrxr.exec:\5xfxrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\thnhbb.exec:\thnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\djpjd.exec:\djpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\bntnnn.exec:\bntnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\pvvvp.exec:\pvvvp.exe23⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vjpjv.exec:\vjpjv.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lflfxxr.exec:\lflfxxr.exe25⤵
- Executes dropped EXE
PID:3232 -
\??\c:\bntbth.exec:\bntbth.exe26⤵
- Executes dropped EXE
PID:3432 -
\??\c:\jddjj.exec:\jddjj.exe27⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rffrllf.exec:\rffrllf.exe28⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nbhbbh.exec:\nbhbbh.exe29⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pddvj.exec:\pddvj.exe30⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjddd.exec:\pjddd.exe31⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xflfrrl.exec:\xflfrrl.exe32⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nbttbt.exec:\nbttbt.exe33⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vvppj.exec:\vvppj.exe34⤵
- Executes dropped EXE
PID:3752 -
\??\c:\rlrxxff.exec:\rlrxxff.exe35⤵
- Executes dropped EXE
PID:4632 -
\??\c:\frrrrrl.exec:\frrrrrl.exe36⤵
- Executes dropped EXE
PID:5020 -
\??\c:\tthbtt.exec:\tthbtt.exe37⤵
- Executes dropped EXE
PID:4468 -
\??\c:\7tbtbn.exec:\7tbtbn.exe38⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vjjdp.exec:\vjjdp.exe39⤵
- Executes dropped EXE
PID:4612 -
\??\c:\5fxrlfl.exec:\5fxrlfl.exe40⤵
- Executes dropped EXE
PID:3676 -
\??\c:\xrxrffx.exec:\xrxrffx.exe41⤵
- Executes dropped EXE
PID:820 -
\??\c:\nbhthb.exec:\nbhthb.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pvddp.exec:\pvddp.exe43⤵
- Executes dropped EXE
PID:3476 -
\??\c:\frrlrxx.exec:\frrlrxx.exe44⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhhnhb.exec:\hhhnhb.exe45⤵
- Executes dropped EXE
PID:4528 -
\??\c:\1ppjd.exec:\1ppjd.exe46⤵
- Executes dropped EXE
PID:3104 -
\??\c:\pvvpp.exec:\pvvpp.exe47⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rfxfxff.exec:\rfxfxff.exe48⤵
- Executes dropped EXE
PID:3684 -
\??\c:\bttnnh.exec:\bttnnh.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lffxrlf.exec:\lffxrlf.exe50⤵
- Executes dropped EXE
PID:2672 -
\??\c:\llxrllf.exec:\llxrllf.exe51⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bhnhbt.exec:\bhnhbt.exe52⤵
- Executes dropped EXE
PID:3184 -
\??\c:\pvvvj.exec:\pvvvj.exe53⤵
- Executes dropped EXE
PID:4204 -
\??\c:\vpdpv.exec:\vpdpv.exe54⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lffxffx.exec:\lffxffx.exe55⤵
- Executes dropped EXE
PID:116 -
\??\c:\3nnhbb.exec:\3nnhbb.exe56⤵
- Executes dropped EXE
PID:4292 -
\??\c:\bnnhhh.exec:\bnnhhh.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\3lfxlfx.exec:\3lfxlfx.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3412 -
\??\c:\tbnhbb.exec:\tbnhbb.exe60⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7vvjv.exec:\7vvjv.exe61⤵
- Executes dropped EXE
PID:3508 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe62⤵
- Executes dropped EXE
PID:3600 -
\??\c:\tnnhht.exec:\tnnhht.exe63⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jddvj.exec:\jddvj.exe64⤵
- Executes dropped EXE
PID:4832 -
\??\c:\dpdvp.exec:\dpdvp.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fllffxx.exec:\fllffxx.exe66⤵PID:4536
-
\??\c:\frxrllf.exec:\frxrllf.exe67⤵PID:1612
-
\??\c:\hhbtnh.exec:\hhbtnh.exe68⤵PID:1124
-
\??\c:\5vvpd.exec:\5vvpd.exe69⤵PID:2444
-
\??\c:\5jvjj.exec:\5jvjj.exe70⤵PID:2692
-
\??\c:\llrlxxr.exec:\llrlxxr.exe71⤵PID:760
-
\??\c:\tnnnhb.exec:\tnnnhb.exe72⤵PID:4680
-
\??\c:\ttnhhh.exec:\ttnhhh.exe73⤵PID:4920
-
\??\c:\jdpjd.exec:\jdpjd.exe74⤵PID:3432
-
\??\c:\jddpj.exec:\jddpj.exe75⤵PID:1500
-
\??\c:\3xxlfxr.exec:\3xxlfxr.exe76⤵PID:2716
-
\??\c:\9hhtth.exec:\9hhtth.exe77⤵PID:212
-
\??\c:\tntnbb.exec:\tntnbb.exe78⤵PID:1048
-
\??\c:\vjpdv.exec:\vjpdv.exe79⤵PID:4100
-
\??\c:\pdjdd.exec:\pdjdd.exe80⤵PID:2488
-
\??\c:\lfrlfrr.exec:\lfrlfrr.exe81⤵PID:3032
-
\??\c:\httbtt.exec:\httbtt.exe82⤵PID:1564
-
\??\c:\9hbthh.exec:\9hbthh.exe83⤵PID:4076
-
\??\c:\jvvpd.exec:\jvvpd.exe84⤵PID:4368
-
\??\c:\jvdvp.exec:\jvdvp.exe85⤵PID:5068
-
\??\c:\xfxrffx.exec:\xfxrffx.exe86⤵PID:3608
-
\??\c:\1fxrlfx.exec:\1fxrlfx.exe87⤵PID:2080
-
\??\c:\3nnbnn.exec:\3nnbnn.exe88⤵PID:4356
-
\??\c:\vdvpj.exec:\vdvpj.exe89⤵PID:1292
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe90⤵PID:1624
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe91⤵PID:872
-
\??\c:\7nhthb.exec:\7nhthb.exe92⤵PID:4216
-
\??\c:\jdvpj.exec:\jdvpj.exe93⤵PID:3168
-
\??\c:\jvdvj.exec:\jvdvj.exe94⤵PID:4748
-
\??\c:\frflxxr.exec:\frflxxr.exe95⤵PID:3164
-
\??\c:\1xrlflf.exec:\1xrlflf.exe96⤵PID:4424
-
\??\c:\thbnbn.exec:\thbnbn.exe97⤵PID:2320
-
\??\c:\jdpjv.exec:\jdpjv.exe98⤵PID:2004
-
\??\c:\jvjdp.exec:\jvjdp.exe99⤵PID:3336
-
\??\c:\fllfxrl.exec:\fllfxrl.exe100⤵PID:4732
-
\??\c:\lxxrllx.exec:\lxxrllx.exe101⤵PID:4232
-
\??\c:\htthbt.exec:\htthbt.exe102⤵PID:1068
-
\??\c:\vpppp.exec:\vpppp.exe103⤵PID:2652
-
\??\c:\vvppj.exec:\vvppj.exe104⤵PID:5072
-
\??\c:\rrfflll.exec:\rrfflll.exe105⤵PID:556
-
\??\c:\frfxrrl.exec:\frfxrrl.exe106⤵PID:4880
-
\??\c:\thnhbt.exec:\thnhbt.exe107⤵PID:4864
-
\??\c:\tnntnn.exec:\tnntnn.exe108⤵PID:1108
-
\??\c:\pjdjv.exec:\pjdjv.exe109⤵PID:3700
-
\??\c:\vjjdv.exec:\vjjdv.exe110⤵PID:2688
-
\??\c:\llfrfxl.exec:\llfrfxl.exe111⤵PID:752
-
\??\c:\nhhbtt.exec:\nhhbtt.exe112⤵PID:2044
-
\??\c:\thnhnn.exec:\thnhnn.exe113⤵PID:4928
-
\??\c:\vpvjp.exec:\vpvjp.exe114⤵PID:2256
-
\??\c:\frrflfr.exec:\frrflfr.exe115⤵PID:512
-
\??\c:\ntbttn.exec:\ntbttn.exe116⤵PID:1144
-
\??\c:\5ththb.exec:\5ththb.exe117⤵PID:2768
-
\??\c:\9jdvj.exec:\9jdvj.exe118⤵PID:4548
-
\??\c:\ppjvj.exec:\ppjvj.exe119⤵PID:3668
-
\??\c:\lrlflfx.exec:\lrlflfx.exe120⤵PID:3004
-
\??\c:\rlxlfxx.exec:\rlxlfxx.exe121⤵PID:2956
-
\??\c:\ttthtn.exec:\ttthtn.exe122⤵PID:4180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-