Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 04:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe
-
Size
52KB
-
MD5
4a6156cda219e78dd79c8ea223e59ee0
-
SHA1
7645eb43f7a798d6ffd76b1ea4f67dc6597152b4
-
SHA256
9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161
-
SHA512
c7d31749e52884d3c145a1f82e1b2f72fd6009cedcdd3b3e61bba7d57cef089bf7ab952b783996fcf6333146a5a4ce4ad6854bf52a6f1370f599f5571914aa3e
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeG:0cdpeeBSHHMHLf9Rybx7DYG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral1/memory/3060-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2876-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-90-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1112-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1780-128-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1272-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-208-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1636-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1944-217-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2152-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1688-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-263-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2064-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-299-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1752-289-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2772-319-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2772-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-322-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2160-327-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2748-340-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2660-353-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2800-358-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2808-367-0x0000000000260000-0x0000000000289000-memory.dmp family_blackmoon behavioral1/memory/2980-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-466-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/652-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/652-475-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2716-478-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2156-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-539-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/904-566-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1772-583-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2836-591-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2628-597-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2084-605-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2668-620-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2668-619-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/536-635-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2372-641-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2760-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-793-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1536-801-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2412-808-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2944-849-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2708-917-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2992-931-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1404-949-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2364-982-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 nntttt.exe 2876 rxrxrrf.exe 2140 nbbbnt.exe 2748 nnnbht.exe 2664 1jdjj.exe 2372 dpdpd.exe 3068 xfxrffl.exe 2648 ffrxflr.exe 2600 nhthnt.exe 2988 hhtntb.exe 1112 7pjjj.exe 1032 vvjdd.exe 1780 fllxfrl.exe 1588 xxxfrrl.exe 2840 5bttbh.exe 1272 rrrrxfl.exe 2024 xrxfrrf.exe 2976 ttnbtn.exe 2132 vdppp.exe 2716 vpppd.exe 2156 lfrrrfl.exe 1720 tnbhtb.exe 1944 nnttbb.exe 1636 pjjvp.exe 1312 5fxxfrr.exe 2152 llfxfll.exe 1688 tbnntb.exe 2424 7nhhnn.exe 2200 3pjjp.exe 2064 9lrxfll.exe 1752 rllrrfr.exe 2340 tthnbh.exe 2060 vvddd.exe 1776 xrfffff.exe 2772 1xlrllr.exe 2160 3bhhhn.exe 2676 7nnbhh.exe 2748 vdpjj.exe 2740 frrflxr.exe 2660 1ffrrff.exe 2800 tnttbt.exe 2808 bnttnb.exe 2540 ppjvd.exe 576 pvjdv.exe 2608 7rlrrxf.exe 2988 xrfxffr.exe 2288 tttttt.exe 2860 jjvvv.exe 1032 jjddp.exe 988 3ppdd.exe 1852 llflrxf.exe 2360 lllxlrr.exe 2776 tbntbh.exe 2964 ntntbh.exe 496 vdpjj.exe 2968 jvvpj.exe 2980 3xxflxf.exe 2124 1thnbh.exe 652 hnntbh.exe 2716 jjdjd.exe 2156 djvdd.exe 1720 rlrrxfr.exe 1608 tbtbhh.exe 1208 ttbhtb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2460 3060 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 31 PID 3060 wrote to memory of 2460 3060 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 31 PID 3060 wrote to memory of 2460 3060 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 31 PID 3060 wrote to memory of 2460 3060 9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe 31 PID 2460 wrote to memory of 2876 2460 nntttt.exe 32 PID 2460 wrote to memory of 2876 2460 nntttt.exe 32 PID 2460 wrote to memory of 2876 2460 nntttt.exe 32 PID 2460 wrote to memory of 2876 2460 nntttt.exe 32 PID 2876 wrote to memory of 2140 2876 rxrxrrf.exe 33 PID 2876 wrote to memory of 2140 2876 rxrxrrf.exe 33 PID 2876 wrote to memory of 2140 2876 rxrxrrf.exe 33 PID 2876 wrote to memory of 2140 2876 rxrxrrf.exe 33 PID 2140 wrote to memory of 2748 2140 nbbbnt.exe 34 PID 2140 wrote to memory of 2748 2140 nbbbnt.exe 34 PID 2140 wrote to memory of 2748 2140 nbbbnt.exe 34 PID 2140 wrote to memory of 2748 2140 nbbbnt.exe 34 PID 2748 wrote to memory of 2664 2748 nnnbht.exe 35 PID 2748 wrote to memory of 2664 2748 nnnbht.exe 35 PID 2748 wrote to memory of 2664 2748 nnnbht.exe 35 PID 2748 wrote to memory of 2664 2748 nnnbht.exe 35 PID 2664 wrote to memory of 2372 2664 1jdjj.exe 36 PID 2664 wrote to memory of 2372 2664 1jdjj.exe 36 PID 2664 wrote to memory of 2372 2664 1jdjj.exe 36 PID 2664 wrote to memory of 2372 2664 1jdjj.exe 36 PID 2372 wrote to memory of 3068 2372 dpdpd.exe 37 PID 2372 wrote to memory of 3068 2372 dpdpd.exe 37 PID 2372 wrote to memory of 3068 2372 dpdpd.exe 37 PID 2372 wrote to memory of 3068 2372 dpdpd.exe 37 PID 3068 wrote to memory of 2648 3068 xfxrffl.exe 38 PID 3068 wrote to memory of 2648 3068 xfxrffl.exe 38 PID 3068 wrote to memory of 2648 3068 xfxrffl.exe 38 PID 3068 wrote to memory of 2648 3068 xfxrffl.exe 38 PID 2648 wrote to memory of 2600 2648 ffrxflr.exe 39 PID 2648 wrote to memory of 2600 2648 ffrxflr.exe 39 PID 2648 wrote to memory of 2600 2648 ffrxflr.exe 39 PID 2648 wrote to memory of 2600 2648 ffrxflr.exe 39 PID 2600 wrote to memory of 2988 2600 nhthnt.exe 40 PID 2600 wrote to memory of 2988 2600 nhthnt.exe 40 PID 2600 wrote to memory of 2988 2600 nhthnt.exe 40 PID 2600 wrote to memory of 2988 2600 nhthnt.exe 40 PID 2988 wrote to memory of 1112 2988 hhtntb.exe 41 PID 2988 wrote to memory of 1112 2988 hhtntb.exe 41 PID 2988 wrote to memory of 1112 2988 hhtntb.exe 41 PID 2988 wrote to memory of 1112 2988 hhtntb.exe 41 PID 1112 wrote to memory of 1032 1112 7pjjj.exe 42 PID 1112 wrote to memory of 1032 1112 7pjjj.exe 42 PID 1112 wrote to memory of 1032 1112 7pjjj.exe 42 PID 1112 wrote to memory of 1032 1112 7pjjj.exe 42 PID 1032 wrote to memory of 1780 1032 vvjdd.exe 43 PID 1032 wrote to memory of 1780 1032 vvjdd.exe 43 PID 1032 wrote to memory of 1780 1032 vvjdd.exe 43 PID 1032 wrote to memory of 1780 1032 vvjdd.exe 43 PID 1780 wrote to memory of 1588 1780 fllxfrl.exe 44 PID 1780 wrote to memory of 1588 1780 fllxfrl.exe 44 PID 1780 wrote to memory of 1588 1780 fllxfrl.exe 44 PID 1780 wrote to memory of 1588 1780 fllxfrl.exe 44 PID 1588 wrote to memory of 2840 1588 xxxfrrl.exe 45 PID 1588 wrote to memory of 2840 1588 xxxfrrl.exe 45 PID 1588 wrote to memory of 2840 1588 xxxfrrl.exe 45 PID 1588 wrote to memory of 2840 1588 xxxfrrl.exe 45 PID 2840 wrote to memory of 1272 2840 5bttbh.exe 46 PID 2840 wrote to memory of 1272 2840 5bttbh.exe 46 PID 2840 wrote to memory of 1272 2840 5bttbh.exe 46 PID 2840 wrote to memory of 1272 2840 5bttbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe"C:\Users\Admin\AppData\Local\Temp\9247fca85c0946f691ffb613e5fad2c23027848dd1b6c565e69f8ad36f1bd161N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\nntttt.exec:\nntttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\rxrxrrf.exec:\rxrxrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nbbbnt.exec:\nbbbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\nnnbht.exec:\nnnbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\1jdjj.exec:\1jdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dpdpd.exec:\dpdpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xfxrffl.exec:\xfxrffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\ffrxflr.exec:\ffrxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\nhthnt.exec:\nhthnt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\hhtntb.exec:\hhtntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\7pjjj.exec:\7pjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\vvjdd.exec:\vvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\fllxfrl.exec:\fllxfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xxxfrrl.exec:\xxxfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5bttbh.exec:\5bttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rrrrxfl.exec:\rrrrxfl.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\xrxfrrf.exec:\xrxfrrf.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\ttnbtn.exec:\ttnbtn.exe19⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vdppp.exec:\vdppp.exe20⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpppd.exec:\vpppd.exe21⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfrrrfl.exec:\lfrrrfl.exe22⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnbhtb.exec:\tnbhtb.exe23⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnttbb.exec:\nnttbb.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjjvp.exec:\pjjvp.exe25⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5fxxfrr.exec:\5fxxfrr.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\llfxfll.exec:\llfxfll.exe27⤵
- Executes dropped EXE
PID:2152 -
\??\c:\tbnntb.exec:\tbnntb.exe28⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7nhhnn.exec:\7nhhnn.exe29⤵
- Executes dropped EXE
PID:2424 -
\??\c:\3pjjp.exec:\3pjjp.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9lrxfll.exec:\9lrxfll.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rllrrfr.exec:\rllrrfr.exe32⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tthnbh.exec:\tthnbh.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vvddd.exec:\vvddd.exe34⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrfffff.exec:\xrfffff.exe35⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1xlrllr.exec:\1xlrllr.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3bhhhn.exec:\3bhhhn.exe37⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7nnbhh.exec:\7nnbhh.exe38⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vdpjj.exec:\vdpjj.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\frrflxr.exec:\frrflxr.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1ffrrff.exec:\1ffrrff.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnttbt.exec:\tnttbt.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\bnttnb.exec:\bnttnb.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\ppjvd.exec:\ppjvd.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvjdv.exec:\pvjdv.exe45⤵
- Executes dropped EXE
PID:576 -
\??\c:\7rlrrxf.exec:\7rlrrxf.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrfxffr.exec:\xrfxffr.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tttttt.exec:\tttttt.exe48⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jjvvv.exec:\jjvvv.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jjddp.exec:\jjddp.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\3ppdd.exec:\3ppdd.exe51⤵
- Executes dropped EXE
PID:988 -
\??\c:\llflrxf.exec:\llflrxf.exe52⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lllxlrr.exec:\lllxlrr.exe53⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbntbh.exec:\tbntbh.exe54⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ntntbh.exec:\ntntbh.exe55⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vdpjj.exec:\vdpjj.exe56⤵
- Executes dropped EXE
PID:496 -
\??\c:\jvvpj.exec:\jvvpj.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3xxflxf.exec:\3xxflxf.exe58⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1thnbh.exec:\1thnbh.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnntbh.exec:\hnntbh.exe60⤵
- Executes dropped EXE
PID:652 -
\??\c:\jjdjd.exec:\jjdjd.exe61⤵
- Executes dropped EXE
PID:2716 -
\??\c:\djvdd.exec:\djvdd.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rlrrxfr.exec:\rlrrxfr.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\tbtbhh.exec:\tbtbhh.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\ttbhtb.exec:\ttbhtb.exe65⤵
- Executes dropped EXE
PID:1208 -
\??\c:\vdvjj.exec:\vdvjj.exe66⤵PID:1244
-
\??\c:\5vjpd.exec:\5vjpd.exe67⤵PID:944
-
\??\c:\xrflffr.exec:\xrflffr.exe68⤵PID:1964
-
\??\c:\xffrxfr.exec:\xffrxfr.exe69⤵PID:848
-
\??\c:\3htnhb.exec:\3htnhb.exe70⤵PID:1080
-
\??\c:\5nthhn.exec:\5nthhn.exe71⤵PID:2408
-
\??\c:\1dppv.exec:\1dppv.exe72⤵PID:924
-
\??\c:\9rllxfr.exec:\9rllxfr.exe73⤵PID:1028
-
\??\c:\rxrfrxf.exec:\rxrfrxf.exe74⤵PID:904
-
\??\c:\tthbbh.exec:\tthbbh.exe75⤵PID:2944
-
\??\c:\tthbbh.exec:\tthbbh.exe76⤵PID:320
-
\??\c:\9djvd.exec:\9djvd.exe77⤵PID:2344
-
\??\c:\9vvjj.exec:\9vvjj.exe78⤵PID:1772
-
\??\c:\xxlrrfx.exec:\xxlrrfx.exe79⤵PID:2836
-
\??\c:\9lrffrr.exec:\9lrffrr.exe80⤵PID:2628
-
\??\c:\nnhtbn.exec:\nnhtbn.exe81⤵PID:2084
-
\??\c:\vdjjp.exec:\vdjjp.exe82⤵PID:2792
-
\??\c:\7dddj.exec:\7dddj.exe83⤵PID:2668
-
\??\c:\jjpjj.exec:\jjpjj.exe84⤵PID:2572
-
\??\c:\ttnbtb.exec:\ttnbtb.exe85⤵PID:536
-
\??\c:\5hnttt.exec:\5hnttt.exe86⤵PID:2372
-
\??\c:\ddjpd.exec:\ddjpd.exe87⤵PID:2592
-
\??\c:\5jdpj.exec:\5jdpj.exe88⤵PID:2540
-
\??\c:\fllxflf.exec:\fllxflf.exe89⤵PID:1960
-
\??\c:\bbttht.exec:\bbttht.exe90⤵PID:2608
-
\??\c:\bhhthn.exec:\bhhthn.exe91⤵PID:2988
-
\??\c:\bhthbb.exec:\bhthbb.exe92⤵PID:1280
-
\??\c:\pvvdj.exec:\pvvdj.exe93⤵PID:2760
-
\??\c:\ppjjj.exec:\ppjjj.exe94⤵PID:2868
-
\??\c:\lrffrfr.exec:\lrffrfr.exe95⤵PID:1620
-
\??\c:\9hhhnt.exec:\9hhhnt.exe96⤵PID:1528
-
\??\c:\nnhtnn.exec:\nnhtnn.exe97⤵PID:2360
-
\??\c:\5vdpv.exec:\5vdpv.exe98⤵PID:2776
-
\??\c:\dvpjj.exec:\dvpjj.exe99⤵PID:3012
-
\??\c:\xxxxffx.exec:\xxxxffx.exe100⤵PID:496
-
\??\c:\rrxflrf.exec:\rrxflrf.exe101⤵PID:2972
-
\??\c:\tnbhth.exec:\tnbhth.exe102⤵PID:2980
-
\??\c:\ttbbht.exec:\ttbbht.exe103⤵PID:2508
-
\??\c:\djjvd.exec:\djjvd.exe104⤵PID:2120
-
\??\c:\dpvjp.exec:\dpvjp.exe105⤵PID:1988
-
\??\c:\7xrxrxl.exec:\7xrxrxl.exe106⤵PID:3024
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe107⤵PID:964
-
\??\c:\nhtbhn.exec:\nhtbhn.exe108⤵PID:2916
-
\??\c:\hhbhbh.exec:\hhbhbh.exe109⤵PID:2224
-
\??\c:\jjpdj.exec:\jjpdj.exe110⤵PID:1956
-
\??\c:\djjjp.exec:\djjjp.exe111⤵PID:2380
-
\??\c:\rxlrxfr.exec:\rxlrxfr.exe112⤵PID:1536
-
\??\c:\hnttbb.exec:\hnttbb.exe113⤵PID:2412
-
\??\c:\bhthnt.exec:\bhthnt.exe114⤵PID:2012
-
\??\c:\jpvvp.exec:\jpvvp.exe115⤵PID:2352
-
\??\c:\ppdjv.exec:\ppdjv.exe116⤵PID:2280
-
\??\c:\rllflxf.exec:\rllflxf.exe117⤵PID:2064
-
\??\c:\rrxfflr.exec:\rrxfflr.exe118⤵PID:2296
-
\??\c:\1tntnt.exec:\1tntnt.exe119⤵PID:2944
-
\??\c:\pjppp.exec:\pjppp.exe120⤵PID:304
-
\??\c:\jppjd.exec:\jppjd.exe121⤵PID:1500
-
\??\c:\7rllrlx.exec:\7rllrlx.exe122⤵PID:1776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-