Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe
-
Size
454KB
-
MD5
7da8d92eb3239e2873cf55d9f78f7ddf
-
SHA1
b5c1e180310c363376c267f6a43782a692b5b605
-
SHA256
9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7
-
SHA512
6e7a6290916e0cace2e773c3ae5209117ef4bacc7cf9eb12a33ef4ae895af297fbf97df131e4caa707ddc4c17eafe3e4bcbfe4f5806f1c2a6562a02172d5e19f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet7:q7Tc2NYHUrAwfMp3CDt7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2848-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-26-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2744-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-137-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2200-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1232-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-508-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1076-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-575-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-662-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-776-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2900 ffrxlrf.exe 2744 ttnnbh.exe 2796 btnnhh.exe 2616 ppjjv.exe 1312 9rllffx.exe 2664 ttbhnn.exe 988 7vdpj.exe 912 9xlfflr.exe 1532 1ttntn.exe 2132 jpdvd.exe 3024 hhbhnt.exe 2952 jpvvv.exe 2936 fxllxfr.exe 2004 5bbbhh.exe 2200 3frrrlf.exe 2504 nhnhtn.exe 1672 5jpdd.exe 1940 frlllrx.exe 2360 nnttbb.exe 2448 5jvvp.exe 2216 xlfxrrx.exe 1496 ddppv.exe 1800 frxrrff.exe 448 bntttn.exe 3032 flrrrrf.exe 1756 9hnbtn.exe 2432 7rllxfr.exe 1040 nhnhhh.exe 2364 9pppp.exe 2220 3flfxxx.exe 876 hhhnbn.exe 396 1jvvv.exe 2628 rlxffxf.exe 2328 nbttbt.exe 1720 9djdv.exe 2808 rrflllx.exe 2756 3thttt.exe 2672 thnbtt.exe 1828 vjvpv.exe 1556 xxffxxx.exe 600 tntbbh.exe 2664 tbnhhh.exe 2876 3ppjj.exe 576 rflffrr.exe 2336 5bnttt.exe 1204 7bnnnh.exe 3016 jvjjj.exe 2860 xxllllf.exe 2680 ffxlllr.exe 2872 5hnbbb.exe 2928 pdvvv.exe 1976 fllxlff.exe 2580 nbnnhn.exe 1232 nhbntb.exe 1276 1vjdj.exe 2316 xrllxxf.exe 1948 bbbhhh.exe 2476 3htnhh.exe 2468 dvjvd.exe 2260 frrfrfl.exe 1248 nbntbb.exe 108 7bhtnh.exe 1652 dvdvp.exe 1760 vpvvd.exe -
resource yara_rule behavioral1/memory/2848-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-466-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/108-492-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1076-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-817-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2640-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-895-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2900 2848 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2848 wrote to memory of 2900 2848 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2848 wrote to memory of 2900 2848 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2848 wrote to memory of 2900 2848 9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe 30 PID 2900 wrote to memory of 2744 2900 ffrxlrf.exe 31 PID 2900 wrote to memory of 2744 2900 ffrxlrf.exe 31 PID 2900 wrote to memory of 2744 2900 ffrxlrf.exe 31 PID 2900 wrote to memory of 2744 2900 ffrxlrf.exe 31 PID 2744 wrote to memory of 2796 2744 ttnnbh.exe 32 PID 2744 wrote to memory of 2796 2744 ttnnbh.exe 32 PID 2744 wrote to memory of 2796 2744 ttnnbh.exe 32 PID 2744 wrote to memory of 2796 2744 ttnnbh.exe 32 PID 2796 wrote to memory of 2616 2796 btnnhh.exe 33 PID 2796 wrote to memory of 2616 2796 btnnhh.exe 33 PID 2796 wrote to memory of 2616 2796 btnnhh.exe 33 PID 2796 wrote to memory of 2616 2796 btnnhh.exe 33 PID 2616 wrote to memory of 1312 2616 ppjjv.exe 34 PID 2616 wrote to memory of 1312 2616 ppjjv.exe 34 PID 2616 wrote to memory of 1312 2616 ppjjv.exe 34 PID 2616 wrote to memory of 1312 2616 ppjjv.exe 34 PID 1312 wrote to memory of 2664 1312 9rllffx.exe 35 PID 1312 wrote to memory of 2664 1312 9rllffx.exe 35 PID 1312 wrote to memory of 2664 1312 9rllffx.exe 35 PID 1312 wrote to memory of 2664 1312 9rllffx.exe 35 PID 2664 wrote to memory of 988 2664 ttbhnn.exe 36 PID 2664 wrote to memory of 988 2664 ttbhnn.exe 36 PID 2664 wrote to memory of 988 2664 ttbhnn.exe 36 PID 2664 wrote to memory of 988 2664 ttbhnn.exe 36 PID 988 wrote to memory of 912 988 7vdpj.exe 37 PID 988 wrote to memory of 912 988 7vdpj.exe 37 PID 988 wrote to memory of 912 988 7vdpj.exe 37 PID 988 wrote to memory of 912 988 7vdpj.exe 37 PID 912 wrote to memory of 1532 912 9xlfflr.exe 38 PID 912 wrote to memory of 1532 912 9xlfflr.exe 38 PID 912 wrote to memory of 1532 912 9xlfflr.exe 38 PID 912 wrote to memory of 1532 912 9xlfflr.exe 38 PID 1532 wrote to memory of 2132 1532 1ttntn.exe 39 PID 1532 wrote to memory of 2132 1532 1ttntn.exe 39 PID 1532 wrote to memory of 2132 1532 1ttntn.exe 39 PID 1532 wrote to memory of 2132 1532 1ttntn.exe 39 PID 2132 wrote to memory of 3024 2132 jpdvd.exe 40 PID 2132 wrote to memory of 3024 2132 jpdvd.exe 40 PID 2132 wrote to memory of 3024 2132 jpdvd.exe 40 PID 2132 wrote to memory of 3024 2132 jpdvd.exe 40 PID 3024 wrote to memory of 2952 3024 hhbhnt.exe 41 PID 3024 wrote to memory of 2952 3024 hhbhnt.exe 41 PID 3024 wrote to memory of 2952 3024 hhbhnt.exe 41 PID 3024 wrote to memory of 2952 3024 hhbhnt.exe 41 PID 2952 wrote to memory of 2936 2952 jpvvv.exe 42 PID 2952 wrote to memory of 2936 2952 jpvvv.exe 42 PID 2952 wrote to memory of 2936 2952 jpvvv.exe 42 PID 2952 wrote to memory of 2936 2952 jpvvv.exe 42 PID 2936 wrote to memory of 2004 2936 fxllxfr.exe 43 PID 2936 wrote to memory of 2004 2936 fxllxfr.exe 43 PID 2936 wrote to memory of 2004 2936 fxllxfr.exe 43 PID 2936 wrote to memory of 2004 2936 fxllxfr.exe 43 PID 2004 wrote to memory of 2200 2004 5bbbhh.exe 44 PID 2004 wrote to memory of 2200 2004 5bbbhh.exe 44 PID 2004 wrote to memory of 2200 2004 5bbbhh.exe 44 PID 2004 wrote to memory of 2200 2004 5bbbhh.exe 44 PID 2200 wrote to memory of 2504 2200 3frrrlf.exe 45 PID 2200 wrote to memory of 2504 2200 3frrrlf.exe 45 PID 2200 wrote to memory of 2504 2200 3frrrlf.exe 45 PID 2200 wrote to memory of 2504 2200 3frrrlf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe"C:\Users\Admin\AppData\Local\Temp\9f810998df6102e7d45fbac65130610cded309b6566c82dbff3508e8268c33f7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\ttnnbh.exec:\ttnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\btnnhh.exec:\btnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ppjjv.exec:\ppjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9rllffx.exec:\9rllffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\ttbhnn.exec:\ttbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7vdpj.exec:\7vdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\9xlfflr.exec:\9xlfflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\1ttntn.exec:\1ttntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jpdvd.exec:\jpdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\hhbhnt.exec:\hhbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\jpvvv.exec:\jpvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\fxllxfr.exec:\fxllxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5bbbhh.exec:\5bbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\3frrrlf.exec:\3frrrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\nhnhtn.exec:\nhnhtn.exe17⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5jpdd.exec:\5jpdd.exe18⤵
- Executes dropped EXE
PID:1672 -
\??\c:\frlllrx.exec:\frlllrx.exe19⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nnttbb.exec:\nnttbb.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5jvvp.exec:\5jvvp.exe21⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xlfxrrx.exec:\xlfxrrx.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ddppv.exec:\ddppv.exe23⤵
- Executes dropped EXE
PID:1496 -
\??\c:\frxrrff.exec:\frxrrff.exe24⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bntttn.exec:\bntttn.exe25⤵
- Executes dropped EXE
PID:448 -
\??\c:\flrrrrf.exec:\flrrrrf.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9hnbtn.exec:\9hnbtn.exe27⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7rllxfr.exec:\7rllxfr.exe28⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nhnhhh.exec:\nhnhhh.exe29⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9pppp.exec:\9pppp.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3flfxxx.exec:\3flfxxx.exe31⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhhnbn.exec:\hhhnbn.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\1jvvv.exec:\1jvvv.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\rlxffxf.exec:\rlxffxf.exe34⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nbttbt.exec:\nbttbt.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9djdv.exec:\9djdv.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rrflllx.exec:\rrflllx.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3thttt.exec:\3thttt.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thnbtt.exec:\thnbtt.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjvpv.exec:\vjvpv.exe40⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xxffxxx.exec:\xxffxxx.exe41⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tntbbh.exec:\tntbbh.exe42⤵
- Executes dropped EXE
PID:600 -
\??\c:\tbnhhh.exec:\tbnhhh.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3ppjj.exec:\3ppjj.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rflffrr.exec:\rflffrr.exe45⤵
- Executes dropped EXE
PID:576 -
\??\c:\5bnttt.exec:\5bnttt.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7bnnnh.exec:\7bnnnh.exe47⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xxllllf.exec:\xxllllf.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ffxlllr.exec:\ffxlllr.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5hnbbb.exec:\5hnbbb.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pdvvv.exec:\pdvvv.exe52⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fllxlff.exec:\fllxlff.exe53⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nbnnhn.exec:\nbnnhn.exe54⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhbntb.exec:\nhbntb.exe55⤵
- Executes dropped EXE
PID:1232 -
\??\c:\1vjdj.exec:\1vjdj.exe56⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xrllxxf.exec:\xrllxxf.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bbbhhh.exec:\bbbhhh.exe58⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3htnhh.exec:\3htnhh.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frrfrfl.exec:\frrfrfl.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nbntbb.exec:\nbntbb.exe62⤵
- Executes dropped EXE
PID:1248 -
\??\c:\7bhtnh.exec:\7bhtnh.exe63⤵
- Executes dropped EXE
PID:108 -
\??\c:\dvdvp.exec:\dvdvp.exe64⤵
- Executes dropped EXE
PID:1652 -
\??\c:\vpvvd.exec:\vpvvd.exe65⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrflxrx.exec:\xrflxrx.exe66⤵PID:3032
-
\??\c:\bnhhhb.exec:\bnhhhb.exe67⤵PID:692
-
\??\c:\jdpjp.exec:\jdpjp.exe68⤵PID:1740
-
\??\c:\7pdjp.exec:\7pdjp.exe69⤵PID:2152
-
\??\c:\lxlrrlr.exec:\lxlrrlr.exe70⤵PID:2416
-
\??\c:\hhttbh.exec:\hhttbh.exe71⤵PID:1688
-
\??\c:\bthtbb.exec:\bthtbb.exe72⤵PID:2032
-
\??\c:\pdjvp.exec:\pdjvp.exe73⤵PID:1524
-
\??\c:\lxfxxxf.exec:\lxfxxxf.exe74⤵PID:1076
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe75⤵PID:2880
-
\??\c:\3bbbtt.exec:\3bbbtt.exe76⤵PID:2736
-
\??\c:\1pdjj.exec:\1pdjj.exe77⤵PID:2228
-
\??\c:\5rrxxfl.exec:\5rrxxfl.exe78⤵PID:1724
-
\??\c:\1xlffxx.exec:\1xlffxx.exe79⤵PID:2708
-
\??\c:\hthhhb.exec:\hthhhb.exe80⤵PID:2756
-
\??\c:\7vvpj.exec:\7vvpj.exe81⤵PID:2672
-
\??\c:\xlxxllx.exec:\xlxxllx.exe82⤵PID:2480
-
\??\c:\1hnntt.exec:\1hnntt.exe83⤵PID:540
-
\??\c:\btnntb.exec:\btnntb.exe84⤵PID:600
-
\??\c:\ppddv.exec:\ppddv.exe85⤵PID:2920
-
\??\c:\xrrrflx.exec:\xrrrflx.exe86⤵PID:1872
-
\??\c:\xlllfxx.exec:\xlllfxx.exe87⤵PID:2592
-
\??\c:\3ttthh.exec:\3ttthh.exe88⤵PID:2312
-
\??\c:\pdpvj.exec:\pdpvj.exe89⤵PID:2560
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe90⤵PID:1072
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe91⤵PID:2864
-
\??\c:\9nbnnh.exec:\9nbnnh.exe92⤵PID:2800
-
\??\c:\7jpjd.exec:\7jpjd.exe93⤵PID:1096
-
\??\c:\pdvpv.exec:\pdvpv.exe94⤵PID:2516
-
\??\c:\5rxxfxx.exec:\5rxxfxx.exe95⤵PID:2244
-
\??\c:\tthnnb.exec:\tthnnb.exe96⤵PID:1288
-
\??\c:\1bbtnn.exec:\1bbtnn.exe97⤵PID:2492
-
\??\c:\jdpvd.exec:\jdpvd.exe98⤵PID:2252
-
\??\c:\frffrrx.exec:\frffrrx.exe99⤵
- System Location Discovery: System Language Discovery
PID:1544 -
\??\c:\nhtthh.exec:\nhtthh.exe100⤵PID:1956
-
\??\c:\1htbtt.exec:\1htbtt.exe101⤵PID:2448
-
\??\c:\dvpjp.exec:\dvpjp.exe102⤵PID:2224
-
\??\c:\1fffffx.exec:\1fffffx.exe103⤵PID:2292
-
\??\c:\frfflff.exec:\frfflff.exe104⤵PID:2456
-
\??\c:\hbntbt.exec:\hbntbt.exe105⤵PID:108
-
\??\c:\pjvvd.exec:\pjvvd.exe106⤵PID:1800
-
\??\c:\xlxrlfl.exec:\xlxrlfl.exe107⤵PID:448
-
\??\c:\9llflrr.exec:\9llflrr.exe108⤵PID:376
-
\??\c:\bthhhh.exec:\bthhhh.exe109⤵PID:1712
-
\??\c:\vpdvd.exec:\vpdvd.exe110⤵PID:1792
-
\??\c:\lxrrxrx.exec:\lxrrxrx.exe111⤵PID:1040
-
\??\c:\llxffff.exec:\llxffff.exe112⤵PID:2364
-
\??\c:\5bnntt.exec:\5bnntt.exe113⤵PID:2520
-
\??\c:\jvvjd.exec:\jvvjd.exe114⤵PID:2172
-
\??\c:\rflrllr.exec:\rflrllr.exe115⤵PID:1528
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe116⤵PID:2856
-
\??\c:\bhnbbn.exec:\bhnbbn.exe117⤵PID:2848
-
\??\c:\pjppv.exec:\pjppv.exe118⤵PID:2656
-
\??\c:\rlfxrll.exec:\rlfxrll.exe119⤵PID:1612
-
\??\c:\frrfrrx.exec:\frrfrrx.exe120⤵PID:2996
-
\??\c:\hnttbt.exec:\hnttbt.exe121⤵PID:2636
-
\??\c:\dppdv.exec:\dppdv.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-