Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe
-
Size
454KB
-
MD5
f8f6ec6fadaf04363fd0418180be5de2
-
SHA1
38e5b815fa41c5809c14e98a5ea577ed524661a9
-
SHA256
a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c
-
SHA512
99f2e9b4e8db08abe7a1ee59ae39871863bbb04fbeed8799f1883d242791492bfd60470878c1c52152775ce3ffa86452df8cac4d92c581e16358543a7d877e82
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2080-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/652-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1092-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-213-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1884-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/936-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/444-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-538-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-680-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-750-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2196-751-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 tnbhhh.exe 2868 jvppd.exe 2596 3bhnnh.exe 2616 3thhnn.exe 2724 vvjvd.exe 2592 3fllxfl.exe 1552 tnbntt.exe 3056 jdpvj.exe 2936 htnbnt.exe 3068 nhbhtb.exe 2448 pjvvd.exe 1432 xrflrrf.exe 652 5tnnnh.exe 1864 1fxxfxf.exe 2108 dpvvv.exe 2932 rlflxrf.exe 1092 lfrlfxf.exe 1324 vpddd.exe 2404 xrlfrrl.exe 2256 9tnntb.exe 2300 vpjjp.exe 1884 frlfrlr.exe 1152 htnhtt.exe 2516 fxrrxlx.exe 1304 djjjj.exe 1388 fxlfrrr.exe 2292 hbnttt.exe 2112 3llrflf.exe 1736 bbbbhn.exe 2500 dvvvd.exe 1696 fxfrxfl.exe 2728 nhtttt.exe 2712 ddppd.exe 1580 3xrrxrf.exe 2304 3hnthh.exe 2452 jpjjp.exe 2748 fxrrlrx.exe 2616 htnbhb.exe 2784 jppvp.exe 2708 pjdjp.exe 1720 lfrrrxf.exe 1852 nbtntn.exe 3036 vpjdd.exe 2440 dvpvd.exe 568 3fxfrfl.exe 2336 1bhbbn.exe 1936 tnhhhh.exe 2764 7jdpp.exe 756 5xlrrrx.exe 2028 3bttnn.exe 936 hthhhh.exe 2892 pdppd.exe 2004 rlrllrr.exe 1320 5bnnhh.exe 2568 vjdvv.exe 2556 3vppv.exe 1920 7flfxff.exe 2256 9ttntn.exe 1660 nhbttb.exe 2552 jjvjp.exe 1480 1lrlrrf.exe 600 1hhbbh.exe 444 bthbtt.exe 1616 vpjpv.exe -
resource yara_rule behavioral1/memory/2080-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-41-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-750-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2196-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-857-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2080 2468 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 30 PID 2468 wrote to memory of 2080 2468 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 30 PID 2468 wrote to memory of 2080 2468 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 30 PID 2468 wrote to memory of 2080 2468 a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe 30 PID 2080 wrote to memory of 2868 2080 tnbhhh.exe 31 PID 2080 wrote to memory of 2868 2080 tnbhhh.exe 31 PID 2080 wrote to memory of 2868 2080 tnbhhh.exe 31 PID 2080 wrote to memory of 2868 2080 tnbhhh.exe 31 PID 2868 wrote to memory of 2596 2868 jvppd.exe 32 PID 2868 wrote to memory of 2596 2868 jvppd.exe 32 PID 2868 wrote to memory of 2596 2868 jvppd.exe 32 PID 2868 wrote to memory of 2596 2868 jvppd.exe 32 PID 2596 wrote to memory of 2616 2596 3bhnnh.exe 33 PID 2596 wrote to memory of 2616 2596 3bhnnh.exe 33 PID 2596 wrote to memory of 2616 2596 3bhnnh.exe 33 PID 2596 wrote to memory of 2616 2596 3bhnnh.exe 33 PID 2616 wrote to memory of 2724 2616 3thhnn.exe 34 PID 2616 wrote to memory of 2724 2616 3thhnn.exe 34 PID 2616 wrote to memory of 2724 2616 3thhnn.exe 34 PID 2616 wrote to memory of 2724 2616 3thhnn.exe 34 PID 2724 wrote to memory of 2592 2724 vvjvd.exe 35 PID 2724 wrote to memory of 2592 2724 vvjvd.exe 35 PID 2724 wrote to memory of 2592 2724 vvjvd.exe 35 PID 2724 wrote to memory of 2592 2724 vvjvd.exe 35 PID 2592 wrote to memory of 1552 2592 3fllxfl.exe 36 PID 2592 wrote to memory of 1552 2592 3fllxfl.exe 36 PID 2592 wrote to memory of 1552 2592 3fllxfl.exe 36 PID 2592 wrote to memory of 1552 2592 3fllxfl.exe 36 PID 1552 wrote to memory of 3056 1552 tnbntt.exe 37 PID 1552 wrote to memory of 3056 1552 tnbntt.exe 37 PID 1552 wrote to memory of 3056 1552 tnbntt.exe 37 PID 1552 wrote to memory of 3056 1552 tnbntt.exe 37 PID 3056 wrote to memory of 2936 3056 jdpvj.exe 38 PID 3056 wrote to memory of 2936 3056 jdpvj.exe 38 PID 3056 wrote to memory of 2936 3056 jdpvj.exe 38 PID 3056 wrote to memory of 2936 3056 jdpvj.exe 38 PID 2936 wrote to memory of 3068 2936 htnbnt.exe 39 PID 2936 wrote to memory of 3068 2936 htnbnt.exe 39 PID 2936 wrote to memory of 3068 2936 htnbnt.exe 39 PID 2936 wrote to memory of 3068 2936 htnbnt.exe 39 PID 3068 wrote to memory of 2448 3068 nhbhtb.exe 40 PID 3068 wrote to memory of 2448 3068 nhbhtb.exe 40 PID 3068 wrote to memory of 2448 3068 nhbhtb.exe 40 PID 3068 wrote to memory of 2448 3068 nhbhtb.exe 40 PID 2448 wrote to memory of 1432 2448 pjvvd.exe 41 PID 2448 wrote to memory of 1432 2448 pjvvd.exe 41 PID 2448 wrote to memory of 1432 2448 pjvvd.exe 41 PID 2448 wrote to memory of 1432 2448 pjvvd.exe 41 PID 1432 wrote to memory of 652 1432 xrflrrf.exe 42 PID 1432 wrote to memory of 652 1432 xrflrrf.exe 42 PID 1432 wrote to memory of 652 1432 xrflrrf.exe 42 PID 1432 wrote to memory of 652 1432 xrflrrf.exe 42 PID 652 wrote to memory of 1864 652 5tnnnh.exe 43 PID 652 wrote to memory of 1864 652 5tnnnh.exe 43 PID 652 wrote to memory of 1864 652 5tnnnh.exe 43 PID 652 wrote to memory of 1864 652 5tnnnh.exe 43 PID 1864 wrote to memory of 2108 1864 1fxxfxf.exe 44 PID 1864 wrote to memory of 2108 1864 1fxxfxf.exe 44 PID 1864 wrote to memory of 2108 1864 1fxxfxf.exe 44 PID 1864 wrote to memory of 2108 1864 1fxxfxf.exe 44 PID 2108 wrote to memory of 2932 2108 dpvvv.exe 45 PID 2108 wrote to memory of 2932 2108 dpvvv.exe 45 PID 2108 wrote to memory of 2932 2108 dpvvv.exe 45 PID 2108 wrote to memory of 2932 2108 dpvvv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe"C:\Users\Admin\AppData\Local\Temp\a650db69d805c629016e5705102f67b67ad7d55b8adcd2647b048d01f3aab36c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnbhhh.exec:\tnbhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\jvppd.exec:\jvppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\3bhnnh.exec:\3bhnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\3thhnn.exec:\3thhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vvjvd.exec:\vvjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\3fllxfl.exec:\3fllxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\tnbntt.exec:\tnbntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\jdpvj.exec:\jdpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\htnbnt.exec:\htnbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\nhbhtb.exec:\nhbhtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pjvvd.exec:\pjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\xrflrrf.exec:\xrflrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\5tnnnh.exec:\5tnnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\1fxxfxf.exec:\1fxxfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\dpvvv.exec:\dpvvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rlflxrf.exec:\rlflxrf.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfrlfxf.exec:\lfrlfxf.exe18⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vpddd.exec:\vpddd.exe19⤵
- Executes dropped EXE
PID:1324 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe20⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9tnntb.exec:\9tnntb.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vpjjp.exec:\vpjjp.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\frlfrlr.exec:\frlfrlr.exe23⤵
- Executes dropped EXE
PID:1884 -
\??\c:\htnhtt.exec:\htnhtt.exe24⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fxrrxlx.exec:\fxrrxlx.exe25⤵
- Executes dropped EXE
PID:2516 -
\??\c:\djjjj.exec:\djjjj.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe27⤵
- Executes dropped EXE
PID:1388 -
\??\c:\hbnttt.exec:\hbnttt.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3llrflf.exec:\3llrflf.exe29⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bbbbhn.exec:\bbbbhn.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvvvd.exec:\dvvvd.exe31⤵
- Executes dropped EXE
PID:2500 -
\??\c:\fxfrxfl.exec:\fxfrxfl.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nhtttt.exec:\nhtttt.exe33⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ddppd.exec:\ddppd.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\3xrrxrf.exec:\3xrrxrf.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3hnthh.exec:\3hnthh.exe36⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jpjjp.exec:\jpjjp.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\htnbhb.exec:\htnbhb.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jppvp.exec:\jppvp.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjdjp.exec:\pjdjp.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe42⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nbtntn.exec:\nbtntn.exe43⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vpjdd.exec:\vpjdd.exe44⤵
- Executes dropped EXE
PID:3036 -
\??\c:\dvpvd.exec:\dvpvd.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3fxfrfl.exec:\3fxfrfl.exe46⤵
- Executes dropped EXE
PID:568 -
\??\c:\1bhbbn.exec:\1bhbbn.exe47⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnhhhh.exec:\tnhhhh.exe48⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7jdpp.exec:\7jdpp.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5xlrrrx.exec:\5xlrrrx.exe50⤵
- Executes dropped EXE
PID:756 -
\??\c:\3bttnn.exec:\3bttnn.exe51⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hthhhh.exec:\hthhhh.exe52⤵
- Executes dropped EXE
PID:936 -
\??\c:\pdppd.exec:\pdppd.exe53⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlrllrr.exec:\rlrllrr.exe54⤵
- Executes dropped EXE
PID:2004 -
\??\c:\5bnnhh.exec:\5bnnhh.exe55⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vjdvv.exec:\vjdvv.exe56⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3vppv.exec:\3vppv.exe57⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7flfxff.exec:\7flfxff.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9ttntn.exec:\9ttntn.exe59⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nhbttb.exec:\nhbttb.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jjvjp.exec:\jjvjp.exe61⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1lrlrrf.exec:\1lrlrrf.exe62⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1hhbbh.exec:\1hhbbh.exe63⤵
- Executes dropped EXE
PID:600 -
\??\c:\bthbtt.exec:\bthbtt.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:444 -
\??\c:\vpjpv.exec:\vpjpv.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\llfxxxf.exec:\llfxxxf.exe66⤵PID:1304
-
\??\c:\7rxrrrx.exec:\7rxrrrx.exe67⤵PID:692
-
\??\c:\nhntbb.exec:\nhntbb.exe68⤵PID:2532
-
\??\c:\hbtbhn.exec:\hbtbhn.exe69⤵PID:2464
-
\??\c:\9jjdd.exec:\9jjdd.exe70⤵PID:2112
-
\??\c:\1rfflrf.exec:\1rfflrf.exe71⤵PID:2096
-
\??\c:\lxrxxrf.exec:\lxrxxrf.exe72⤵PID:2120
-
\??\c:\nhttbb.exec:\nhttbb.exe73⤵
- System Location Discovery: System Language Discovery
PID:1696 -
\??\c:\jdpjp.exec:\jdpjp.exe74⤵PID:2956
-
\??\c:\rfxrrll.exec:\rfxrrll.exe75⤵PID:2856
-
\??\c:\frxxfxl.exec:\frxxfxl.exe76⤵PID:2868
-
\??\c:\hhbhnn.exec:\hhbhnn.exe77⤵PID:1580
-
\??\c:\nhntbb.exec:\nhntbb.exe78⤵
- System Location Discovery: System Language Discovery
PID:2304 -
\??\c:\jdvdd.exec:\jdvdd.exe79⤵PID:2760
-
\??\c:\fxlllll.exec:\fxlllll.exe80⤵PID:2788
-
\??\c:\fxllxxf.exec:\fxllxxf.exe81⤵PID:2652
-
\??\c:\btnntt.exec:\btnntt.exe82⤵PID:2584
-
\??\c:\9jppv.exec:\9jppv.exe83⤵PID:2036
-
\??\c:\lfxflll.exec:\lfxflll.exe84⤵PID:1720
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe85⤵PID:2936
-
\??\c:\btnntt.exec:\btnntt.exe86⤵PID:2684
-
\??\c:\pdjpv.exec:\pdjpv.exe87⤵PID:264
-
\??\c:\pjvdj.exec:\pjvdj.exe88⤵PID:2076
-
\??\c:\rxfrrlr.exec:\rxfrrlr.exe89⤵PID:2648
-
\??\c:\tnhhnn.exec:\tnhhnn.exe90⤵PID:1936
-
\??\c:\bnhhbb.exec:\bnhhbb.exe91⤵PID:2836
-
\??\c:\pdjdd.exec:\pdjdd.exe92⤵PID:1524
-
\??\c:\1fllllr.exec:\1fllllr.exe93⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\9nhnnh.exec:\9nhnnh.exe94⤵PID:936
-
\??\c:\7thhnh.exec:\7thhnh.exe95⤵PID:1260
-
\??\c:\7dvdd.exec:\7dvdd.exe96⤵PID:1684
-
\??\c:\vpvdp.exec:\vpvdp.exe97⤵PID:2320
-
\??\c:\1rllrrl.exec:\1rllrrl.exe98⤵PID:2696
-
\??\c:\thbnnn.exec:\thbnnn.exe99⤵PID:2412
-
\??\c:\vpdvv.exec:\vpdvv.exe100⤵PID:1928
-
\??\c:\dpjjp.exec:\dpjjp.exe101⤵PID:2300
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe102⤵PID:2196
-
\??\c:\fxxxffl.exec:\fxxxffl.exe103⤵PID:2064
-
\??\c:\bntttb.exec:\bntttb.exe104⤵PID:1480
-
\??\c:\pjjjp.exec:\pjjjp.exe105⤵PID:1368
-
\??\c:\5fxxrxx.exec:\5fxxrxx.exe106⤵PID:444
-
\??\c:\lxffffr.exec:\lxffffr.exe107⤵PID:1944
-
\??\c:\hnhhtt.exec:\hnhhtt.exe108⤵PID:2016
-
\??\c:\dpjjv.exec:\dpjjv.exe109⤵PID:2672
-
\??\c:\vpddj.exec:\vpddj.exe110⤵PID:2532
-
\??\c:\ffxrlxl.exec:\ffxrlxl.exe111⤵PID:1736
-
\??\c:\bthbtt.exec:\bthbtt.exe112⤵PID:2112
-
\??\c:\hthnhh.exec:\hthnhh.exe113⤵PID:2356
-
\??\c:\3vjdd.exec:\3vjdd.exe114⤵PID:2120
-
\??\c:\3lxrflr.exec:\3lxrflr.exe115⤵PID:1696
-
\??\c:\7xfrrlr.exec:\7xfrrlr.exe116⤵PID:2956
-
\??\c:\nhbtbb.exec:\nhbtbb.exe117⤵PID:2856
-
\??\c:\pddjj.exec:\pddjj.exe118⤵PID:2792
-
\??\c:\7dvvv.exec:\7dvvv.exe119⤵PID:2844
-
\??\c:\ffrrflr.exec:\ffrrflr.exe120⤵PID:2304
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe121⤵PID:2620
-
\??\c:\bbntnh.exec:\bbntnh.exe122⤵PID:2608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-