Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe
-
Size
456KB
-
MD5
c8e9da04487de43cd92ef3afc0a5573a
-
SHA1
917dffbce31082a5a4b9379adf27598bf2e0d805
-
SHA256
1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8
-
SHA512
052659d83daef2199e58adfb66aa01cfa74702872eac2a612cec51fc15df7174137169f4e405a6aa8985c724845349c5afb56bad14859a32a850d93060a14260
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2628-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2176-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/996-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-623-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-652-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-697-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2952-712-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-881-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 fxlrrxl.exe 2660 thhhth.exe 2828 9pppv.exe 2800 1lflllx.exe 2988 nnbtbt.exe 2568 dpjpd.exe 2544 tnbtnn.exe 2284 7jppv.exe 2276 lxrrxxx.exe 1740 7fxrlff.exe 2176 ffrfflx.exe 1812 bnthbn.exe 996 3jvdj.exe 2884 pjvvd.exe 548 dvpvj.exe 3068 1xlxlll.exe 2604 bnttnh.exe 536 dvdpd.exe 2168 nhtbhn.exe 2184 jdppp.exe 2644 3nnnnh.exe 696 1vdjp.exe 352 3xrlxxf.exe 860 thnnbb.exe 2376 rrfrlxr.exe 1776 7hbbbb.exe 1300 1pvvd.exe 572 9fxrlrl.exe 1316 1nbhhh.exe 1744 1vdvp.exe 1184 rflrxrr.exe 1756 dvdjp.exe 2728 5lrrffl.exe 1584 fxrxxxl.exe 2680 tbnhtt.exe 2832 dpdjp.exe 1996 vpdjp.exe 2820 xxrflfl.exe 1164 nhnhtn.exe 2912 vpdjv.exe 2664 jvppp.exe 2576 rxllllr.exe 2612 bthnbb.exe 1824 dvdvv.exe 2400 pdvpv.exe 1616 xllfxxx.exe 2140 nhnthn.exe 2636 thtttb.exe 2784 pjppp.exe 1816 rfrlllr.exe 996 xrrxffl.exe 2616 bthbhb.exe 548 bhbhnn.exe 2232 vjvvj.exe 1676 fflxrfx.exe 1864 3hnhhn.exe 1480 nbnhnh.exe 2136 pdppp.exe 2172 xxlrxfl.exe 2060 nbbbbt.exe 2644 tntbtn.exe 696 9jvjd.exe 1600 fxxflfr.exe 904 fxlrxxf.exe -
resource yara_rule behavioral1/memory/2628-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-126-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/548-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1164-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-759-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-881-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2888-922-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2856 2628 1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe 31 PID 2628 wrote to memory of 2856 2628 1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe 31 PID 2628 wrote to memory of 2856 2628 1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe 31 PID 2628 wrote to memory of 2856 2628 1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe 31 PID 2856 wrote to memory of 2660 2856 fxlrrxl.exe 32 PID 2856 wrote to memory of 2660 2856 fxlrrxl.exe 32 PID 2856 wrote to memory of 2660 2856 fxlrrxl.exe 32 PID 2856 wrote to memory of 2660 2856 fxlrrxl.exe 32 PID 2660 wrote to memory of 2828 2660 thhhth.exe 33 PID 2660 wrote to memory of 2828 2660 thhhth.exe 33 PID 2660 wrote to memory of 2828 2660 thhhth.exe 33 PID 2660 wrote to memory of 2828 2660 thhhth.exe 33 PID 2828 wrote to memory of 2800 2828 9pppv.exe 34 PID 2828 wrote to memory of 2800 2828 9pppv.exe 34 PID 2828 wrote to memory of 2800 2828 9pppv.exe 34 PID 2828 wrote to memory of 2800 2828 9pppv.exe 34 PID 2800 wrote to memory of 2988 2800 1lflllx.exe 35 PID 2800 wrote to memory of 2988 2800 1lflllx.exe 35 PID 2800 wrote to memory of 2988 2800 1lflllx.exe 35 PID 2800 wrote to memory of 2988 2800 1lflllx.exe 35 PID 2988 wrote to memory of 2568 2988 nnbtbt.exe 36 PID 2988 wrote to memory of 2568 2988 nnbtbt.exe 36 PID 2988 wrote to memory of 2568 2988 nnbtbt.exe 36 PID 2988 wrote to memory of 2568 2988 nnbtbt.exe 36 PID 2568 wrote to memory of 2544 2568 dpjpd.exe 37 PID 2568 wrote to memory of 2544 2568 dpjpd.exe 37 PID 2568 wrote to memory of 2544 2568 dpjpd.exe 37 PID 2568 wrote to memory of 2544 2568 dpjpd.exe 37 PID 2544 wrote to memory of 2284 2544 tnbtnn.exe 38 PID 2544 wrote to memory of 2284 2544 tnbtnn.exe 38 PID 2544 wrote to memory of 2284 2544 tnbtnn.exe 38 PID 2544 wrote to memory of 2284 2544 tnbtnn.exe 38 PID 2284 wrote to memory of 2276 2284 7jppv.exe 39 PID 2284 wrote to memory of 2276 2284 7jppv.exe 39 PID 2284 wrote to memory of 2276 2284 7jppv.exe 39 PID 2284 wrote to memory of 2276 2284 7jppv.exe 39 PID 2276 wrote to memory of 1740 2276 lxrrxxx.exe 40 PID 2276 wrote to memory of 1740 2276 lxrrxxx.exe 40 PID 2276 wrote to memory of 1740 2276 lxrrxxx.exe 40 PID 2276 wrote to memory of 1740 2276 lxrrxxx.exe 40 PID 1740 wrote to memory of 2176 1740 7fxrlff.exe 41 PID 1740 wrote to memory of 2176 1740 7fxrlff.exe 41 PID 1740 wrote to memory of 2176 1740 7fxrlff.exe 41 PID 1740 wrote to memory of 2176 1740 7fxrlff.exe 41 PID 2176 wrote to memory of 1812 2176 ffrfflx.exe 42 PID 2176 wrote to memory of 1812 2176 ffrfflx.exe 42 PID 2176 wrote to memory of 1812 2176 ffrfflx.exe 42 PID 2176 wrote to memory of 1812 2176 ffrfflx.exe 42 PID 1812 wrote to memory of 996 1812 bnthbn.exe 43 PID 1812 wrote to memory of 996 1812 bnthbn.exe 43 PID 1812 wrote to memory of 996 1812 bnthbn.exe 43 PID 1812 wrote to memory of 996 1812 bnthbn.exe 43 PID 996 wrote to memory of 2884 996 3jvdj.exe 44 PID 996 wrote to memory of 2884 996 3jvdj.exe 44 PID 996 wrote to memory of 2884 996 3jvdj.exe 44 PID 996 wrote to memory of 2884 996 3jvdj.exe 44 PID 2884 wrote to memory of 548 2884 pjvvd.exe 45 PID 2884 wrote to memory of 548 2884 pjvvd.exe 45 PID 2884 wrote to memory of 548 2884 pjvvd.exe 45 PID 2884 wrote to memory of 548 2884 pjvvd.exe 45 PID 548 wrote to memory of 3068 548 dvpvj.exe 46 PID 548 wrote to memory of 3068 548 dvpvj.exe 46 PID 548 wrote to memory of 3068 548 dvpvj.exe 46 PID 548 wrote to memory of 3068 548 dvpvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe"C:\Users\Admin\AppData\Local\Temp\1fc546e2921566b68c669bbc16ac718d37d0fabee83f906555f1f5979e639eb8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\fxlrrxl.exec:\fxlrrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\thhhth.exec:\thhhth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\9pppv.exec:\9pppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1lflllx.exec:\1lflllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nnbtbt.exec:\nnbtbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\dpjpd.exec:\dpjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tnbtnn.exec:\tnbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7jppv.exec:\7jppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\7fxrlff.exec:\7fxrlff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ffrfflx.exec:\ffrfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\bnthbn.exec:\bnthbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\3jvdj.exec:\3jvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\dvpvj.exec:\dvpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\1xlxlll.exec:\1xlxlll.exe17⤵
- Executes dropped EXE
PID:3068 -
\??\c:\bnttnh.exec:\bnttnh.exe18⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvdpd.exec:\dvdpd.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhtbhn.exec:\nhtbhn.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdppp.exec:\jdppp.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3nnnnh.exec:\3nnnnh.exe22⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1vdjp.exec:\1vdjp.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\3xrlxxf.exec:\3xrlxxf.exe24⤵
- Executes dropped EXE
PID:352 -
\??\c:\thnnbb.exec:\thnnbb.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7hbbbb.exec:\7hbbbb.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1pvvd.exec:\1pvvd.exe28⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9fxrlrl.exec:\9fxrlrl.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\1nbhhh.exec:\1nbhhh.exe30⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1vdvp.exec:\1vdvp.exe31⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rflrxrr.exec:\rflrxrr.exe32⤵
- Executes dropped EXE
PID:1184 -
\??\c:\dvdjp.exec:\dvdjp.exe33⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5lrrffl.exec:\5lrrffl.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tbnhtt.exec:\tbnhtt.exe36⤵
- Executes dropped EXE
PID:2680 -
\??\c:\dpdjp.exec:\dpdjp.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpdjp.exec:\vpdjp.exe38⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xxrflfl.exec:\xxrflfl.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nhnhtn.exec:\nhnhtn.exe40⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vpdjv.exec:\vpdjv.exe41⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jvppp.exec:\jvppp.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rxllllr.exec:\rxllllr.exe43⤵
- Executes dropped EXE
PID:2576 -
\??\c:\bthnbb.exec:\bthnbb.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvdvv.exec:\dvdvv.exe45⤵
- Executes dropped EXE
PID:1824 -
\??\c:\pdvpv.exec:\pdvpv.exe46⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xllfxxx.exec:\xllfxxx.exe47⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhnthn.exec:\nhnthn.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\thtttb.exec:\thtttb.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjppp.exec:\pjppp.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rfrlllr.exec:\rfrlllr.exe51⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xrrxffl.exec:\xrrxffl.exe52⤵
- Executes dropped EXE
PID:996 -
\??\c:\bthbhb.exec:\bthbhb.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bhbhnn.exec:\bhbhnn.exe54⤵
- Executes dropped EXE
PID:548 -
\??\c:\vjvvj.exec:\vjvvj.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2232 -
\??\c:\fflxrfx.exec:\fflxrfx.exe56⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3hnhhn.exec:\3hnhhn.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbnhnh.exec:\nbnhnh.exe58⤵
- Executes dropped EXE
PID:1480 -
\??\c:\pdppp.exec:\pdppp.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nbbbbt.exec:\nbbbbt.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\tntbtn.exec:\tntbtn.exe62⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9jvjd.exec:\9jvjd.exe63⤵
- Executes dropped EXE
PID:696 -
\??\c:\fxxflfr.exec:\fxxflfr.exe64⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\bthntn.exec:\bthntn.exe66⤵PID:1032
-
\??\c:\jvjdd.exec:\jvjdd.exe67⤵PID:1544
-
\??\c:\dvdjj.exec:\dvdjj.exe68⤵PID:1168
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe69⤵PID:2032
-
\??\c:\3ntnhh.exec:\3ntnhh.exe70⤵PID:1300
-
\??\c:\dvjjv.exec:\dvjjv.exe71⤵PID:1700
-
\??\c:\5vpjj.exec:\5vpjj.exe72⤵PID:1920
-
\??\c:\xlxffff.exec:\xlxffff.exe73⤵PID:1060
-
\??\c:\bbnhhh.exec:\bbnhhh.exe74⤵PID:1916
-
\??\c:\dppvp.exec:\dppvp.exe75⤵PID:2428
-
\??\c:\pjvpj.exec:\pjvpj.exe76⤵PID:1592
-
\??\c:\1lrrxxf.exec:\1lrrxxf.exe77⤵PID:2728
-
\??\c:\lfxxffl.exec:\lfxxffl.exe78⤵PID:2700
-
\??\c:\nbnhnt.exec:\nbnhnt.exe79⤵PID:2808
-
\??\c:\5vpvd.exec:\5vpvd.exe80⤵PID:2852
-
\??\c:\llxlrrf.exec:\llxlrrf.exe81⤵PID:1996
-
\??\c:\9lxxfxx.exec:\9lxxfxx.exe82⤵PID:2756
-
\??\c:\nbhntt.exec:\nbhntt.exe83⤵PID:2668
-
\??\c:\5dppp.exec:\5dppp.exe84⤵PID:2560
-
\??\c:\fxlflfl.exec:\fxlflfl.exe85⤵PID:2084
-
\??\c:\lfxxffl.exec:\lfxxffl.exe86⤵PID:2600
-
\??\c:\3bnnnn.exec:\3bnnnn.exe87⤵PID:1876
-
\??\c:\jjvjp.exec:\jjvjp.exe88⤵PID:1804
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe89⤵PID:1616
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe90⤵PID:2140
-
\??\c:\5thntb.exec:\5thntb.exe91⤵PID:2636
-
\??\c:\thhbbb.exec:\thhbbb.exe92⤵PID:2532
-
\??\c:\dddjv.exec:\dddjv.exe93⤵PID:2772
-
\??\c:\rlfrxxf.exec:\rlfrxxf.exe94⤵PID:2920
-
\??\c:\1lxxfxx.exec:\1lxxfxx.exe95⤵PID:2952
-
\??\c:\tnhnnn.exec:\tnhnnn.exe96⤵PID:2956
-
\??\c:\1jjpd.exec:\1jjpd.exe97⤵PID:2924
-
\??\c:\frflrll.exec:\frflrll.exe98⤵PID:1676
-
\??\c:\frlflff.exec:\frlflff.exe99⤵PID:1992
-
\??\c:\3tnnbb.exec:\3tnnbb.exe100⤵PID:2528
-
\??\c:\pjddd.exec:\pjddd.exe101⤵PID:448
-
\??\c:\jjvjd.exec:\jjvjd.exe102⤵PID:600
-
\??\c:\5rffffr.exec:\5rffffr.exe103⤵PID:2472
-
\??\c:\9rrfxxr.exec:\9rrfxxr.exe104⤵PID:2644
-
\??\c:\1nbhnn.exec:\1nbhnn.exe105⤵PID:1356
-
\??\c:\5dppp.exec:\5dppp.exe106⤵PID:2344
-
\??\c:\dpddp.exec:\dpddp.exe107⤵PID:904
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe108⤵PID:1032
-
\??\c:\bbtbhn.exec:\bbtbhn.exe109⤵PID:1732
-
\??\c:\tnhnhn.exec:\tnhnhn.exe110⤵PID:2028
-
\??\c:\7jppv.exec:\7jppv.exe111⤵PID:2732
-
\??\c:\fxrxllx.exec:\fxrxllx.exe112⤵PID:1208
-
\??\c:\7fxflrf.exec:\7fxflrf.exe113⤵PID:1780
-
\??\c:\hbtbnn.exec:\hbtbnn.exe114⤵PID:2004
-
\??\c:\3jdvd.exec:\3jdvd.exe115⤵PID:1596
-
\??\c:\dvpdp.exec:\dvpdp.exe116⤵PID:1520
-
\??\c:\rlxxffr.exec:\rlxxffr.exe117⤵PID:1580
-
\??\c:\xrflxrf.exec:\xrflxrf.exe118⤵PID:2456
-
\??\c:\tnhtbb.exec:\tnhtbb.exe119⤵PID:2856
-
\??\c:\dvpvp.exec:\dvpvp.exe120⤵PID:2300
-
\??\c:\jjppd.exec:\jjppd.exe121⤵PID:2804
-
\??\c:\1xflrlr.exec:\1xflrlr.exe122⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-