Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe
-
Size
453KB
-
MD5
2cac169befdb02e6b0f8c9a518976570
-
SHA1
cc7a4be941eb3127a8b8ee5ac678b210288b2cd3
-
SHA256
05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aa
-
SHA512
ea73b308d2abbcd8c6a3c53f984823336fb1b7c3628189e6cf7c0716c8e0ff25588b6b42240d9c67194f170c8edde4028986a35d5bb9b01d4c1b536839f00a78
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2932-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-159-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/772-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-196-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-335-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2608-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-384-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2788-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-463-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3064-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-482-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/448-489-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1260-516-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2544-531-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-559-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1736-579-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2220-772-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-779-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2088 3hbhnt.exe 2732 btnnbb.exe 2836 bthnbb.exe 2608 jpjpv.exe 2704 hhbntt.exe 2776 7ntntt.exe 2616 7fflxlf.exe 2332 jvpvd.exe 1804 fxrxrrf.exe 2572 pvjdv.exe 2996 lrlxrxf.exe 2884 htnbnn.exe 2840 rrllxxl.exe 1788 tnnbbh.exe 1508 frfrffl.exe 1108 bnnhtn.exe 372 vjpvv.exe 772 rflrxfl.exe 1636 jvvvj.exe 2488 1frrxfx.exe 1628 bnhbhh.exe 2096 jvvvv.exe 2260 bnhhtt.exe 1392 xrxrxrf.exe 2160 hnhnnh.exe 588 pvvjd.exe 1712 hhtbhh.exe 2404 vvdjp.exe 2080 ntnhbn.exe 1668 jvdpv.exe 1516 1xlfllx.exe 2292 thtbbh.exe 2136 3xlrlxf.exe 2808 rrlrrrf.exe 2908 ppjjv.exe 2760 llxxlrf.exe 2764 nthttb.exe 2608 9hbttt.exe 2656 dvjpd.exe 2604 frrfllr.exe 2664 9nhnnn.exe 2424 ppdjv.exe 2652 5frrxxl.exe 2696 9bhhtt.exe 1860 7vvjp.exe 2788 ffxflrx.exe 2876 frlrxxx.exe 2660 7hbbbb.exe 2952 pvdjp.exe 680 lxxflrf.exe 2172 nhnhnn.exe 1980 vpddd.exe 1296 jvjdp.exe 1448 xrrrxfr.exe 2012 ntttbt.exe 2296 7dpdv.exe 320 pddvj.exe 3064 xrfllff.exe 2500 ttnhtt.exe 448 nbtntb.exe 1136 frlflff.exe 2044 flxfxll.exe 2260 nhbhbh.exe 1260 jjvdd.exe -
resource yara_rule behavioral1/memory/2932-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-779-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2088 2932 05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe 30 PID 2932 wrote to memory of 2088 2932 05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe 30 PID 2932 wrote to memory of 2088 2932 05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe 30 PID 2932 wrote to memory of 2088 2932 05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe 30 PID 2088 wrote to memory of 2732 2088 3hbhnt.exe 31 PID 2088 wrote to memory of 2732 2088 3hbhnt.exe 31 PID 2088 wrote to memory of 2732 2088 3hbhnt.exe 31 PID 2088 wrote to memory of 2732 2088 3hbhnt.exe 31 PID 2732 wrote to memory of 2836 2732 btnnbb.exe 32 PID 2732 wrote to memory of 2836 2732 btnnbb.exe 32 PID 2732 wrote to memory of 2836 2732 btnnbb.exe 32 PID 2732 wrote to memory of 2836 2732 btnnbb.exe 32 PID 2836 wrote to memory of 2608 2836 bthnbb.exe 33 PID 2836 wrote to memory of 2608 2836 bthnbb.exe 33 PID 2836 wrote to memory of 2608 2836 bthnbb.exe 33 PID 2836 wrote to memory of 2608 2836 bthnbb.exe 33 PID 2608 wrote to memory of 2704 2608 jpjpv.exe 34 PID 2608 wrote to memory of 2704 2608 jpjpv.exe 34 PID 2608 wrote to memory of 2704 2608 jpjpv.exe 34 PID 2608 wrote to memory of 2704 2608 jpjpv.exe 34 PID 2704 wrote to memory of 2776 2704 hhbntt.exe 35 PID 2704 wrote to memory of 2776 2704 hhbntt.exe 35 PID 2704 wrote to memory of 2776 2704 hhbntt.exe 35 PID 2704 wrote to memory of 2776 2704 hhbntt.exe 35 PID 2776 wrote to memory of 2616 2776 7ntntt.exe 36 PID 2776 wrote to memory of 2616 2776 7ntntt.exe 36 PID 2776 wrote to memory of 2616 2776 7ntntt.exe 36 PID 2776 wrote to memory of 2616 2776 7ntntt.exe 36 PID 2616 wrote to memory of 2332 2616 7fflxlf.exe 37 PID 2616 wrote to memory of 2332 2616 7fflxlf.exe 37 PID 2616 wrote to memory of 2332 2616 7fflxlf.exe 37 PID 2616 wrote to memory of 2332 2616 7fflxlf.exe 37 PID 2332 wrote to memory of 1804 2332 jvpvd.exe 38 PID 2332 wrote to memory of 1804 2332 jvpvd.exe 38 PID 2332 wrote to memory of 1804 2332 jvpvd.exe 38 PID 2332 wrote to memory of 1804 2332 jvpvd.exe 38 PID 1804 wrote to memory of 2572 1804 fxrxrrf.exe 39 PID 1804 wrote to memory of 2572 1804 fxrxrrf.exe 39 PID 1804 wrote to memory of 2572 1804 fxrxrrf.exe 39 PID 1804 wrote to memory of 2572 1804 fxrxrrf.exe 39 PID 2572 wrote to memory of 2996 2572 pvjdv.exe 40 PID 2572 wrote to memory of 2996 2572 pvjdv.exe 40 PID 2572 wrote to memory of 2996 2572 pvjdv.exe 40 PID 2572 wrote to memory of 2996 2572 pvjdv.exe 40 PID 2996 wrote to memory of 2884 2996 lrlxrxf.exe 41 PID 2996 wrote to memory of 2884 2996 lrlxrxf.exe 41 PID 2996 wrote to memory of 2884 2996 lrlxrxf.exe 41 PID 2996 wrote to memory of 2884 2996 lrlxrxf.exe 41 PID 2884 wrote to memory of 2840 2884 htnbnn.exe 42 PID 2884 wrote to memory of 2840 2884 htnbnn.exe 42 PID 2884 wrote to memory of 2840 2884 htnbnn.exe 42 PID 2884 wrote to memory of 2840 2884 htnbnn.exe 42 PID 2840 wrote to memory of 1788 2840 rrllxxl.exe 43 PID 2840 wrote to memory of 1788 2840 rrllxxl.exe 43 PID 2840 wrote to memory of 1788 2840 rrllxxl.exe 43 PID 2840 wrote to memory of 1788 2840 rrllxxl.exe 43 PID 1788 wrote to memory of 1508 1788 tnnbbh.exe 44 PID 1788 wrote to memory of 1508 1788 tnnbbh.exe 44 PID 1788 wrote to memory of 1508 1788 tnnbbh.exe 44 PID 1788 wrote to memory of 1508 1788 tnnbbh.exe 44 PID 1508 wrote to memory of 1108 1508 frfrffl.exe 45 PID 1508 wrote to memory of 1108 1508 frfrffl.exe 45 PID 1508 wrote to memory of 1108 1508 frfrffl.exe 45 PID 1508 wrote to memory of 1108 1508 frfrffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe"C:\Users\Admin\AppData\Local\Temp\05615e9ba5e736d79049f089a1adbd9abc433c80bd6aafad9d8c53a902ad84aaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3hbhnt.exec:\3hbhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\btnnbb.exec:\btnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bthnbb.exec:\bthnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jpjpv.exec:\jpjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\hhbntt.exec:\hhbntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7ntntt.exec:\7ntntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7fflxlf.exec:\7fflxlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jvpvd.exec:\jvpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\pvjdv.exec:\pvjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lrlxrxf.exec:\lrlxrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\htnbnn.exec:\htnbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\rrllxxl.exec:\rrllxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tnnbbh.exec:\tnnbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\frfrffl.exec:\frfrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\bnnhtn.exec:\bnnhtn.exe17⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vjpvv.exec:\vjpvv.exe18⤵
- Executes dropped EXE
PID:372 -
\??\c:\rflrxfl.exec:\rflrxfl.exe19⤵
- Executes dropped EXE
PID:772 -
\??\c:\jvvvj.exec:\jvvvj.exe20⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1frrxfx.exec:\1frrxfx.exe21⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bnhbhh.exec:\bnhbhh.exe22⤵
- Executes dropped EXE
PID:1628 -
\??\c:\jvvvv.exec:\jvvvv.exe23⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bnhhtt.exec:\bnhhtt.exe24⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrxrxrf.exec:\xrxrxrf.exe25⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hnhnnh.exec:\hnhnnh.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvvjd.exec:\pvvjd.exe27⤵
- Executes dropped EXE
PID:588 -
\??\c:\hhtbhh.exec:\hhtbhh.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvdjp.exec:\vvdjp.exe29⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ntnhbn.exec:\ntnhbn.exe30⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jvdpv.exec:\jvdpv.exe31⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1xlfllx.exec:\1xlfllx.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\thtbbh.exec:\thtbbh.exe33⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3xlrlxf.exec:\3xlrlxf.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rrlrrrf.exec:\rrlrrrf.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\ppjjv.exec:\ppjjv.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llxxlrf.exec:\llxxlrf.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nthttb.exec:\nthttb.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\9hbttt.exec:\9hbttt.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvjpd.exec:\dvjpd.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\frrfllr.exec:\frrfllr.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9nhnnn.exec:\9nhnnn.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ppdjv.exec:\ppdjv.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5frrxxl.exec:\5frrxxl.exe44⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9bhhtt.exec:\9bhhtt.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7vvjp.exec:\7vvjp.exe46⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ffxflrx.exec:\ffxflrx.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\frlrxxx.exec:\frlrxxx.exe48⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7hbbbb.exec:\7hbbbb.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pvdjp.exec:\pvdjp.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lxxflrf.exec:\lxxflrf.exe51⤵
- Executes dropped EXE
PID:680 -
\??\c:\nhnhnn.exec:\nhnhnn.exe52⤵
- Executes dropped EXE
PID:2172 -
\??\c:\vpddd.exec:\vpddd.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1980 -
\??\c:\jvjdp.exec:\jvjdp.exe54⤵
- Executes dropped EXE
PID:1296 -
\??\c:\xrrrxfr.exec:\xrrrxfr.exe55⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ntttbt.exec:\ntttbt.exe56⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7dpdv.exec:\7dpdv.exe57⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pddvj.exec:\pddvj.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\xrfllff.exec:\xrfllff.exe59⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ttnhtt.exec:\ttnhtt.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nbtntb.exec:\nbtntb.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\frlflff.exec:\frlflff.exe62⤵
- Executes dropped EXE
PID:1136 -
\??\c:\flxfxll.exec:\flxfxll.exe63⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhbhbh.exec:\nhbhbh.exe64⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jjvdd.exec:\jjvdd.exe65⤵
- Executes dropped EXE
PID:1260 -
\??\c:\3rlfflr.exec:\3rlfflr.exe66⤵PID:2428
-
\??\c:\5lfxrrx.exec:\5lfxrrx.exe67⤵PID:2544
-
\??\c:\btbntb.exec:\btbntb.exe68⤵PID:704
-
\??\c:\vjvdd.exec:\vjvdd.exe69⤵PID:1712
-
\??\c:\3lfrlrf.exec:\3lfrlrf.exe70⤵PID:844
-
\??\c:\thtntn.exec:\thtntn.exe71⤵PID:1736
-
\??\c:\pjppv.exec:\pjppv.exe72⤵PID:888
-
\??\c:\vppvv.exec:\vppvv.exe73⤵PID:1728
-
\??\c:\rlflffr.exec:\rlflffr.exe74⤵PID:1600
-
\??\c:\bbbnnh.exec:\bbbnnh.exe75⤵PID:2692
-
\??\c:\5vjdp.exec:\5vjdp.exe76⤵PID:2224
-
\??\c:\vpjjp.exec:\vpjjp.exe77⤵PID:2732
-
\??\c:\xlrlxff.exec:\xlrlxff.exe78⤵PID:2228
-
\??\c:\hhtbnn.exec:\hhtbnn.exe79⤵PID:2736
-
\??\c:\1pddd.exec:\1pddd.exe80⤵PID:2852
-
\??\c:\lfllllr.exec:\lfllllr.exe81⤵PID:2820
-
\??\c:\5tbbbh.exec:\5tbbbh.exe82⤵PID:2656
-
\??\c:\pjpdp.exec:\pjpdp.exe83⤵PID:2000
-
\??\c:\jddjv.exec:\jddjv.exe84⤵PID:2664
-
\??\c:\rxlffxx.exec:\rxlffxx.exe85⤵PID:2688
-
\??\c:\bthntt.exec:\bthntt.exe86⤵PID:2332
-
\??\c:\vvppv.exec:\vvppv.exe87⤵PID:560
-
\??\c:\rfllxxf.exec:\rfllxxf.exe88⤵PID:2252
-
\??\c:\lflrrlr.exec:\lflrrlr.exe89⤵PID:2856
-
\??\c:\htnnnt.exec:\htnnnt.exe90⤵PID:2876
-
\??\c:\vpppj.exec:\vpppj.exe91⤵PID:1068
-
\??\c:\7jdvv.exec:\7jdvv.exe92⤵PID:2952
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe93⤵PID:492
-
\??\c:\tnbhtn.exec:\tnbhtn.exe94⤵PID:1788
-
\??\c:\tnbbnn.exec:\tnbbnn.exe95⤵PID:2700
-
\??\c:\vvpvj.exec:\vvpvj.exe96⤵PID:1168
-
\??\c:\ppddj.exec:\ppddj.exe97⤵PID:1764
-
\??\c:\frfffrr.exec:\frfffrr.exe98⤵PID:372
-
\??\c:\tnbbbh.exec:\tnbbbh.exe99⤵PID:2296
-
\??\c:\vpjjv.exec:\vpjjv.exe100⤵PID:2220
-
\??\c:\vpjjd.exec:\vpjjd.exe101⤵PID:3048
-
\??\c:\xxlrllx.exec:\xxlrllx.exe102⤵PID:2148
-
\??\c:\nnbhtb.exec:\nnbhtb.exe103⤵PID:448
-
\??\c:\nnnbnt.exec:\nnnbnt.exe104⤵PID:1364
-
\??\c:\dvdjv.exec:\dvdjv.exe105⤵PID:1756
-
\??\c:\xxllxfx.exec:\xxllxfx.exe106⤵PID:1392
-
\??\c:\ntbbhb.exec:\ntbbhb.exe107⤵PID:988
-
\??\c:\7bnntt.exec:\7bnntt.exe108⤵PID:2568
-
\??\c:\pdddp.exec:\pdddp.exe109⤵PID:2416
-
\??\c:\ffrrfxl.exec:\ffrrfxl.exe110⤵PID:1612
-
\??\c:\3lflrlx.exec:\3lflrlx.exe111⤵PID:1712
-
\??\c:\tnhhbh.exec:\tnhhbh.exe112⤵PID:844
-
\??\c:\pjppp.exec:\pjppp.exe113⤵PID:2420
-
\??\c:\xrflrxl.exec:\xrflrxl.exe114⤵PID:3020
-
\??\c:\lrflxxl.exec:\lrflxxl.exe115⤵PID:1992
-
\??\c:\hbtbtt.exec:\hbtbtt.exe116⤵PID:1700
-
\??\c:\xlxflrr.exec:\xlxflrr.exe117⤵PID:2804
-
\??\c:\3tbnhn.exec:\3tbnhn.exe118⤵PID:2708
-
\??\c:\pdvdp.exec:\pdvdp.exe119⤵PID:2728
-
\??\c:\rxrxrxl.exec:\rxrxrxl.exe120⤵PID:1688
-
\??\c:\1thbht.exec:\1thbht.exe121⤵PID:2636
-
\??\c:\vpddj.exec:\vpddj.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-