Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe
-
Size
455KB
-
MD5
90cfb890ddcab038d893a0d88c8c558f
-
SHA1
9339d1e274617455a9227511cb6130f43b2364c4
-
SHA256
25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b
-
SHA512
c479f6d33afaaf47fd80f41637a1cc650c562970b24aa04b26f7ca6865e9d54cbe77d3500e768cc0f146347f1e93bada11d0aeeacab7471a94790079645b41c3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeD:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-298-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-327-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2700-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-366-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2104-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-410-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-451-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-691-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2768-718-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 hbhntt.exe 2868 lxffrrf.exe 2792 dpjvd.exe 2616 rflxffl.exe 2784 1vjdp.exe 2604 xlrffff.exe 3040 vjvpp.exe 2036 9pdpv.exe 3032 bnhntn.exe 2200 frflllx.exe 264 bthntb.exe 1432 jvdvj.exe 112 1thhnn.exe 756 3bnnnn.exe 2032 3vjjp.exe 2932 btnbhh.exe 1684 pjvjv.exe 1300 3xfflxx.exe 2572 htnntn.exe 2256 lxlfrlx.exe 1660 bnntbb.exe 2216 5jvjj.exe 1620 hbbhbb.exe 1396 pjdjv.exe 1944 xrllxlx.exe 552 5jddj.exe 3008 lxlfflr.exe 1736 nbtthh.exe 2540 ddvpd.exe 3024 5thntn.exe 2732 bnhntb.exe 1548 rfrxffl.exe 2740 dpvvp.exe 2868 9lxlrxx.exe 2452 btbtbb.exe 2088 jjjpd.exe 2700 frlxrrr.exe 2660 frlrxxf.exe 2604 hbhhnn.exe 2232 5dvdv.exe 2148 lfrrrrx.exe 2104 1nhnnb.exe 1932 hbnnnn.exe 2448 vddjp.exe 768 fxxxffl.exe 652 tnbhhn.exe 112 vdjdp.exe 2764 5ddvv.exe 2040 3lxxxrx.exe 1268 nhbthn.exe 1724 3pdpd.exe 2156 fxlrxxf.exe 1324 hbnntt.exe 2412 htnthn.exe 1972 pjjjv.exe 2268 3rxflxf.exe 1916 hbtttt.exe 664 tttbbb.exe 1516 vpjpp.exe 1620 xrlrxxf.exe 1368 tnhhnn.exe 2376 pjvpp.exe 1944 ppddj.exe 1372 xrlfllx.exe -
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-131-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/756-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-451-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1916-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-691-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3008-785-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2460 2316 25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe 30 PID 2316 wrote to memory of 2460 2316 25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe 30 PID 2316 wrote to memory of 2460 2316 25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe 30 PID 2316 wrote to memory of 2460 2316 25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe 30 PID 2460 wrote to memory of 2868 2460 hbhntt.exe 31 PID 2460 wrote to memory of 2868 2460 hbhntt.exe 31 PID 2460 wrote to memory of 2868 2460 hbhntt.exe 31 PID 2460 wrote to memory of 2868 2460 hbhntt.exe 31 PID 2868 wrote to memory of 2792 2868 lxffrrf.exe 32 PID 2868 wrote to memory of 2792 2868 lxffrrf.exe 32 PID 2868 wrote to memory of 2792 2868 lxffrrf.exe 32 PID 2868 wrote to memory of 2792 2868 lxffrrf.exe 32 PID 2792 wrote to memory of 2616 2792 dpjvd.exe 33 PID 2792 wrote to memory of 2616 2792 dpjvd.exe 33 PID 2792 wrote to memory of 2616 2792 dpjvd.exe 33 PID 2792 wrote to memory of 2616 2792 dpjvd.exe 33 PID 2616 wrote to memory of 2784 2616 rflxffl.exe 34 PID 2616 wrote to memory of 2784 2616 rflxffl.exe 34 PID 2616 wrote to memory of 2784 2616 rflxffl.exe 34 PID 2616 wrote to memory of 2784 2616 rflxffl.exe 34 PID 2784 wrote to memory of 2604 2784 1vjdp.exe 35 PID 2784 wrote to memory of 2604 2784 1vjdp.exe 35 PID 2784 wrote to memory of 2604 2784 1vjdp.exe 35 PID 2784 wrote to memory of 2604 2784 1vjdp.exe 35 PID 2604 wrote to memory of 3040 2604 xlrffff.exe 36 PID 2604 wrote to memory of 3040 2604 xlrffff.exe 36 PID 2604 wrote to memory of 3040 2604 xlrffff.exe 36 PID 2604 wrote to memory of 3040 2604 xlrffff.exe 36 PID 3040 wrote to memory of 2036 3040 vjvpp.exe 37 PID 3040 wrote to memory of 2036 3040 vjvpp.exe 37 PID 3040 wrote to memory of 2036 3040 vjvpp.exe 37 PID 3040 wrote to memory of 2036 3040 vjvpp.exe 37 PID 2036 wrote to memory of 3032 2036 9pdpv.exe 38 PID 2036 wrote to memory of 3032 2036 9pdpv.exe 38 PID 2036 wrote to memory of 3032 2036 9pdpv.exe 38 PID 2036 wrote to memory of 3032 2036 9pdpv.exe 38 PID 3032 wrote to memory of 2200 3032 bnhntn.exe 39 PID 3032 wrote to memory of 2200 3032 bnhntn.exe 39 PID 3032 wrote to memory of 2200 3032 bnhntn.exe 39 PID 3032 wrote to memory of 2200 3032 bnhntn.exe 39 PID 2200 wrote to memory of 264 2200 frflllx.exe 40 PID 2200 wrote to memory of 264 2200 frflllx.exe 40 PID 2200 wrote to memory of 264 2200 frflllx.exe 40 PID 2200 wrote to memory of 264 2200 frflllx.exe 40 PID 264 wrote to memory of 1432 264 bthntb.exe 41 PID 264 wrote to memory of 1432 264 bthntb.exe 41 PID 264 wrote to memory of 1432 264 bthntb.exe 41 PID 264 wrote to memory of 1432 264 bthntb.exe 41 PID 1432 wrote to memory of 112 1432 jvdvj.exe 42 PID 1432 wrote to memory of 112 1432 jvdvj.exe 42 PID 1432 wrote to memory of 112 1432 jvdvj.exe 42 PID 1432 wrote to memory of 112 1432 jvdvj.exe 42 PID 112 wrote to memory of 756 112 1thhnn.exe 43 PID 112 wrote to memory of 756 112 1thhnn.exe 43 PID 112 wrote to memory of 756 112 1thhnn.exe 43 PID 112 wrote to memory of 756 112 1thhnn.exe 43 PID 756 wrote to memory of 2032 756 3bnnnn.exe 44 PID 756 wrote to memory of 2032 756 3bnnnn.exe 44 PID 756 wrote to memory of 2032 756 3bnnnn.exe 44 PID 756 wrote to memory of 2032 756 3bnnnn.exe 44 PID 2032 wrote to memory of 2932 2032 3vjjp.exe 45 PID 2032 wrote to memory of 2932 2032 3vjjp.exe 45 PID 2032 wrote to memory of 2932 2032 3vjjp.exe 45 PID 2032 wrote to memory of 2932 2032 3vjjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe"C:\Users\Admin\AppData\Local\Temp\25632d1c1f3349406573c3c3ecc25ed1c9a8e79b84e45347a655200408caf24b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\hbhntt.exec:\hbhntt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\lxffrrf.exec:\lxffrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\dpjvd.exec:\dpjvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rflxffl.exec:\rflxffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1vjdp.exec:\1vjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\xlrffff.exec:\xlrffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\vjvpp.exec:\vjvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\9pdpv.exec:\9pdpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\bnhntn.exec:\bnhntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\frflllx.exec:\frflllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\bthntb.exec:\bthntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\jvdvj.exec:\jvdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1thhnn.exec:\1thhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\3bnnnn.exec:\3bnnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\3vjjp.exec:\3vjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\btnbhh.exec:\btnbhh.exe17⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvjv.exec:\pjvjv.exe18⤵
- Executes dropped EXE
PID:1684 -
\??\c:\3xfflxx.exec:\3xfflxx.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\htnntn.exec:\htnntn.exe20⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lxlfrlx.exec:\lxlfrlx.exe21⤵
- Executes dropped EXE
PID:2256 -
\??\c:\bnntbb.exec:\bnntbb.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5jvjj.exec:\5jvjj.exe23⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hbbhbb.exec:\hbbhbb.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pjdjv.exec:\pjdjv.exe25⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xrllxlx.exec:\xrllxlx.exe26⤵
- Executes dropped EXE
PID:1944 -
\??\c:\5jddj.exec:\5jddj.exe27⤵
- Executes dropped EXE
PID:552 -
\??\c:\lxlfflr.exec:\lxlfflr.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbtthh.exec:\nbtthh.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ddvpd.exec:\ddvpd.exe30⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5thntn.exec:\5thntn.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bnhntb.exec:\bnhntb.exe32⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rfrxffl.exec:\rfrxffl.exe33⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dpvvp.exec:\dpvvp.exe34⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9lxlrxx.exec:\9lxlrxx.exe35⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btbtbb.exec:\btbtbb.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jjjpd.exec:\jjjpd.exe37⤵
- Executes dropped EXE
PID:2088 -
\??\c:\frlxrrr.exec:\frlxrrr.exe38⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frlrxxf.exec:\frlrxxf.exe39⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hbhhnn.exec:\hbhhnn.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5dvdv.exec:\5dvdv.exe41⤵
- Executes dropped EXE
PID:2232 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1nhnnb.exec:\1nhnnb.exe43⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbnnnn.exec:\hbnnnn.exe44⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vddjp.exec:\vddjp.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\fxxxffl.exec:\fxxxffl.exe46⤵
- Executes dropped EXE
PID:768 -
\??\c:\tnbhhn.exec:\tnbhhn.exe47⤵
- Executes dropped EXE
PID:652 -
\??\c:\vdjdp.exec:\vdjdp.exe48⤵
- Executes dropped EXE
PID:112 -
\??\c:\5ddvv.exec:\5ddvv.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3lxxxrx.exec:\3lxxxrx.exe50⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhbthn.exec:\nhbthn.exe51⤵
- Executes dropped EXE
PID:1268 -
\??\c:\3pdpd.exec:\3pdpd.exe52⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hbnntt.exec:\hbnntt.exe54⤵
- Executes dropped EXE
PID:1324 -
\??\c:\htnthn.exec:\htnthn.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjjjv.exec:\pjjjv.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3rxflxf.exec:\3rxflxf.exe57⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hbtttt.exec:\hbtttt.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\tttbbb.exec:\tttbbb.exe59⤵
- Executes dropped EXE
PID:664 -
\??\c:\vpjpp.exec:\vpjpp.exe60⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\tnhhnn.exec:\tnhhnn.exe62⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjvpp.exec:\pjvpp.exe63⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ppddj.exec:\ppddj.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\xrlfllx.exec:\xrlfllx.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\btbhtt.exec:\btbhtt.exe66⤵PID:2052
-
\??\c:\1tntbh.exec:\1tntbh.exe67⤵PID:2132
-
\??\c:\pdppp.exec:\pdppp.exe68⤵PID:2112
-
\??\c:\rxrrxxl.exec:\rxrrxxl.exe69⤵PID:2948
-
\??\c:\hthhhh.exec:\hthhhh.exe70⤵PID:2228
-
\??\c:\5hbbnn.exec:\5hbbnn.exe71⤵PID:2692
-
\??\c:\9vvvv.exec:\9vvvv.exe72⤵PID:2860
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe73⤵PID:2720
-
\??\c:\9nbbbt.exec:\9nbbbt.exe74⤵PID:2740
-
\??\c:\htnhnn.exec:\htnhnn.exe75⤵PID:2868
-
\??\c:\pjjjj.exec:\pjjjj.exe76⤵PID:2452
-
\??\c:\lllrxxf.exec:\lllrxxf.exe77⤵PID:2636
-
\??\c:\rfllllx.exec:\rfllllx.exe78⤵PID:2640
-
\??\c:\tthhtt.exec:\tthhtt.exe79⤵PID:1700
-
\??\c:\dvjpp.exec:\dvjpp.exe80⤵PID:1948
-
\??\c:\pvvpv.exec:\pvvpv.exe81⤵PID:2928
-
\??\c:\rfllrlr.exec:\rfllrlr.exe82⤵PID:2944
-
\??\c:\9htnbb.exec:\9htnbb.exe83⤵PID:3032
-
\??\c:\5btbhh.exec:\5btbhh.exe84⤵PID:576
-
\??\c:\dvjpv.exec:\dvjpv.exe85⤵PID:1860
-
\??\c:\5lfrxxf.exec:\5lfrxxf.exe86⤵PID:2000
-
\??\c:\lxrflfr.exec:\lxrflfr.exe87⤵PID:2100
-
\??\c:\nhbhnn.exec:\nhbhnn.exe88⤵PID:824
-
\??\c:\pjdjp.exec:\pjdjp.exe89⤵PID:2656
-
\??\c:\rrllrlr.exec:\rrllrlr.exe90⤵PID:1484
-
\??\c:\bbnhnn.exec:\bbnhnn.exe91⤵PID:2892
-
\??\c:\hnnnbn.exec:\hnnnbn.exe92⤵PID:2004
-
\??\c:\dpvdd.exec:\dpvdd.exe93⤵PID:2976
-
\??\c:\vjvvd.exec:\vjvvd.exe94⤵PID:1280
-
\??\c:\xlxfllr.exec:\xlxfllr.exe95⤵PID:2768
-
\??\c:\1ttntn.exec:\1ttntn.exe96⤵PID:2272
-
\??\c:\tnhnbn.exec:\tnhnbn.exe97⤵PID:2224
-
\??\c:\vpjvv.exec:\vpjvv.exe98⤵PID:2552
-
\??\c:\lfxfffl.exec:\lfxfffl.exe99⤵PID:2992
-
\??\c:\rlxfllx.exec:\rlxfllx.exe100⤵PID:1352
-
\??\c:\nbhnbb.exec:\nbhnbb.exe101⤵PID:1784
-
\??\c:\dvpdj.exec:\dvpdj.exe102⤵PID:1388
-
\??\c:\vjdjp.exec:\vjdjp.exe103⤵PID:844
-
\??\c:\lflffff.exec:\lflffff.exe104⤵PID:1100
-
\??\c:\rfxxllr.exec:\rfxxllr.exe105⤵PID:904
-
\??\c:\nbtbhb.exec:\nbtbhb.exe106⤵PID:3008
-
\??\c:\7vjdp.exec:\7vjdp.exe107⤵PID:336
-
\??\c:\pdvvd.exec:\pdvvd.exe108⤵PID:1748
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe109⤵PID:3000
-
\??\c:\thhbhh.exec:\thhbhh.exe110⤵PID:1572
-
\??\c:\bnhhnh.exec:\bnhhnh.exe111⤵PID:2816
-
\??\c:\dvddd.exec:\dvddd.exe112⤵PID:2360
-
\??\c:\lflrxrr.exec:\lflrxrr.exe113⤵PID:2828
-
\??\c:\xrffffl.exec:\xrffffl.exe114⤵PID:2720
-
\??\c:\bnnhhb.exec:\bnnhhb.exe115⤵PID:2844
-
\??\c:\vjppp.exec:\vjppp.exe116⤵PID:2616
-
\??\c:\jdppd.exec:\jdppd.exe117⤵PID:2584
-
\??\c:\lrlxrlr.exec:\lrlxrlr.exe118⤵PID:2592
-
\??\c:\thnnhb.exec:\thnnhb.exe119⤵PID:2660
-
\??\c:\tnbhhh.exec:\tnbhhh.exe120⤵PID:3056
-
\??\c:\7pjvd.exec:\7pjvd.exe121⤵PID:2012
-
\??\c:\9dvvd.exec:\9dvvd.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-