Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 06:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe
-
Size
454KB
-
MD5
9ea2676640c48dd5356ec451c025f3d0
-
SHA1
a8851a78cf438f0df6ad261b4bc8d0274b4e298b
-
SHA256
d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2
-
SHA512
ebfbc4c6a75d981a1f5e77bcecd41cd06bf99af0c13e9447f266a5bee6bcc8be59ebc9d87faab60b3fe3b952dcb8ed195aae18bd428bff3d082882a8d435b256
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeh:q7Tc2NYHUrAwfMp3CDh
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-173-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2252-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-191-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1012-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-254-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1880-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-633-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2536-651-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2488-662-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2488-689-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1052-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-801-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1444 htntbh.exe 2720 pjddj.exe 2712 tnnbnn.exe 2548 dpjpp.exe 2568 lfxfrrr.exe 2564 btttbh.exe 2980 rxxlffx.exe 2336 5hnnbh.exe 2240 ffxfflr.exe 1516 bnttbt.exe 2824 vpjdd.exe 2420 1frxfxl.exe 1496 9vpvj.exe 2756 rlfxflr.exe 2972 bthhnn.exe 1816 5lrrrrr.exe 2624 tbnbth.exe 2892 pjvvv.exe 2252 ttntnb.exe 1012 pvjvp.exe 1040 1xfffff.exe 1004 tnbhtn.exe 1788 vjddp.exe 1616 rlrxffx.exe 876 dvvjj.exe 1656 xflfrxl.exe 1880 3nhnhn.exe 2392 xrxxflf.exe 1700 bbttnb.exe 1804 1jdvj.exe 2228 hnnnbh.exe 2724 7dvvj.exe 2884 tntnnh.exe 2776 htbnhb.exe 2300 3dvjp.exe 2744 lfxflrl.exe 2524 hnnhtb.exe 2540 tnbbnh.exe 2588 pvpdv.exe 1748 3frllll.exe 1820 tbtnbt.exe 2336 pvvpd.exe 2488 9fxxfrl.exe 2164 5nbtbn.exe 2820 bbbnbh.exe 2824 jppdd.exe 2332 llflxlf.exe 568 bnnbhh.exe 272 7tnnbt.exe 2864 dddpj.exe 1636 fffxrfr.exe 592 hnnnnt.exe 2668 jdvdp.exe 2500 dvdpd.exe 844 xrlrxfl.exe 1872 nttbnh.exe 2288 dvvvv.exe 2908 lrxlflx.exe 2372 hthhtt.exe 1040 9ppdp.exe 268 jpvpj.exe 980 xfxrllr.exe 1280 bthnnb.exe 1716 dvvpp.exe -
resource yara_rule behavioral1/memory/2244-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-173-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2252-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-633-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1784-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-801-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2244 wrote to memory of 1444 2244 d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe 30 PID 2244 wrote to memory of 1444 2244 d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe 30 PID 2244 wrote to memory of 1444 2244 d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe 30 PID 2244 wrote to memory of 1444 2244 d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe 30 PID 1444 wrote to memory of 2720 1444 htntbh.exe 31 PID 1444 wrote to memory of 2720 1444 htntbh.exe 31 PID 1444 wrote to memory of 2720 1444 htntbh.exe 31 PID 1444 wrote to memory of 2720 1444 htntbh.exe 31 PID 2720 wrote to memory of 2712 2720 pjddj.exe 32 PID 2720 wrote to memory of 2712 2720 pjddj.exe 32 PID 2720 wrote to memory of 2712 2720 pjddj.exe 32 PID 2720 wrote to memory of 2712 2720 pjddj.exe 32 PID 2712 wrote to memory of 2548 2712 tnnbnn.exe 33 PID 2712 wrote to memory of 2548 2712 tnnbnn.exe 33 PID 2712 wrote to memory of 2548 2712 tnnbnn.exe 33 PID 2712 wrote to memory of 2548 2712 tnnbnn.exe 33 PID 2548 wrote to memory of 2568 2548 dpjpp.exe 34 PID 2548 wrote to memory of 2568 2548 dpjpp.exe 34 PID 2548 wrote to memory of 2568 2548 dpjpp.exe 34 PID 2548 wrote to memory of 2568 2548 dpjpp.exe 34 PID 2568 wrote to memory of 2564 2568 lfxfrrr.exe 35 PID 2568 wrote to memory of 2564 2568 lfxfrrr.exe 35 PID 2568 wrote to memory of 2564 2568 lfxfrrr.exe 35 PID 2568 wrote to memory of 2564 2568 lfxfrrr.exe 35 PID 2564 wrote to memory of 2980 2564 btttbh.exe 36 PID 2564 wrote to memory of 2980 2564 btttbh.exe 36 PID 2564 wrote to memory of 2980 2564 btttbh.exe 36 PID 2564 wrote to memory of 2980 2564 btttbh.exe 36 PID 2980 wrote to memory of 2336 2980 rxxlffx.exe 37 PID 2980 wrote to memory of 2336 2980 rxxlffx.exe 37 PID 2980 wrote to memory of 2336 2980 rxxlffx.exe 37 PID 2980 wrote to memory of 2336 2980 rxxlffx.exe 37 PID 2336 wrote to memory of 2240 2336 5hnnbh.exe 38 PID 2336 wrote to memory of 2240 2336 5hnnbh.exe 38 PID 2336 wrote to memory of 2240 2336 5hnnbh.exe 38 PID 2336 wrote to memory of 2240 2336 5hnnbh.exe 38 PID 2240 wrote to memory of 1516 2240 ffxfflr.exe 39 PID 2240 wrote to memory of 1516 2240 ffxfflr.exe 39 PID 2240 wrote to memory of 1516 2240 ffxfflr.exe 39 PID 2240 wrote to memory of 1516 2240 ffxfflr.exe 39 PID 1516 wrote to memory of 2824 1516 bnttbt.exe 40 PID 1516 wrote to memory of 2824 1516 bnttbt.exe 40 PID 1516 wrote to memory of 2824 1516 bnttbt.exe 40 PID 1516 wrote to memory of 2824 1516 bnttbt.exe 40 PID 2824 wrote to memory of 2420 2824 vpjdd.exe 41 PID 2824 wrote to memory of 2420 2824 vpjdd.exe 41 PID 2824 wrote to memory of 2420 2824 vpjdd.exe 41 PID 2824 wrote to memory of 2420 2824 vpjdd.exe 41 PID 2420 wrote to memory of 1496 2420 1frxfxl.exe 42 PID 2420 wrote to memory of 1496 2420 1frxfxl.exe 42 PID 2420 wrote to memory of 1496 2420 1frxfxl.exe 42 PID 2420 wrote to memory of 1496 2420 1frxfxl.exe 42 PID 1496 wrote to memory of 2756 1496 9vpvj.exe 43 PID 1496 wrote to memory of 2756 1496 9vpvj.exe 43 PID 1496 wrote to memory of 2756 1496 9vpvj.exe 43 PID 1496 wrote to memory of 2756 1496 9vpvj.exe 43 PID 2756 wrote to memory of 2972 2756 rlfxflr.exe 44 PID 2756 wrote to memory of 2972 2756 rlfxflr.exe 44 PID 2756 wrote to memory of 2972 2756 rlfxflr.exe 44 PID 2756 wrote to memory of 2972 2756 rlfxflr.exe 44 PID 2972 wrote to memory of 1816 2972 bthhnn.exe 45 PID 2972 wrote to memory of 1816 2972 bthhnn.exe 45 PID 2972 wrote to memory of 1816 2972 bthhnn.exe 45 PID 2972 wrote to memory of 1816 2972 bthhnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe"C:\Users\Admin\AppData\Local\Temp\d25911b4c69098a91d65895d460246309b9e39c547260336dee6ac17a1c9e3e2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\htntbh.exec:\htntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\pjddj.exec:\pjddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnnbnn.exec:\tnnbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\dpjpp.exec:\dpjpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\btttbh.exec:\btttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rxxlffx.exec:\rxxlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5hnnbh.exec:\5hnnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ffxfflr.exec:\ffxfflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bnttbt.exec:\bnttbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\vpjdd.exec:\vpjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\1frxfxl.exec:\1frxfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\9vpvj.exec:\9vpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\rlfxflr.exec:\rlfxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bthhnn.exec:\bthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\5lrrrrr.exec:\5lrrrrr.exe17⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tbnbth.exec:\tbnbth.exe18⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvvv.exec:\pjvvv.exe19⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ttntnb.exec:\ttntnb.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pvjvp.exec:\pvjvp.exe21⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1xfffff.exec:\1xfffff.exe22⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tnbhtn.exec:\tnbhtn.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vjddp.exec:\vjddp.exe24⤵
- Executes dropped EXE
PID:1788 -
\??\c:\rlrxffx.exec:\rlrxffx.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvvjj.exec:\dvvjj.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\xflfrxl.exec:\xflfrxl.exe27⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3nhnhn.exec:\3nhnhn.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xrxxflf.exec:\xrxxflf.exe29⤵
- Executes dropped EXE
PID:2392 -
\??\c:\bbttnb.exec:\bbttnb.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1jdvj.exec:\1jdvj.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\hnnnbh.exec:\hnnnbh.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7dvvj.exec:\7dvvj.exe33⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tntnnh.exec:\tntnnh.exe34⤵
- Executes dropped EXE
PID:2884 -
\??\c:\htbnhb.exec:\htbnhb.exe35⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3dvjp.exec:\3dvjp.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\lfxflrl.exec:\lfxflrl.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hnnhtb.exec:\hnnhtb.exe38⤵
- Executes dropped EXE
PID:2524 -
\??\c:\tnbbnh.exec:\tnbbnh.exe39⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pvpdv.exec:\pvpdv.exe40⤵
- Executes dropped EXE
PID:2588 -
\??\c:\3frllll.exec:\3frllll.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\tbtnbt.exec:\tbtnbt.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pvvpd.exec:\pvvpd.exe43⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9fxxfrl.exec:\9fxxfrl.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5nbtbn.exec:\5nbtbn.exe45⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bbbnbh.exec:\bbbnbh.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jppdd.exec:\jppdd.exe47⤵
- Executes dropped EXE
PID:2824 -
\??\c:\llflxlf.exec:\llflxlf.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bnnbhh.exec:\bnnbhh.exe49⤵
- Executes dropped EXE
PID:568 -
\??\c:\7tnnbt.exec:\7tnnbt.exe50⤵
- Executes dropped EXE
PID:272 -
\??\c:\dddpj.exec:\dddpj.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fffxrfr.exec:\fffxrfr.exe52⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hnnnnt.exec:\hnnnnt.exe53⤵
- Executes dropped EXE
PID:592 -
\??\c:\jdvdp.exec:\jdvdp.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dvdpd.exec:\dvdpd.exe55⤵
- Executes dropped EXE
PID:2500 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe56⤵
- Executes dropped EXE
PID:844 -
\??\c:\nttbnh.exec:\nttbnh.exe57⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvvvv.exec:\dvvvv.exe58⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lrxlflx.exec:\lrxlflx.exe59⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hthhtt.exec:\hthhtt.exe60⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9ppdp.exec:\9ppdp.exe61⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jpvpj.exec:\jpvpj.exe62⤵
- Executes dropped EXE
PID:268 -
\??\c:\xfxrllr.exec:\xfxrllr.exe63⤵
- Executes dropped EXE
PID:980 -
\??\c:\bthnnb.exec:\bthnnb.exe64⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dvvpp.exec:\dvvpp.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe66⤵PID:2440
-
\??\c:\tbnnbn.exec:\tbnnbn.exe67⤵PID:552
-
\??\c:\pjpvd.exec:\pjpvd.exe68⤵PID:2112
-
\??\c:\rlrrxrx.exec:\rlrrxrx.exe69⤵PID:2428
-
\??\c:\9hhnth.exec:\9hhnth.exe70⤵PID:1692
-
\??\c:\tnnbhn.exec:\tnnbhn.exe71⤵PID:1392
-
\??\c:\djdpd.exec:\djdpd.exe72⤵PID:896
-
\??\c:\1rfrrfr.exec:\1rfrrfr.exe73⤵PID:1804
-
\??\c:\9hhtbn.exec:\9hhtbn.exe74⤵PID:1640
-
\??\c:\7nhnbh.exec:\7nhnbh.exe75⤵PID:2752
-
\??\c:\vpdpp.exec:\vpdpp.exe76⤵PID:2792
-
\??\c:\7lflrxl.exec:\7lflrxl.exe77⤵PID:2656
-
\??\c:\9fxxllr.exec:\9fxxllr.exe78⤵PID:2556
-
\??\c:\hbnnbb.exec:\hbnnbb.exe79⤵PID:2548
-
\??\c:\ppjjv.exec:\ppjjv.exe80⤵PID:2568
-
\??\c:\frrxrxx.exec:\frrxrxx.exe81⤵PID:2536
-
\??\c:\5hbhtb.exec:\5hbhtb.exe82⤵PID:2572
-
\??\c:\hbtbnt.exec:\hbtbnt.exe83⤵PID:2980
-
\??\c:\jdvdp.exec:\jdvdp.exe84⤵PID:1764
-
\??\c:\7xrxlrf.exec:\7xrxlrf.exe85⤵PID:2240
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe86⤵PID:2488
-
\??\c:\1tnnbb.exec:\1tnnbb.exe87⤵PID:2164
-
\??\c:\jjjpd.exec:\jjjpd.exe88⤵PID:1740
-
\??\c:\pvpdp.exec:\pvpdp.exe89⤵PID:2824
-
\??\c:\xrflrxf.exec:\xrflrxf.exe90⤵PID:1496
-
\??\c:\nnnnht.exec:\nnnnht.exe91⤵PID:1104
-
\??\c:\dvpdv.exec:\dvpdv.exe92⤵PID:272
-
\??\c:\3jvjj.exec:\3jvjj.exe93⤵PID:2864
-
\??\c:\flflflx.exec:\flflflx.exe94⤵PID:1052
-
\??\c:\tnnnhn.exec:\tnnnhn.exe95⤵PID:1920
-
\??\c:\djvjd.exec:\djvjd.exe96⤵PID:1784
-
\??\c:\vppvj.exec:\vppvj.exe97⤵PID:2396
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe98⤵PID:844
-
\??\c:\nnnnbh.exec:\nnnnbh.exe99⤵PID:2892
-
\??\c:\5vvjv.exec:\5vvjv.exe100⤵PID:1096
-
\??\c:\fxrflxf.exec:\fxrflxf.exe101⤵PID:2032
-
\??\c:\xrflrrl.exec:\xrflrrl.exe102⤵PID:1776
-
\??\c:\7httbn.exec:\7httbn.exe103⤵PID:1004
-
\??\c:\vddjd.exec:\vddjd.exe104⤵PID:2620
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe105⤵PID:1316
-
\??\c:\rrfrxxl.exec:\rrfrxxl.exe106⤵PID:1940
-
\??\c:\hbnthn.exec:\hbnthn.exe107⤵PID:876
-
\??\c:\vvjvj.exec:\vvjvj.exe108⤵PID:2120
-
\??\c:\fxffrxf.exec:\fxffrxf.exe109⤵PID:1680
-
\??\c:\htntbb.exec:\htntbb.exe110⤵PID:2324
-
\??\c:\1tnthh.exec:\1tnthh.exe111⤵PID:2308
-
\??\c:\vddjv.exec:\vddjv.exe112⤵PID:660
-
\??\c:\llflffr.exec:\llflffr.exe113⤵PID:1392
-
\??\c:\ffflxfr.exec:\ffflxfr.exe114⤵PID:1628
-
\??\c:\nnnbbt.exec:\nnnbbt.exe115⤵PID:1588
-
\??\c:\vpjpj.exec:\vpjpj.exe116⤵PID:2732
-
\??\c:\ppjpd.exec:\ppjpd.exe117⤵PID:2764
-
\??\c:\rrllxfr.exec:\rrllxfr.exe118⤵PID:2792
-
\??\c:\ntntbn.exec:\ntntbn.exe119⤵PID:2300
-
\??\c:\ppdjj.exec:\ppdjj.exe120⤵PID:2528
-
\??\c:\9hhbth.exec:\9hhbth.exe121⤵PID:2596
-
\??\c:\tnhhtb.exec:\tnhhtb.exe122⤵PID:2552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-