Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 21:56
Behavioral task
behavioral1
Sample
45ad4a225521a820122f30c93a1a1880_NEIKI.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
-
Target
45ad4a225521a820122f30c93a1a1880_NEIKI.exe
-
Size
441KB
-
MD5
45ad4a225521a820122f30c93a1a1880
-
SHA1
a25c29353069b78a00d308fdf17f8f0ecd2f5d82
-
SHA256
8eb76559650e76d1019b09d77bf25267d9677410a14bb61ec31c30931e85b331
-
SHA512
d757b16f9abfc5a1ed3cdec65f3dfc177f897a2f953253cf6ea26908ead990156175a965703439db0837242705a729fe531d5c81c591e69282c7588fe5232238
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wlu3:UrR/nPW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4364-7-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2332-8-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2332-13-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2944-18-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3848-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2480-26-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2480-33-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3200-125-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1156-222-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3168-259-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3456-337-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3820-390-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2380-506-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3544-512-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2852-515-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4636-502-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1420-499-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1008-494-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3572-491-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3988-486-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4620-483-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4392-480-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4972-476-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3836-470-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3516-467-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3748-464-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2064-460-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2988-453-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4668-451-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4332-445-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4420-439-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4804-428-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/440-416-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3744-412-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1608-409-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2748-406-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4424-396-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2800-387-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3884-382-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1552-379-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1400-376-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4204-367-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1920-364-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3800-358-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2052-349-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2328-344-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1428-325-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1472-320-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1644-314-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2988-301-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1812-292-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/780-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1248-283-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2676-278-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2480-274-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4944-268-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2868-265-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/876-253-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4364-247-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4304-239-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4148-236-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1716-230-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4388-226-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5036-215-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2332 flllflf.exe 2944 hbhbtt.exe 3848 tnhbbt.exe 2480 llrrrxf.exe 4848 ddvdj.exe 1680 ffffxrx.exe 2452 ttbbhh.exe 3956 jvdvv.exe 1296 rlxxxxl.exe 1812 lllfrlf.exe 4460 nhnhbt.exe 3920 jvdvd.exe 4672 dvjdp.exe 2252 1lfrfrl.exe 3316 ntbtnn.exe 1068 pjjdv.exe 5056 jdvpj.exe 3200 xfffrfl.exe 3844 tnbtbb.exe 8 5bbtnh.exe 2852 pdjdp.exe 3988 xllffrf.exe 4580 bbhbnn.exe 3572 3ntbbb.exe 5040 9vdvp.exe 4488 frrlfxr.exe 2148 hhttnt.exe 4324 nbhnhh.exe 3556 3pjdv.exe 2528 rrrlfxx.exe 2648 rrxxlff.exe 2432 9tttth.exe 1904 pppjd.exe 1088 llfxrlx.exe 5036 btbtnb.exe 4940 dvvpp.exe 1156 dvvjd.exe 2800 fxlfrrf.exe 4388 tbnnnn.exe 1716 jjpjd.exe 4148 rflxxrr.exe 4304 hnhhbh.exe 4244 vppdv.exe 4364 flrllll.exe 4428 tthbnn.exe 876 nbhbth.exe 3168 vpjjv.exe 5004 3llfxxx.exe 2868 3hnhhb.exe 4944 9tnttt.exe 2480 pppjj.exe 2676 xxfllfx.exe 3948 5rfrfff.exe 1248 htbtnn.exe 780 pjdvj.exe 1812 9fxxrrl.exe 1584 3bhbnn.exe 4668 btnhhh.exe 2988 3jpvv.exe 4652 3xxrllf.exe 3748 7ttnhh.exe 2620 ntbttt.exe 1644 1pvpj.exe 1472 frfxxff.exe -
resource yara_rule behavioral2/memory/4364-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4364-7-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000c000000023b3d-3.dat upx behavioral2/memory/2332-8-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000b000000023b9d-10.dat upx behavioral2/memory/2332-13-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2944-11-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a000000023ba1-15.dat upx behavioral2/memory/2944-18-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3848-20-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a000000023ba2-24.dat upx behavioral2/memory/3848-28-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2480-26-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a000000023ba3-32.dat upx behavioral2/memory/2480-33-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4848-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a000000023ba5-39.dat upx behavioral2/memory/1680-40-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000a000000023ba7-52.dat upx behavioral2/files/0x000a000000023ba8-58.dat upx behavioral2/files/0x000a000000023ba9-64.dat upx behavioral2/files/0x000a000000023bad-88.dat upx behavioral2/files/0x000a000000023baf-100.dat upx behavioral2/files/0x000a000000023bb1-112.dat upx behavioral2/memory/3200-125-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1156-222-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3168-259-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3456-337-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3820-390-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2380-506-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3544-512-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2852-515-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4636-502-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1420-499-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1008-494-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3572-491-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3988-486-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4620-483-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4392-480-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4972-476-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3836-470-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3516-467-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3748-464-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2064-460-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2988-453-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4668-451-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4332-445-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4420-439-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4804-428-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/440-416-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3744-412-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1608-409-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2748-406-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4424-396-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2800-387-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3884-382-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1552-379-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1400-376-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4204-367-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1920-364-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3800-358-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2052-349-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2328-344-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1428-325-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 2332 4364 45ad4a225521a820122f30c93a1a1880_NEIKI.exe 84 PID 4364 wrote to memory of 2332 4364 45ad4a225521a820122f30c93a1a1880_NEIKI.exe 84 PID 4364 wrote to memory of 2332 4364 45ad4a225521a820122f30c93a1a1880_NEIKI.exe 84 PID 2332 wrote to memory of 2944 2332 flllflf.exe 85 PID 2332 wrote to memory of 2944 2332 flllflf.exe 85 PID 2332 wrote to memory of 2944 2332 flllflf.exe 85 PID 2944 wrote to memory of 3848 2944 hbhbtt.exe 86 PID 2944 wrote to memory of 3848 2944 hbhbtt.exe 86 PID 2944 wrote to memory of 3848 2944 hbhbtt.exe 86 PID 3848 wrote to memory of 2480 3848 tnhbbt.exe 135 PID 3848 wrote to memory of 2480 3848 tnhbbt.exe 135 PID 3848 wrote to memory of 2480 3848 tnhbbt.exe 135 PID 2480 wrote to memory of 4848 2480 llrrrxf.exe 88 PID 2480 wrote to memory of 4848 2480 llrrrxf.exe 88 PID 2480 wrote to memory of 4848 2480 llrrrxf.exe 88 PID 4848 wrote to memory of 1680 4848 ddvdj.exe 90 PID 4848 wrote to memory of 1680 4848 ddvdj.exe 90 PID 4848 wrote to memory of 1680 4848 ddvdj.exe 90 PID 1680 wrote to memory of 2452 1680 ffffxrx.exe 91 PID 1680 wrote to memory of 2452 1680 ffffxrx.exe 91 PID 1680 wrote to memory of 2452 1680 ffffxrx.exe 91 PID 2452 wrote to memory of 3956 2452 ttbbhh.exe 92 PID 2452 wrote to memory of 3956 2452 ttbbhh.exe 92 PID 2452 wrote to memory of 3956 2452 ttbbhh.exe 92 PID 3956 wrote to memory of 1296 3956 jvdvv.exe 93 PID 3956 wrote to memory of 1296 3956 jvdvv.exe 93 PID 3956 wrote to memory of 1296 3956 jvdvv.exe 93 PID 1296 wrote to memory of 1812 1296 rlxxxxl.exe 94 PID 1296 wrote to memory of 1812 1296 rlxxxxl.exe 94 PID 1296 wrote to memory of 1812 1296 rlxxxxl.exe 94 PID 1812 wrote to memory of 4460 1812 lllfrlf.exe 95 PID 1812 wrote to memory of 4460 1812 lllfrlf.exe 95 PID 1812 wrote to memory of 4460 1812 lllfrlf.exe 95 PID 4460 wrote to memory of 3920 4460 nhnhbt.exe 96 PID 4460 wrote to memory of 3920 4460 nhnhbt.exe 96 PID 4460 wrote to memory of 3920 4460 nhnhbt.exe 96 PID 3920 wrote to memory of 4672 3920 jvdvd.exe 97 PID 3920 wrote to memory of 4672 3920 jvdvd.exe 97 PID 3920 wrote to memory of 4672 3920 jvdvd.exe 97 PID 4672 wrote to memory of 2252 4672 dvjdp.exe 98 PID 4672 wrote to memory of 2252 4672 dvjdp.exe 98 PID 4672 wrote to memory of 2252 4672 dvjdp.exe 98 PID 2252 wrote to memory of 3316 2252 1lfrfrl.exe 99 PID 2252 wrote to memory of 3316 2252 1lfrfrl.exe 99 PID 2252 wrote to memory of 3316 2252 1lfrfrl.exe 99 PID 3316 wrote to memory of 1068 3316 ntbtnn.exe 100 PID 3316 wrote to memory of 1068 3316 ntbtnn.exe 100 PID 3316 wrote to memory of 1068 3316 ntbtnn.exe 100 PID 1068 wrote to memory of 5056 1068 pjjdv.exe 101 PID 1068 wrote to memory of 5056 1068 pjjdv.exe 101 PID 1068 wrote to memory of 5056 1068 pjjdv.exe 101 PID 5056 wrote to memory of 3200 5056 jdvpj.exe 102 PID 5056 wrote to memory of 3200 5056 jdvpj.exe 102 PID 5056 wrote to memory of 3200 5056 jdvpj.exe 102 PID 3200 wrote to memory of 3844 3200 xfffrfl.exe 103 PID 3200 wrote to memory of 3844 3200 xfffrfl.exe 103 PID 3200 wrote to memory of 3844 3200 xfffrfl.exe 103 PID 3844 wrote to memory of 8 3844 tnbtbb.exe 104 PID 3844 wrote to memory of 8 3844 tnbtbb.exe 104 PID 3844 wrote to memory of 8 3844 tnbtbb.exe 104 PID 8 wrote to memory of 2852 8 5bbtnh.exe 105 PID 8 wrote to memory of 2852 8 5bbtnh.exe 105 PID 8 wrote to memory of 2852 8 5bbtnh.exe 105 PID 2852 wrote to memory of 3988 2852 pdjdp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ad4a225521a820122f30c93a1a1880_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\45ad4a225521a820122f30c93a1a1880_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\flllflf.exec:\flllflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hbhbtt.exec:\hbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tnhbbt.exec:\tnhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\llrrrxf.exec:\llrrrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\ddvdj.exec:\ddvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\ffffxrx.exec:\ffffxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\ttbbhh.exec:\ttbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\jvdvv.exec:\jvdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\rlxxxxl.exec:\rlxxxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\lllfrlf.exec:\lllfrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\nhnhbt.exec:\nhnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\jvdvd.exec:\jvdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\dvjdp.exec:\dvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\1lfrfrl.exec:\1lfrfrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ntbtnn.exec:\ntbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\pjjdv.exec:\pjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jdvpj.exec:\jdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\xfffrfl.exec:\xfffrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\tnbtbb.exec:\tnbtbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\5bbtnh.exec:\5bbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\pdjdp.exec:\pdjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\xllffrf.exec:\xllffrf.exe23⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bbhbnn.exec:\bbhbnn.exe24⤵
- Executes dropped EXE
PID:4580 -
\??\c:\3ntbbb.exec:\3ntbbb.exe25⤵
- Executes dropped EXE
PID:3572 -
\??\c:\9vdvp.exec:\9vdvp.exe26⤵
- Executes dropped EXE
PID:5040 -
\??\c:\frrlfxr.exec:\frrlfxr.exe27⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hhttnt.exec:\hhttnt.exe28⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nbhnhh.exec:\nbhnhh.exe29⤵
- Executes dropped EXE
PID:4324 -
\??\c:\3pjdv.exec:\3pjdv.exe30⤵
- Executes dropped EXE
PID:3556 -
\??\c:\rrrlfxx.exec:\rrrlfxx.exe31⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rrxxlff.exec:\rrxxlff.exe32⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9tttth.exec:\9tttth.exe33⤵
- Executes dropped EXE
PID:2432 -
\??\c:\pppjd.exec:\pppjd.exe34⤵
- Executes dropped EXE
PID:1904 -
\??\c:\llfxrlx.exec:\llfxrlx.exe35⤵
- Executes dropped EXE
PID:1088 -
\??\c:\btbtnb.exec:\btbtnb.exe36⤵
- Executes dropped EXE
PID:5036 -
\??\c:\dvvpp.exec:\dvvpp.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\dvvjd.exec:\dvvjd.exe38⤵
- Executes dropped EXE
PID:1156 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\tbnnnn.exec:\tbnnnn.exe40⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jjpjd.exec:\jjpjd.exe41⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rflxxrr.exec:\rflxxrr.exe42⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hnhhbh.exec:\hnhhbh.exe43⤵
- Executes dropped EXE
PID:4304 -
\??\c:\vppdv.exec:\vppdv.exe44⤵
- Executes dropped EXE
PID:4244 -
\??\c:\flrllll.exec:\flrllll.exe45⤵
- Executes dropped EXE
PID:4364 -
\??\c:\tthbnn.exec:\tthbnn.exe46⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nbhbth.exec:\nbhbth.exe47⤵
- Executes dropped EXE
PID:876 -
\??\c:\vpjjv.exec:\vpjjv.exe48⤵
- Executes dropped EXE
PID:3168 -
\??\c:\3llfxxx.exec:\3llfxxx.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3hnhhb.exec:\3hnhhb.exe50⤵
- Executes dropped EXE
PID:2868 -
\??\c:\9tnttt.exec:\9tnttt.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pppjj.exec:\pppjj.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xxfllfx.exec:\xxfllfx.exe53⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5rfrfff.exec:\5rfrfff.exe54⤵
- Executes dropped EXE
PID:3948 -
\??\c:\htbtnn.exec:\htbtnn.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pjdvj.exec:\pjdvj.exe56⤵
- Executes dropped EXE
PID:780 -
\??\c:\9fxxrrl.exec:\9fxxrrl.exe57⤵
- Executes dropped EXE
PID:1812 -
\??\c:\3bhbnn.exec:\3bhbnn.exe58⤵
- Executes dropped EXE
PID:1584 -
\??\c:\btnhhh.exec:\btnhhh.exe59⤵
- Executes dropped EXE
PID:4668 -
\??\c:\3jpvv.exec:\3jpvv.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3xxrllf.exec:\3xxrllf.exe61⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7ttnhh.exec:\7ttnhh.exe62⤵
- Executes dropped EXE
PID:3748 -
\??\c:\ntbttt.exec:\ntbttt.exe63⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1pvpj.exec:\1pvpj.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\frfxxff.exec:\frfxxff.exe65⤵
- Executes dropped EXE
PID:1472 -
\??\c:\1lrllfx.exec:\1lrllfx.exe66⤵PID:1732
-
\??\c:\ntnhnt.exec:\ntnhnt.exe67⤵PID:1428
-
\??\c:\ddvvd.exec:\ddvvd.exe68⤵PID:444
-
\??\c:\dddvv.exec:\dddvv.exe69⤵PID:2368
-
\??\c:\xlxrxlf.exec:\xlxrxlf.exe70⤵PID:3620
-
\??\c:\tnbbhb.exec:\tnbbhb.exe71⤵PID:3456
-
\??\c:\pjpjd.exec:\pjpjd.exe72⤵PID:2328
-
\??\c:\lfflllf.exec:\lfflllf.exe73⤵PID:1108
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe74⤵PID:2052
-
\??\c:\5bbtnb.exec:\5bbtnb.exe75⤵PID:2356
-
\??\c:\djppp.exec:\djppp.exe76⤵PID:3800
-
\??\c:\lffrlfx.exec:\lffrlfx.exe77⤵PID:3512
-
\??\c:\1rllfrl.exec:\1rllfrl.exe78⤵PID:1920
-
\??\c:\bnbbbb.exec:\bnbbbb.exe79⤵PID:4204
-
\??\c:\vvjjd.exec:\vvjjd.exe80⤵PID:1088
-
\??\c:\pvvvv.exec:\pvvvv.exe81⤵PID:1400
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe82⤵PID:1552
-
\??\c:\tttnnt.exec:\tttnnt.exe83⤵PID:3884
-
\??\c:\dpvpj.exec:\dpvpj.exe84⤵PID:2800
-
\??\c:\jdddv.exec:\jdddv.exe85⤵PID:3820
-
\??\c:\xflffrx.exec:\xflffrx.exe86⤵PID:4300
-
\??\c:\btbhnh.exec:\btbhnh.exe87⤵PID:4424
-
\??\c:\jvdpj.exec:\jvdpj.exe88⤵PID:924
-
\??\c:\jpdvp.exec:\jpdvp.exe89⤵PID:2748
-
\??\c:\lxxfxxr.exec:\lxxfxxr.exe90⤵PID:1608
-
\??\c:\bbhnbn.exec:\bbhnbn.exe91⤵PID:3744
-
\??\c:\dpvpd.exec:\dpvpd.exe92⤵PID:440
-
\??\c:\1pvjv.exec:\1pvjv.exe93⤵PID:5004
-
\??\c:\llrlfxr.exec:\llrlfxr.exe94⤵PID:3612
-
\??\c:\tbbbnn.exec:\tbbbnn.exe95⤵PID:4804
-
\??\c:\jvdpj.exec:\jvdpj.exe96⤵PID:3952
-
\??\c:\3ppjv.exec:\3ppjv.exe97⤵PID:4060
-
\??\c:\rxxrxfr.exec:\rxxrxfr.exe98⤵PID:4416
-
\??\c:\ttbbtn.exec:\ttbbtn.exe99⤵PID:4420
-
\??\c:\hthbtn.exec:\hthbtn.exe100⤵PID:2200
-
\??\c:\vpvpd.exec:\vpvpd.exe101⤵PID:4332
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe102⤵PID:4668
-
\??\c:\flffxrr.exec:\flffxrr.exe103⤵PID:2988
-
\??\c:\xllxrlx.exec:\xllxrlx.exe104⤵PID:2064
-
\??\c:\btthbt.exec:\btthbt.exe105⤵PID:3748
-
\??\c:\djjvd.exec:\djjvd.exe106⤵PID:3516
-
\??\c:\7jvjd.exec:\7jvjd.exe107⤵PID:3836
-
\??\c:\3llfrfr.exec:\3llfrfr.exe108⤵PID:4972
-
\??\c:\bbhbtn.exec:\bbhbtn.exe109⤵PID:4392
-
\??\c:\tbnhbn.exec:\tbnhbn.exe110⤵PID:4620
-
\??\c:\jjdjd.exec:\jjdjd.exe111⤵PID:3988
-
\??\c:\frxlfxr.exec:\frxlfxr.exe112⤵PID:3572
-
\??\c:\rrlffff.exec:\rrlffff.exe113⤵PID:1008
-
\??\c:\hnbbhh.exec:\hnbbhh.exe114⤵PID:1420
-
\??\c:\vdjjd.exec:\vdjjd.exe115⤵PID:4636
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe116⤵PID:2380
-
\??\c:\frxrxrx.exec:\frxrxrx.exe117⤵PID:3544
-
\??\c:\hbthhb.exec:\hbthhb.exe118⤵PID:2852
-
\??\c:\9pvpj.exec:\9pvpj.exe119⤵PID:1592
-
\??\c:\dvdjj.exec:\dvdjj.exe120⤵PID:3352
-
\??\c:\rrlfxrr.exec:\rrlfxrr.exe121⤵PID:716
-
\??\c:\hhnnnh.exec:\hhnnnh.exe122⤵PID:3984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-