Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 02:53
Behavioral task
behavioral1
Sample
54d00959794eb226f648020308c4c5f0_NEAS.exe
Resource
win7-20240215-en
6 signatures
150 seconds
General
-
Target
54d00959794eb226f648020308c4c5f0_NEAS.exe
-
Size
252KB
-
MD5
54d00959794eb226f648020308c4c5f0
-
SHA1
f55e10719119878c4a5ed77cfe9bc06083600963
-
SHA256
f59230f16cf3f57706d5ca386e9a9d837488d62bb9f0401ff0663bdca029dd2c
-
SHA512
cddf5624a627ca7de6d74bf028fbd35c183c9c18f83915ed39d20c361e4139333d971fd7b9f35a24df794a3c7a743233b0da24114e234c2341ff0359cb9fed56
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkv:ccm4FmowdHoSi9EIBftapTs4WZazeEv
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4660-4-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5084-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-16-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1796-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1812-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3704-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1192-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2336-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/448-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3124-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2600-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3484-70-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4972-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3600-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4944-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4120-108-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1936-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2648-121-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/464-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/608-138-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3264-153-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4256-165-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3004-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1744-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4520-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4864-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1912-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4804-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4332-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5080-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5084-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2480-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3916-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3892-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/928-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4932-261-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2468-269-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4464-281-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2528-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2996-304-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3936-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3372-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3540-340-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5068-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-360-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2296-389-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4152-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4936-410-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4584-418-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2812-425-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4452-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5096-496-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2336-556-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-619-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1944-671-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3124-691-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4900-707-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3928-750-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/876-760-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4156-930-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1744-1002-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1800-1326-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000c000000023b8b-3.dat family_berbew behavioral2/files/0x000a000000023b92-8.dat family_berbew behavioral2/files/0x000a000000023b93-12.dat family_berbew behavioral2/files/0x000a000000023b94-21.dat family_berbew behavioral2/files/0x000a000000023b95-26.dat family_berbew behavioral2/files/0x000a000000023b96-33.dat family_berbew behavioral2/files/0x000a000000023b97-39.dat family_berbew behavioral2/files/0x000a000000023b98-45.dat family_berbew behavioral2/files/0x000a000000023b99-50.dat family_berbew behavioral2/files/0x000a000000023b9a-56.dat family_berbew behavioral2/files/0x000a000000023b9b-61.dat family_berbew behavioral2/files/0x000a000000023b9c-68.dat family_berbew behavioral2/files/0x000a000000023b9d-73.dat family_berbew behavioral2/files/0x000a000000023b9e-79.dat family_berbew behavioral2/files/0x000a000000023b9f-85.dat family_berbew behavioral2/files/0x000a000000023ba0-92.dat family_berbew behavioral2/files/0x000b000000023b8f-96.dat family_berbew behavioral2/files/0x000a000000023ba1-100.dat family_berbew behavioral2/files/0x000a000000023ba2-105.dat family_berbew behavioral2/files/0x000a000000023ba3-113.dat family_berbew behavioral2/files/0x000a000000023ba4-117.dat family_berbew behavioral2/files/0x000a000000023ba5-124.dat family_berbew behavioral2/files/0x000a000000023ba6-129.dat family_berbew behavioral2/files/0x000a000000023ba7-135.dat family_berbew behavioral2/files/0x000a000000023ba8-141.dat family_berbew behavioral2/files/0x000a000000023ba9-147.dat family_berbew behavioral2/files/0x000a000000023baa-151.dat family_berbew behavioral2/files/0x000a000000023bac-159.dat family_berbew behavioral2/files/0x000a000000023bad-163.dat family_berbew behavioral2/files/0x000a000000023bae-170.dat family_berbew behavioral2/files/0x000a000000023baf-175.dat family_berbew behavioral2/files/0x000a000000023bb0-180.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 5084 pvjjv.exe 3452 bbbtnn.exe 1796 pvdvv.exe 3704 nntnth.exe 1812 dvjjp.exe 1192 lllrxff.exe 2336 3nhnnt.exe 448 vpjjd.exe 3124 bbnbbh.exe 2600 pddjv.exe 3484 tnhnnn.exe 4972 pppvp.exe 884 btbbtn.exe 3600 lflfffl.exe 220 ddjdv.exe 3992 xfffxxx.exe 4944 nntttt.exe 4120 pdjjj.exe 1936 nnhhbb.exe 4496 xfrrffl.exe 2648 hhbtbb.exe 464 pvdvp.exe 3936 bnhbhn.exe 608 ppjdd.exe 3692 xfrxxff.exe 3264 nttttb.exe 3540 rrfxxxx.exe 4256 thnhnh.exe 5020 ddddv.exe 3004 rfxlxlx.exe 4592 htbbbh.exe 1744 jddvj.exe 4520 xrxrlll.exe 4864 tnbtbb.exe 1912 pjvpp.exe 4852 lfrllll.exe 1988 htbbnn.exe 4804 dvddd.exe 4332 xrffxff.exe 4428 nnbbbh.exe 5080 djvvp.exe 5084 rxxxfff.exe 4740 nhnhnn.exe 1796 vpjpd.exe 5016 frfrrrl.exe 5076 rrxrlff.exe 2480 hbbtnn.exe 4896 vjppp.exe 3916 rflrxxx.exe 1452 nhbbhh.exe 2580 vvdvp.exe 3892 rrxrllf.exe 928 rrxxxxx.exe 4932 tntnhh.exe 1880 1dddp.exe 1284 fffxllf.exe 2468 9nbttt.exe 2124 hnhnbt.exe 3920 vvppp.exe 4464 lrfrflx.exe 4872 1ffffff.exe 4404 tthnhh.exe 2528 pdpvj.exe 3760 dvddv.exe -
resource yara_rule behavioral2/memory/4660-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000c000000023b8b-3.dat upx behavioral2/memory/4660-4-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b92-8.dat upx behavioral2/memory/5084-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b93-12.dat upx behavioral2/memory/3452-16-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1796-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b94-21.dat upx behavioral2/files/0x000a000000023b95-26.dat upx behavioral2/memory/1812-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3704-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b96-33.dat upx behavioral2/memory/1192-35-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b97-39.dat upx behavioral2/memory/2336-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b98-45.dat upx behavioral2/memory/448-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b99-50.dat upx behavioral2/files/0x000a000000023b9a-56.dat upx behavioral2/memory/3124-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/448-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b9b-61.dat upx behavioral2/memory/2600-63-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b9c-68.dat upx behavioral2/memory/3484-70-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b9d-73.dat upx behavioral2/memory/4972-75-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b9e-79.dat upx behavioral2/memory/884-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3600-86-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023b9f-85.dat upx behavioral2/files/0x000a000000023ba0-92.dat upx behavioral2/files/0x000b000000023b8f-96.dat upx behavioral2/files/0x000a000000023ba1-100.dat upx behavioral2/memory/4944-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba2-105.dat upx behavioral2/memory/4120-108-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba3-113.dat upx behavioral2/memory/1936-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba4-117.dat upx behavioral2/memory/4496-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2648-121-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba5-124.dat upx behavioral2/memory/464-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba6-129.dat upx behavioral2/files/0x000a000000023ba7-135.dat upx behavioral2/memory/608-138-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023ba8-141.dat upx behavioral2/files/0x000a000000023ba9-147.dat upx behavioral2/files/0x000a000000023baa-151.dat upx behavioral2/memory/3264-153-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023bac-159.dat upx behavioral2/memory/4256-165-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023bad-163.dat upx behavioral2/files/0x000a000000023bae-170.dat upx behavioral2/memory/3004-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023baf-175.dat upx behavioral2/files/0x000a000000023bb0-180.dat upx behavioral2/memory/1744-185-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4520-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4864-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1912-195-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4804-206-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 5084 4660 54d00959794eb226f648020308c4c5f0_NEAS.exe 85 PID 4660 wrote to memory of 5084 4660 54d00959794eb226f648020308c4c5f0_NEAS.exe 85 PID 4660 wrote to memory of 5084 4660 54d00959794eb226f648020308c4c5f0_NEAS.exe 85 PID 5084 wrote to memory of 3452 5084 pvjjv.exe 86 PID 5084 wrote to memory of 3452 5084 pvjjv.exe 86 PID 5084 wrote to memory of 3452 5084 pvjjv.exe 86 PID 3452 wrote to memory of 1796 3452 bbbtnn.exe 87 PID 3452 wrote to memory of 1796 3452 bbbtnn.exe 87 PID 3452 wrote to memory of 1796 3452 bbbtnn.exe 87 PID 1796 wrote to memory of 3704 1796 pvdvv.exe 88 PID 1796 wrote to memory of 3704 1796 pvdvv.exe 88 PID 1796 wrote to memory of 3704 1796 pvdvv.exe 88 PID 3704 wrote to memory of 1812 3704 nntnth.exe 89 PID 3704 wrote to memory of 1812 3704 nntnth.exe 89 PID 3704 wrote to memory of 1812 3704 nntnth.exe 89 PID 1812 wrote to memory of 1192 1812 dvjjp.exe 90 PID 1812 wrote to memory of 1192 1812 dvjjp.exe 90 PID 1812 wrote to memory of 1192 1812 dvjjp.exe 90 PID 1192 wrote to memory of 2336 1192 lllrxff.exe 91 PID 1192 wrote to memory of 2336 1192 lllrxff.exe 91 PID 1192 wrote to memory of 2336 1192 lllrxff.exe 91 PID 2336 wrote to memory of 448 2336 3nhnnt.exe 92 PID 2336 wrote to memory of 448 2336 3nhnnt.exe 92 PID 2336 wrote to memory of 448 2336 3nhnnt.exe 92 PID 448 wrote to memory of 3124 448 vpjjd.exe 93 PID 448 wrote to memory of 3124 448 vpjjd.exe 93 PID 448 wrote to memory of 3124 448 vpjjd.exe 93 PID 3124 wrote to memory of 2600 3124 bbnbbh.exe 94 PID 3124 wrote to memory of 2600 3124 bbnbbh.exe 94 PID 3124 wrote to memory of 2600 3124 bbnbbh.exe 94 PID 2600 wrote to memory of 3484 2600 pddjv.exe 95 PID 2600 wrote to memory of 3484 2600 pddjv.exe 95 PID 2600 wrote to memory of 3484 2600 pddjv.exe 95 PID 3484 wrote to memory of 4972 3484 tnhnnn.exe 96 PID 3484 wrote to memory of 4972 3484 tnhnnn.exe 96 PID 3484 wrote to memory of 4972 3484 tnhnnn.exe 96 PID 4972 wrote to memory of 884 4972 pppvp.exe 97 PID 4972 wrote to memory of 884 4972 pppvp.exe 97 PID 4972 wrote to memory of 884 4972 pppvp.exe 97 PID 884 wrote to memory of 3600 884 btbbtn.exe 98 PID 884 wrote to memory of 3600 884 btbbtn.exe 98 PID 884 wrote to memory of 3600 884 btbbtn.exe 98 PID 3600 wrote to memory of 220 3600 lflfffl.exe 99 PID 3600 wrote to memory of 220 3600 lflfffl.exe 99 PID 3600 wrote to memory of 220 3600 lflfffl.exe 99 PID 220 wrote to memory of 3992 220 ddjdv.exe 100 PID 220 wrote to memory of 3992 220 ddjdv.exe 100 PID 220 wrote to memory of 3992 220 ddjdv.exe 100 PID 3992 wrote to memory of 4944 3992 xfffxxx.exe 101 PID 3992 wrote to memory of 4944 3992 xfffxxx.exe 101 PID 3992 wrote to memory of 4944 3992 xfffxxx.exe 101 PID 4944 wrote to memory of 4120 4944 nntttt.exe 103 PID 4944 wrote to memory of 4120 4944 nntttt.exe 103 PID 4944 wrote to memory of 4120 4944 nntttt.exe 103 PID 4120 wrote to memory of 1936 4120 pdjjj.exe 104 PID 4120 wrote to memory of 1936 4120 pdjjj.exe 104 PID 4120 wrote to memory of 1936 4120 pdjjj.exe 104 PID 1936 wrote to memory of 4496 1936 nnhhbb.exe 105 PID 1936 wrote to memory of 4496 1936 nnhhbb.exe 105 PID 1936 wrote to memory of 4496 1936 nnhhbb.exe 105 PID 4496 wrote to memory of 2648 4496 xfrrffl.exe 107 PID 4496 wrote to memory of 2648 4496 xfrrffl.exe 107 PID 4496 wrote to memory of 2648 4496 xfrrffl.exe 107 PID 2648 wrote to memory of 464 2648 hhbtbb.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d00959794eb226f648020308c4c5f0_NEAS.exe"C:\Users\Admin\AppData\Local\Temp\54d00959794eb226f648020308c4c5f0_NEAS.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\pvjjv.exec:\pvjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\bbbtnn.exec:\bbbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\pvdvv.exec:\pvdvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\nntnth.exec:\nntnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\dvjjp.exec:\dvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\lllrxff.exec:\lllrxff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\3nhnnt.exec:\3nhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vpjjd.exec:\vpjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\bbnbbh.exec:\bbnbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pddjv.exec:\pddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\tnhnnn.exec:\tnhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pppvp.exec:\pppvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\btbbtn.exec:\btbbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\lflfffl.exec:\lflfffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\ddjdv.exec:\ddjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\xfffxxx.exec:\xfffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\nntttt.exec:\nntttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pdjjj.exec:\pdjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\nnhhbb.exec:\nnhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xfrrffl.exec:\xfrrffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\hhbtbb.exec:\hhbtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvdvp.exec:\pvdvp.exe23⤵
- Executes dropped EXE
PID:464 -
\??\c:\bnhbhn.exec:\bnhbhn.exe24⤵
- Executes dropped EXE
PID:3936 -
\??\c:\ppjdd.exec:\ppjdd.exe25⤵
- Executes dropped EXE
PID:608 -
\??\c:\xfrxxff.exec:\xfrxxff.exe26⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nttttb.exec:\nttttb.exe27⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe28⤵
- Executes dropped EXE
PID:3540 -
\??\c:\thnhnh.exec:\thnhnh.exe29⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddddv.exec:\ddddv.exe30⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\htbbbh.exec:\htbbbh.exe32⤵
- Executes dropped EXE
PID:4592 -
\??\c:\jddvj.exec:\jddvj.exe33⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrxrlll.exec:\xrxrlll.exe34⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tnbtbb.exec:\tnbtbb.exe35⤵
- Executes dropped EXE
PID:4864 -
\??\c:\pjvpp.exec:\pjvpp.exe36⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrllll.exec:\lfrllll.exe37⤵
- Executes dropped EXE
PID:4852 -
\??\c:\htbbnn.exec:\htbbnn.exe38⤵
- Executes dropped EXE
PID:1988 -
\??\c:\dvddd.exec:\dvddd.exe39⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xrffxff.exec:\xrffxff.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nnbbbh.exec:\nnbbbh.exe41⤵
- Executes dropped EXE
PID:4428 -
\??\c:\djvvp.exec:\djvvp.exe42⤵
- Executes dropped EXE
PID:5080 -
\??\c:\rxxxfff.exec:\rxxxfff.exe43⤵
- Executes dropped EXE
PID:5084 -
\??\c:\nhnhnn.exec:\nhnhnn.exe44⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vpjpd.exec:\vpjpd.exe45⤵
- Executes dropped EXE
PID:1796 -
\??\c:\frfrrrl.exec:\frfrrrl.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rrxrlff.exec:\rrxrlff.exe47⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hbbtnn.exec:\hbbtnn.exe48⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjppp.exec:\vjppp.exe49⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rflrxxx.exec:\rflrxxx.exe50⤵
- Executes dropped EXE
PID:3916 -
\??\c:\nhbbhh.exec:\nhbbhh.exe51⤵
- Executes dropped EXE
PID:1452 -
\??\c:\vvdvp.exec:\vvdvp.exe52⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rrxrllf.exec:\rrxrllf.exe53⤵
- Executes dropped EXE
PID:3892 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe54⤵
- Executes dropped EXE
PID:928 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:4932 -
\??\c:\1dddp.exec:\1dddp.exe56⤵
- Executes dropped EXE
PID:1880 -
\??\c:\fffxllf.exec:\fffxllf.exe57⤵
- Executes dropped EXE
PID:1284 -
\??\c:\9nbttt.exec:\9nbttt.exe58⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hnhnbt.exec:\hnhnbt.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vvppp.exec:\vvppp.exe60⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lrfrflx.exec:\lrfrflx.exe61⤵
- Executes dropped EXE
PID:4464 -
\??\c:\1ffffff.exec:\1ffffff.exe62⤵
- Executes dropped EXE
PID:4872 -
\??\c:\tthnhh.exec:\tthnhh.exe63⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pdpvj.exec:\pdpvj.exe64⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dvddv.exec:\dvddv.exe65⤵
- Executes dropped EXE
PID:3760 -
\??\c:\xxrxrlf.exec:\xxrxrlf.exe66⤵PID:3528
-
\??\c:\5bhhbh.exec:\5bhhbh.exe67⤵PID:1936
-
\??\c:\tnbtbb.exec:\tnbtbb.exe68⤵PID:2996
-
\??\c:\pppjv.exec:\pppjv.exe69⤵PID:4496
-
\??\c:\xfxxffr.exec:\xfxxffr.exe70⤵PID:2648
-
\??\c:\thhtth.exec:\thhtth.exe71⤵PID:3688
-
\??\c:\djppp.exec:\djppp.exe72⤵PID:2976
-
\??\c:\pvpdp.exec:\pvpdp.exe73⤵PID:3936
-
\??\c:\rrxfxxf.exec:\rrxfxxf.exe74⤵PID:2228
-
\??\c:\btnhbt.exec:\btnhbt.exe75⤵PID:3372
-
\??\c:\btbhhh.exec:\btbhhh.exe76⤵PID:264
-
\??\c:\7vvvp.exec:\7vvvp.exe77⤵PID:1680
-
\??\c:\1fxrxfl.exec:\1fxrxfl.exe78⤵PID:216
-
\??\c:\tbbbtt.exec:\tbbbtt.exe79⤵PID:3540
-
\??\c:\bhtthh.exec:\bhtthh.exe80⤵PID:5068
-
\??\c:\jdvpj.exec:\jdvpj.exe81⤵PID:5020
-
\??\c:\5vddv.exec:\5vddv.exe82⤵PID:2920
-
\??\c:\xfrrfff.exec:\xfrrfff.exe83⤵PID:60
-
\??\c:\htntnn.exec:\htntnn.exe84⤵PID:3328
-
\??\c:\3bnhtn.exec:\3bnhtn.exe85⤵PID:1652
-
\??\c:\dpdvd.exec:\dpdvd.exe86⤵PID:2116
-
\??\c:\vjvpd.exec:\vjvpd.exe87⤵PID:1408
-
\??\c:\lxxrlff.exec:\lxxrlff.exe88⤵PID:1564
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe89⤵PID:2152
-
\??\c:\nhtnnn.exec:\nhtnnn.exe90⤵PID:3156
-
\??\c:\nhbbth.exec:\nhbbth.exe91⤵PID:4804
-
\??\c:\pvddd.exec:\pvddd.exe92⤵PID:3488
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe93⤵PID:436
-
\??\c:\nthhhh.exec:\nthhhh.exe94⤵PID:2296
-
\??\c:\nhthbt.exec:\nhthbt.exe95⤵PID:4064
-
\??\c:\jpvpp.exec:\jpvpp.exe96⤵PID:4152
-
\??\c:\xrflrxf.exec:\xrflrxf.exe97⤵PID:2924
-
\??\c:\btbtnn.exec:\btbtnn.exe98⤵PID:2832
-
\??\c:\pvpjd.exec:\pvpjd.exe99⤵PID:1344
-
\??\c:\dvvdv.exec:\dvvdv.exe100⤵PID:4936
-
\??\c:\hbbtth.exec:\hbbtth.exe101⤵PID:2308
-
\??\c:\ppvpj.exec:\ppvpj.exe102⤵PID:4584
-
\??\c:\djpjd.exec:\djpjd.exe103⤵PID:2592
-
\??\c:\frfxrrr.exec:\frfxrrr.exe104⤵PID:2812
-
\??\c:\tnnhbt.exec:\tnnhbt.exe105⤵PID:3948
-
\??\c:\vjpdp.exec:\vjpdp.exe106⤵PID:4624
-
\??\c:\pvdvj.exec:\pvdvj.exe107⤵PID:4456
-
\??\c:\xxrxxxx.exec:\xxrxxxx.exe108⤵PID:4452
-
\??\c:\frfxrrr.exec:\frfxrrr.exe109⤵PID:4924
-
\??\c:\bbnhbb.exec:\bbnhbb.exe110⤵PID:3092
-
\??\c:\hbbnhb.exec:\hbbnhb.exe111⤵PID:848
-
\??\c:\5jdpj.exec:\5jdpj.exe112⤵PID:1432
-
\??\c:\flfxrxr.exec:\flfxrxr.exe113⤵PID:1396
-
\??\c:\7tbtnn.exec:\7tbtnn.exe114⤵PID:2268
-
\??\c:\nbhbbb.exec:\nbhbbb.exe115⤵PID:628
-
\??\c:\3dvvj.exec:\3dvvj.exe116⤵PID:1224
-
\??\c:\rrxllll.exec:\rrxllll.exe117⤵PID:2848
-
\??\c:\1fxlxxx.exec:\1fxlxxx.exe118⤵PID:1524
-
\??\c:\tbtntb.exec:\tbtntb.exe119⤵PID:464
-
\??\c:\hbhbtn.exec:\hbhbtn.exe120⤵PID:364
-
\??\c:\7ddvj.exec:\7ddvj.exe121⤵PID:1716
-
\??\c:\fxfrllx.exec:\fxfrllx.exe122⤵PID:4488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-