Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 20:05
Behavioral task
behavioral1
Sample
1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe
-
Size
351KB
-
MD5
1c693a60202ab21ec468e72d13cccbc0
-
SHA1
fcfb1405f40b31429d6344e39c466c5d4797e8b5
-
SHA256
f62958629395ecabe50259cfec131f1cd602e0ed2668bdd951e513bc6ffeda0c
-
SHA512
dd10f9914c201c8a74389d26bb433059e52b5804afbd437041897d0955acec414de1f3e8d7ea6c6b497135f44fcefbed4f1d9271cf4f513d157d04d84fc3d7f6
-
SSDEEP
6144:bcm4FmowdHoSgWrXD486jCpoAhlq1mEjBqLyOSlhNFF23k:h4wFHoSgWj168w1VjsyvhNFF20
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1800-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2908-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2688-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2416-72-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2416-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1112-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2392-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2380-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1892-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-162-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/896-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/708-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-291-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/1528-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-886-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2436-897-0x00000000005C0000-0x00000000005E7000-memory.dmp family_blackmoon behavioral1/memory/2416-903-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1592-935-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-1056-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2748-9494-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2748-10545-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2748-19322-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon behavioral1/memory/2748-22236-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 45 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000c000000013144-5.dat family_berbew behavioral1/files/0x003400000001565a-14.dat family_berbew behavioral1/files/0x0008000000015b85-23.dat family_berbew behavioral1/files/0x0007000000015c9a-33.dat family_berbew behavioral1/files/0x0007000000015ca8-40.dat family_berbew behavioral1/files/0x0007000000015cb1-48.dat family_berbew behavioral1/files/0x0007000000015cc5-56.dat family_berbew behavioral1/files/0x0007000000016122-65.dat family_berbew behavioral1/files/0x00060000000161ee-74.dat family_berbew behavioral1/files/0x00060000000163eb-82.dat family_berbew behavioral1/files/0x00060000000164ec-90.dat family_berbew behavioral1/files/0x0006000000016575-98.dat family_berbew behavioral1/files/0x00060000000167bf-106.dat family_berbew behavioral1/files/0x0006000000016a28-115.dat family_berbew behavioral1/files/0x0006000000016c1f-121.dat family_berbew behavioral1/files/0x0006000000016c30-130.dat family_berbew behavioral1/files/0x0006000000016c38-137.dat family_berbew behavioral1/files/0x0006000000016c84-147.dat family_berbew behavioral1/files/0x0006000000016cb5-154.dat family_berbew behavioral1/files/0x0006000000016ce0-163.dat family_berbew behavioral1/files/0x0034000000015662-170.dat family_berbew behavioral1/files/0x0006000000016ced-178.dat family_berbew behavioral1/files/0x0006000000016cf3-186.dat family_berbew behavioral1/files/0x0006000000016cfd-195.dat family_berbew behavioral1/files/0x0006000000016d06-202.dat family_berbew behavioral1/files/0x0006000000016d10-209.dat family_berbew behavioral1/files/0x0006000000016d18-216.dat family_berbew behavioral1/files/0x0006000000016d21-224.dat family_berbew behavioral1/files/0x0006000000016d29-231.dat family_berbew behavioral1/files/0x0006000000016d31-238.dat family_berbew behavioral1/files/0x0006000000016d81-245.dat family_berbew behavioral1/files/0x0006000000016d85-252.dat family_berbew behavioral1/memory/2748-5994-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-8971-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-11069-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_berbew behavioral1/memory/2748-12644-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-12643-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_berbew behavioral1/memory/2748-21649-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_berbew behavioral1/memory/2748-22237-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-22236-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_berbew behavioral1/memory/2748-25766-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-26360-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-26657-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-26954-0x0000000076FC0000-0x00000000770BA000-memory.dmp family_berbew behavioral1/memory/2748-26953-0x0000000076EA0000-0x0000000076FBF000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1800 dpvdp.exe 2908 xrflxfx.exe 2520 vpjpv.exe 2640 9dvjd.exe 2120 bthtbn.exe 2688 9jjpd.exe 2552 rxfllff.exe 2416 htbbhn.exe 2492 vdvjj.exe 1112 7rlllfl.exe 2300 pdpjj.exe 1592 5ffrlrl.exe 2392 1bhtbb.exe 1808 pdpdd.exe 2336 nhntbh.exe 2380 nnbbnh.exe 340 3dvjd.exe 1892 tnhhtb.exe 1660 pjvpd.exe 896 xrlxfrx.exe 2852 nnhhtb.exe 1260 jvpvj.exe 2012 7xrfrfl.exe 2028 nbtthn.exe 488 dvddv.exe 1292 1rflflf.exe 2936 hbtttb.exe 1704 1hbhtb.exe 1288 7fxxfll.exe 1716 lfrlxrr.exe 916 7nthnn.exe 708 vpddj.exe 2860 5xfffxf.exe 2984 btbnbt.exe 2232 dvjjj.exe 1304 xrlrffr.exe 2152 tnbhtt.exe 2748 1bbnbh.exe 1528 lrlrflr.exe 2508 nnhbth.exe 2904 dvppj.exe 2556 5vdpv.exe 2572 fxxllxr.exe 2540 3ntntb.exe 2532 hbhnht.exe 2120 9pjpp.exe 2464 rlflflx.exe 2580 tttbbh.exe 2448 7pddd.exe 2480 9jvdd.exe 2536 lrflxfr.exe 1016 bhbhhn.exe 292 3jjpp.exe 1468 9vvvv.exe 1592 llflffx.exe 1348 3hthbn.exe 2476 3vpvd.exe 680 ddvjv.exe 2336 fxrlrxl.exe 776 nnhnhn.exe 1904 hhttht.exe 352 5vvvd.exe 2212 llxfrxr.exe 2660 lfxxfff.exe -
resource yara_rule behavioral1/memory/1656-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000c000000013144-5.dat upx behavioral1/memory/1800-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x003400000001565a-14.dat upx behavioral1/memory/2908-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015b85-23.dat upx behavioral1/memory/2520-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2908-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015c9a-33.dat upx behavioral1/memory/2520-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015ca8-40.dat upx behavioral1/files/0x0007000000015cb1-48.dat upx behavioral1/memory/2120-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015cc5-56.dat upx behavioral1/memory/2688-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016122-65.dat upx behavioral1/memory/2416-72-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2416-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000161ee-74.dat upx behavioral1/files/0x00060000000163eb-82.dat upx behavioral1/memory/2492-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000164ec-90.dat upx behavioral1/memory/1112-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016575-98.dat upx behavioral1/files/0x00060000000167bf-106.dat upx behavioral1/memory/2392-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a28-115.dat upx behavioral1/memory/2392-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1f-121.dat upx behavioral1/memory/1808-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c30-130.dat upx behavioral1/files/0x0006000000016c38-137.dat upx behavioral1/memory/2380-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/340-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c84-147.dat upx behavioral1/memory/340-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1892-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb5-154.dat upx behavioral1/files/0x0006000000016ce0-163.dat upx behavioral1/files/0x0034000000015662-170.dat upx behavioral1/memory/896-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016ced-178.dat upx behavioral1/memory/2852-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1260-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cf3-186.dat upx behavioral1/memory/2012-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cfd-195.dat upx behavioral1/files/0x0006000000016d06-202.dat upx behavioral1/files/0x0006000000016d10-209.dat upx behavioral1/files/0x0006000000016d18-216.dat upx behavioral1/memory/2936-217-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016d21-224.dat upx behavioral1/files/0x0006000000016d29-231.dat upx behavioral1/files/0x0006000000016d31-238.dat upx behavioral1/files/0x0006000000016d81-245.dat upx behavioral1/files/0x0006000000016d85-252.dat upx behavioral1/memory/708-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2984-272-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-273-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2232-279-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1800 1656 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 28 PID 1656 wrote to memory of 1800 1656 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 28 PID 1656 wrote to memory of 1800 1656 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 28 PID 1656 wrote to memory of 1800 1656 1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe 28 PID 1800 wrote to memory of 2908 1800 dpvdp.exe 29 PID 1800 wrote to memory of 2908 1800 dpvdp.exe 29 PID 1800 wrote to memory of 2908 1800 dpvdp.exe 29 PID 1800 wrote to memory of 2908 1800 dpvdp.exe 29 PID 2908 wrote to memory of 2520 2908 xrflxfx.exe 30 PID 2908 wrote to memory of 2520 2908 xrflxfx.exe 30 PID 2908 wrote to memory of 2520 2908 xrflxfx.exe 30 PID 2908 wrote to memory of 2520 2908 xrflxfx.exe 30 PID 2520 wrote to memory of 2640 2520 vpjpv.exe 31 PID 2520 wrote to memory of 2640 2520 vpjpv.exe 31 PID 2520 wrote to memory of 2640 2520 vpjpv.exe 31 PID 2520 wrote to memory of 2640 2520 vpjpv.exe 31 PID 2640 wrote to memory of 2120 2640 9dvjd.exe 32 PID 2640 wrote to memory of 2120 2640 9dvjd.exe 32 PID 2640 wrote to memory of 2120 2640 9dvjd.exe 32 PID 2640 wrote to memory of 2120 2640 9dvjd.exe 32 PID 2120 wrote to memory of 2688 2120 bthtbn.exe 33 PID 2120 wrote to memory of 2688 2120 bthtbn.exe 33 PID 2120 wrote to memory of 2688 2120 bthtbn.exe 33 PID 2120 wrote to memory of 2688 2120 bthtbn.exe 33 PID 2688 wrote to memory of 2552 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2552 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2552 2688 9jjpd.exe 34 PID 2688 wrote to memory of 2552 2688 9jjpd.exe 34 PID 2552 wrote to memory of 2416 2552 rxfllff.exe 35 PID 2552 wrote to memory of 2416 2552 rxfllff.exe 35 PID 2552 wrote to memory of 2416 2552 rxfllff.exe 35 PID 2552 wrote to memory of 2416 2552 rxfllff.exe 35 PID 2416 wrote to memory of 2492 2416 htbbhn.exe 36 PID 2416 wrote to memory of 2492 2416 htbbhn.exe 36 PID 2416 wrote to memory of 2492 2416 htbbhn.exe 36 PID 2416 wrote to memory of 2492 2416 htbbhn.exe 36 PID 2492 wrote to memory of 1112 2492 vdvjj.exe 37 PID 2492 wrote to memory of 1112 2492 vdvjj.exe 37 PID 2492 wrote to memory of 1112 2492 vdvjj.exe 37 PID 2492 wrote to memory of 1112 2492 vdvjj.exe 37 PID 1112 wrote to memory of 2300 1112 7rlllfl.exe 38 PID 1112 wrote to memory of 2300 1112 7rlllfl.exe 38 PID 1112 wrote to memory of 2300 1112 7rlllfl.exe 38 PID 1112 wrote to memory of 2300 1112 7rlllfl.exe 38 PID 2300 wrote to memory of 1592 2300 pdpjj.exe 39 PID 2300 wrote to memory of 1592 2300 pdpjj.exe 39 PID 2300 wrote to memory of 1592 2300 pdpjj.exe 39 PID 2300 wrote to memory of 1592 2300 pdpjj.exe 39 PID 1592 wrote to memory of 2392 1592 5ffrlrl.exe 40 PID 1592 wrote to memory of 2392 1592 5ffrlrl.exe 40 PID 1592 wrote to memory of 2392 1592 5ffrlrl.exe 40 PID 1592 wrote to memory of 2392 1592 5ffrlrl.exe 40 PID 2392 wrote to memory of 1808 2392 1bhtbb.exe 41 PID 2392 wrote to memory of 1808 2392 1bhtbb.exe 41 PID 2392 wrote to memory of 1808 2392 1bhtbb.exe 41 PID 2392 wrote to memory of 1808 2392 1bhtbb.exe 41 PID 1808 wrote to memory of 2336 1808 pdpdd.exe 42 PID 1808 wrote to memory of 2336 1808 pdpdd.exe 42 PID 1808 wrote to memory of 2336 1808 pdpdd.exe 42 PID 1808 wrote to memory of 2336 1808 pdpdd.exe 42 PID 2336 wrote to memory of 2380 2336 nhntbh.exe 43 PID 2336 wrote to memory of 2380 2336 nhntbh.exe 43 PID 2336 wrote to memory of 2380 2336 nhntbh.exe 43 PID 2336 wrote to memory of 2380 2336 nhntbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\1c693a60202ab21ec468e72d13cccbc0_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\dpvdp.exec:\dpvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrflxfx.exec:\xrflxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\vpjpv.exec:\vpjpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\9dvjd.exec:\9dvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\bthtbn.exec:\bthtbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9jjpd.exec:\9jjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rxfllff.exec:\rxfllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\htbbhn.exec:\htbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vdvjj.exec:\vdvjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7rlllfl.exec:\7rlllfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\pdpjj.exec:\pdpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\5ffrlrl.exec:\5ffrlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\1bhtbb.exec:\1bhtbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\pdpdd.exec:\pdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nhntbh.exec:\nhntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nnbbnh.exec:\nnbbnh.exe17⤵
- Executes dropped EXE
PID:2380 -
\??\c:\3dvjd.exec:\3dvjd.exe18⤵
- Executes dropped EXE
PID:340 -
\??\c:\tnhhtb.exec:\tnhhtb.exe19⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pjvpd.exec:\pjvpd.exe20⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xrlxfrx.exec:\xrlxfrx.exe21⤵
- Executes dropped EXE
PID:896 -
\??\c:\nnhhtb.exec:\nnhhtb.exe22⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvpvj.exec:\jvpvj.exe23⤵
- Executes dropped EXE
PID:1260 -
\??\c:\7xrfrfl.exec:\7xrfrfl.exe24⤵
- Executes dropped EXE
PID:2012 -
\??\c:\nbtthn.exec:\nbtthn.exe25⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvddv.exec:\dvddv.exe26⤵
- Executes dropped EXE
PID:488 -
\??\c:\1rflflf.exec:\1rflflf.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\hbtttb.exec:\hbtttb.exe28⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1hbhtb.exec:\1hbhtb.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7fxxfll.exec:\7fxxfll.exe30⤵
- Executes dropped EXE
PID:1288 -
\??\c:\lfrlxrr.exec:\lfrlxrr.exe31⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7nthnn.exec:\7nthnn.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\vpddj.exec:\vpddj.exe33⤵
- Executes dropped EXE
PID:708 -
\??\c:\5xfffxf.exec:\5xfffxf.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\btbnbt.exec:\btbnbt.exe35⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvjjj.exec:\dvjjj.exe36⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xrlrffr.exec:\xrlrffr.exe37⤵
- Executes dropped EXE
PID:1304 -
\??\c:\tnbhtt.exec:\tnbhtt.exe38⤵
- Executes dropped EXE
PID:2152 -
\??\c:\1bbnbh.exec:\1bbnbh.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\9jppj.exec:\9jppj.exe40⤵PID:1724
-
\??\c:\lrlrflr.exec:\lrlrflr.exe41⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nnhbth.exec:\nnhbth.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\dvppj.exec:\dvppj.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\5vdpv.exec:\5vdpv.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxxllxr.exec:\fxxllxr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3ntntb.exec:\3ntntb.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbhnht.exec:\hbhnht.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\9pjpp.exec:\9pjpp.exe48⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlflflx.exec:\rlflflx.exe49⤵
- Executes dropped EXE
PID:2464 -
\??\c:\tttbbh.exec:\tttbbh.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7pddd.exec:\7pddd.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9jvdd.exec:\9jvdd.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lrflxfr.exec:\lrflxfr.exe53⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bhbhhn.exec:\bhbhhn.exe54⤵
- Executes dropped EXE
PID:1016 -
\??\c:\3jjpp.exec:\3jjpp.exe55⤵
- Executes dropped EXE
PID:292 -
\??\c:\9vvvv.exec:\9vvvv.exe56⤵
- Executes dropped EXE
PID:1468 -
\??\c:\llflffx.exec:\llflffx.exe57⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3hthbn.exec:\3hthbn.exe58⤵
- Executes dropped EXE
PID:1348 -
\??\c:\3vpvd.exec:\3vpvd.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddvjv.exec:\ddvjv.exe60⤵
- Executes dropped EXE
PID:680 -
\??\c:\fxrlrxl.exec:\fxrlrxl.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nnhnhn.exec:\nnhnhn.exe62⤵
- Executes dropped EXE
PID:776 -
\??\c:\hhttht.exec:\hhttht.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\5vvvd.exec:\5vvvd.exe64⤵
- Executes dropped EXE
PID:352 -
\??\c:\llxfrxr.exec:\llxfrxr.exe65⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lfxxfff.exec:\lfxxfff.exe66⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3thnhh.exec:\3thnhh.exe67⤵PID:1660
-
\??\c:\vvpdp.exec:\vvpdp.exe68⤵PID:1652
-
\??\c:\pjdpp.exec:\pjdpp.exe69⤵PID:2732
-
\??\c:\9rlxflx.exec:\9rlxflx.exe70⤵PID:1632
-
\??\c:\tnhtnt.exec:\tnhtnt.exe71⤵PID:1184
-
\??\c:\7btbhh.exec:\7btbhh.exe72⤵PID:2136
-
\??\c:\djjvv.exec:\djjvv.exe73⤵PID:2512
-
\??\c:\jpjpj.exec:\jpjpj.exe74⤵PID:2028
-
\??\c:\1rrlfrx.exec:\1rrlfrx.exe75⤵PID:348
-
\??\c:\5nnnhh.exec:\5nnnhh.exe76⤵PID:1676
-
\??\c:\tnhtnb.exec:\tnhtnb.exe77⤵PID:988
-
\??\c:\5jddd.exec:\5jddd.exe78⤵PID:1460
-
\??\c:\flfrlxl.exec:\flfrlxl.exe79⤵PID:1000
-
\??\c:\9ffxlrf.exec:\9ffxlrf.exe80⤵PID:1760
-
\??\c:\hhbnhn.exec:\hhbnhn.exe81⤵PID:1248
-
\??\c:\jdvvd.exec:\jdvvd.exe82⤵PID:3048
-
\??\c:\ppjjv.exec:\ppjjv.exe83⤵PID:572
-
\??\c:\lrxlrxr.exec:\lrxlrxr.exe84⤵PID:1576
-
\??\c:\hbbbnb.exec:\hbbbnb.exe85⤵PID:996
-
\??\c:\tnbhtb.exec:\tnbhtb.exe86⤵PID:3040
-
\??\c:\3vjdd.exec:\3vjdd.exe87⤵PID:2784
-
\??\c:\pjjpv.exec:\pjjpv.exe88⤵PID:1428
-
\??\c:\3fflxrf.exec:\3fflxrf.exe89⤵PID:2296
-
\??\c:\3hbbth.exec:\3hbbth.exe90⤵PID:2152
-
\??\c:\tthnbh.exec:\tthnbh.exe91⤵PID:1956
-
\??\c:\5pdpv.exec:\5pdpv.exe92⤵PID:1740
-
\??\c:\jdvjp.exec:\jdvjp.exe93⤵PID:2560
-
\??\c:\9lxxllr.exec:\9lxxllr.exe94⤵PID:2908
-
\??\c:\tnbbhb.exec:\tnbbhb.exe95⤵PID:2656
-
\??\c:\hntnth.exec:\hntnth.exe96⤵PID:2636
-
\??\c:\pjjvj.exec:\pjjvj.exe97⤵PID:2640
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe98⤵PID:2928
-
\??\c:\rfrfrlr.exec:\rfrfrlr.exe99⤵PID:2676
-
\??\c:\nbbbhb.exec:\nbbbhb.exe100⤵PID:2412
-
\??\c:\vpvvd.exec:\vpvvd.exe101⤵PID:2428
-
\??\c:\llfxfrf.exec:\llfxfrf.exe102⤵PID:2416
-
\??\c:\frrrfxf.exec:\frrrfxf.exe103⤵PID:1756
-
\??\c:\bhhntb.exec:\bhhntb.exe104⤵PID:2176
-
\??\c:\1jvdj.exec:\1jvdj.exe105⤵PID:780
-
\??\c:\7vpdv.exec:\7vpdv.exe106⤵PID:1636
-
\??\c:\7rxxfff.exec:\7rxxfff.exe107⤵PID:1596
-
\??\c:\nhhhth.exec:\nhhhth.exe108⤵PID:1552
-
\??\c:\ppddj.exec:\ppddj.exe109⤵PID:240
-
\??\c:\pjjpp.exec:\pjjpp.exe110⤵PID:2328
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe111⤵PID:2148
-
\??\c:\3nnthn.exec:\3nnthn.exe112⤵PID:2208
-
\??\c:\bnhttt.exec:\bnhttt.exe113⤵PID:1628
-
\??\c:\vjjjd.exec:\vjjjd.exe114⤵PID:2044
-
\??\c:\rlflxxr.exec:\rlflxxr.exe115⤵PID:1876
-
\??\c:\rlflxfl.exec:\rlflxfl.exe116⤵PID:1440
-
\??\c:\nhbhbt.exec:\nhbhbt.exe117⤵PID:1368
-
\??\c:\nnnnhh.exec:\nnnnhh.exe118⤵PID:2824
-
\??\c:\dvdjd.exec:\dvdjd.exe119⤵PID:2516
-
\??\c:\rfffllr.exec:\rfffllr.exe120⤵PID:1048
-
\??\c:\lxfrlll.exec:\lxfrlll.exe121⤵PID:2008
-
\??\c:\hnnbth.exec:\hnnbth.exe122⤵PID:1184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-