Analysis
- max time kernel
150s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 23:17
Behavioral task
behavioral1
Sample
1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target 1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe
- Size 204KB
- Sample240509-2967vacf8s
- SHA256 b83a464e1e6c514044ad07687f2dc3da8e94ca5be151b24cd2d7bb944fb2d1cb
- MD5 1c6b1136ab9be80cfde30a8c24091fe0
- SHA1 56adf2581d4557773904569484947f65fca8ed0a
- SHA512 4508d68e36f4e2423917f36c4002c2a4c218c74514b059e478ec7cc7e6c9ffa4a4bad3b48d852d71ee26af5dbaaaef0bc72e232aa56485f50fcd9262d20355d8
- SSDEEP 6144:rcm4FmowdHoStBuhW246lCXb7YpdnSj6Ksaa:x4wFHoSLjr0+Hsaa
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2084-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1408-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4152-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2696-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/224-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3984-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3284-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1028-55-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1028-61-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1412-65-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/764-69-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3800-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1768-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1960-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2736-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4892-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4380-121-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3336-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3640-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2552-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3316-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3580-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1716-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4776-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4452-171-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-181-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3192-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4428-199-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4960-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/736-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3016-217-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4144-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1440-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4848-245-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3952-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4824-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4948-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5112-280-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4232-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4760-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3996-332-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3300-360-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4912-375-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1436-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/724-405-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3348-409-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4828-429-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1428-436-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1552-461-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4492-488-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2764-507-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4956-527-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3768-534-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4152-559-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2500-657-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3188-685-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-716-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3384-732-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1652-845-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3608-990-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1596-1035-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00050000000232a4-6.dat family_berbew behavioral2/files/0x000800000002344c-11.dat family_berbew behavioral2/files/0x000700000002344d-15.dat family_berbew behavioral2/files/0x000700000002344e-21.dat family_berbew behavioral2/files/0x000700000002344f-29.dat family_berbew behavioral2/files/0x0007000000023450-34.dat family_berbew behavioral2/files/0x0007000000023451-42.dat family_berbew behavioral2/files/0x0007000000023452-45.dat family_berbew behavioral2/files/0x0007000000023453-52.dat family_berbew behavioral2/files/0x0007000000023454-59.dat family_berbew behavioral2/files/0x0007000000023455-67.dat family_berbew behavioral2/files/0x0007000000023456-71.dat family_berbew behavioral2/files/0x0007000000023457-76.dat family_berbew behavioral2/files/0x0007000000023458-83.dat family_berbew behavioral2/files/0x0007000000023459-89.dat family_berbew behavioral2/files/0x000700000002345a-94.dat family_berbew behavioral2/files/0x000700000002345b-101.dat family_berbew behavioral2/files/0x000700000002345c-107.dat family_berbew behavioral2/files/0x000700000002345d-113.dat family_berbew behavioral2/files/0x0009000000023446-116.dat family_berbew behavioral2/files/0x000700000002345e-123.dat family_berbew behavioral2/files/0x000700000002345f-130.dat family_berbew behavioral2/files/0x0007000000023460-135.dat family_berbew behavioral2/files/0x0007000000023461-142.dat family_berbew behavioral2/files/0x0007000000023462-148.dat family_berbew behavioral2/files/0x0007000000023463-152.dat family_berbew behavioral2/files/0x0007000000023464-158.dat family_berbew behavioral2/files/0x0007000000023465-166.dat family_berbew behavioral2/files/0x00050000000006cf-172.dat family_berbew behavioral2/files/0x0004000000022ae1-178.dat family_berbew behavioral2/files/0x0007000000023466-184.dat family_berbew behavioral2/files/0x0007000000023467-189.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3548 jjpdd.exe 1408 xfrrlrl.exe 404 rffffrr.exe 4152 jjdjv.exe 2696 llfxllr.exe 224 xxllllr.exe 3284 9jdvp.exe 3984 bthhnn.exe 1028 hbhbhh.exe 1412 rxflfff.exe 764 djvpj.exe 2304 vppdj.exe 3800 bnthbn.exe 1768 5djjj.exe 1960 llfxxrr.exe 4892 hbbhbh.exe 2736 hnbttn.exe 4412 jvjjj.exe 4380 nthtnn.exe 3588 dvjpd.exe 3336 7dddd.exe 3640 htnhhh.exe 2552 dddvv.exe 3316 lrxxrrr.exe 3580 bbnnnn.exe 4776 jdjjd.exe 1716 nhbtnn.exe 4452 bnbthh.exe 3040 rxfffrf.exe 1652 dpjpj.exe 4184 fxxrlfx.exe 4884 hbbbhh.exe 3192 dvjdv.exe 4428 7rrrllx.exe 1012 tbtnbb.exe 2912 jpdjp.exe 4960 lfxrlfr.exe 736 nnbttb.exe 3016 9dddv.exe 392 rrrfxxx.exe 2284 1htnnn.exe 4144 9vpjd.exe 1408 xrlfrrx.exe 404 tnnbtn.exe 1440 jpvpp.exe 464 rfrlfff.exe 4848 9tbbbh.exe 4596 jdvvj.exe 3952 tbnhbn.exe 4712 9thbnn.exe 4824 jdddd.exe 1360 3xxrrrr.exe 1128 tbnhhh.exe 2024 ppppp.exe 1688 jvdvp.exe 4948 fllfrxx.exe 628 nhnnnn.exe 5112 jjvpj.exe 4844 rllfffx.exe 3844 nbhbtt.exe 4688 3hbbtt.exe 3244 pjjdd.exe 4892 vvdvp.exe 4232 3flfffl.exe -
resource yara_rule behavioral2/memory/2084-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2084-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00050000000232a4-6.dat upx behavioral2/memory/3548-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002344c-11.dat upx behavioral2/files/0x000700000002344d-15.dat upx behavioral2/memory/1408-18-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344e-21.dat upx behavioral2/memory/4152-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002344f-29.dat upx behavioral2/memory/2696-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023450-34.dat upx behavioral2/memory/404-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023451-42.dat upx behavioral2/memory/224-41-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023452-45.dat upx behavioral2/memory/3984-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3284-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023453-52.dat upx behavioral2/memory/1028-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023454-59.dat upx behavioral2/memory/1028-61-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1412-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023455-67.dat upx behavioral2/memory/764-69-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023456-71.dat upx behavioral2/files/0x0007000000023457-76.dat upx behavioral2/memory/3800-79-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3800-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023458-83.dat upx behavioral2/memory/1768-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023459-89.dat upx behavioral2/memory/1960-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345a-94.dat upx behavioral2/files/0x000700000002345b-101.dat upx behavioral2/files/0x000700000002345c-107.dat upx behavioral2/memory/2736-104-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4892-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345d-113.dat upx behavioral2/files/0x0009000000023446-116.dat upx behavioral2/memory/3588-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4380-121-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002345e-123.dat upx behavioral2/files/0x000700000002345f-130.dat upx behavioral2/memory/3336-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3640-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023460-135.dat upx behavioral2/memory/2552-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023461-142.dat upx behavioral2/memory/3316-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023462-148.dat upx behavioral2/files/0x0007000000023463-152.dat upx behavioral2/memory/3580-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023464-158.dat upx behavioral2/memory/1716-162-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4776-161-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023465-166.dat upx behavioral2/memory/4452-171-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00050000000006cf-172.dat upx behavioral2/memory/3040-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0004000000022ae1-178.dat upx behavioral2/memory/1652-181-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023466-184.dat upx behavioral2/files/0x0007000000023467-189.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 3548 2084 1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe 82 PID 2084 wrote to memory of 3548 2084 1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe 82 PID 2084 wrote to memory of 3548 2084 1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe 82 PID 3548 wrote to memory of 1408 3548 jjpdd.exe 83 PID 3548 wrote to memory of 1408 3548 jjpdd.exe 83 PID 3548 wrote to memory of 1408 3548 jjpdd.exe 83 PID 1408 wrote to memory of 404 1408 xfrrlrl.exe 84 PID 1408 wrote to memory of 404 1408 xfrrlrl.exe 84 PID 1408 wrote to memory of 404 1408 xfrrlrl.exe 84 PID 404 wrote to memory of 4152 404 rffffrr.exe 85 PID 404 wrote to memory of 4152 404 rffffrr.exe 85 PID 404 wrote to memory of 4152 404 rffffrr.exe 85 PID 4152 wrote to memory of 2696 4152 jjdjv.exe 86 PID 4152 wrote to memory of 2696 4152 jjdjv.exe 86 PID 4152 wrote to memory of 2696 4152 jjdjv.exe 86 PID 2696 wrote to memory of 224 2696 llfxllr.exe 87 PID 2696 wrote to memory of 224 2696 llfxllr.exe 87 PID 2696 wrote to memory of 224 2696 llfxllr.exe 87 PID 224 wrote to memory of 3284 224 xxllllr.exe 89 PID 224 wrote to memory of 3284 224 xxllllr.exe 89 PID 224 wrote to memory of 3284 224 xxllllr.exe 89 PID 3284 wrote to memory of 3984 3284 9jdvp.exe 90 PID 3284 wrote to memory of 3984 3284 9jdvp.exe 90 PID 3284 wrote to memory of 3984 3284 9jdvp.exe 90 PID 3984 wrote to memory of 1028 3984 bthhnn.exe 92 PID 3984 wrote to memory of 1028 3984 bthhnn.exe 92 PID 3984 wrote to memory of 1028 3984 bthhnn.exe 92 PID 1028 wrote to memory of 1412 1028 hbhbhh.exe 93 PID 1028 wrote to memory of 1412 1028 hbhbhh.exe 93 PID 1028 wrote to memory of 1412 1028 hbhbhh.exe 93 PID 1412 wrote to memory of 764 1412 rxflfff.exe 95 PID 1412 wrote to memory of 764 1412 rxflfff.exe 95 PID 1412 wrote to memory of 764 1412 rxflfff.exe 95 PID 764 wrote to memory of 2304 764 djvpj.exe 96 PID 764 wrote to memory of 2304 764 djvpj.exe 96 PID 764 wrote to memory of 2304 764 djvpj.exe 96 PID 2304 wrote to memory of 3800 2304 vppdj.exe 97 PID 2304 wrote to memory of 3800 2304 vppdj.exe 97 PID 2304 wrote to memory of 3800 2304 vppdj.exe 97 PID 3800 wrote to memory of 1768 3800 bnthbn.exe 98 PID 3800 wrote to memory of 1768 3800 bnthbn.exe 98 PID 3800 wrote to memory of 1768 3800 bnthbn.exe 98 PID 1768 wrote to memory of 1960 1768 5djjj.exe 99 PID 1768 wrote to memory of 1960 1768 5djjj.exe 99 PID 1768 wrote to memory of 1960 1768 5djjj.exe 99 PID 1960 wrote to memory of 4892 1960 llfxxrr.exe 100 PID 1960 wrote to memory of 4892 1960 llfxxrr.exe 100 PID 1960 wrote to memory of 4892 1960 llfxxrr.exe 100 PID 4892 wrote to memory of 2736 4892 hbbhbh.exe 101 PID 4892 wrote to memory of 2736 4892 hbbhbh.exe 101 PID 4892 wrote to memory of 2736 4892 hbbhbh.exe 101 PID 2736 wrote to memory of 4412 2736 hnbttn.exe 102 PID 2736 wrote to memory of 4412 2736 hnbttn.exe 102 PID 2736 wrote to memory of 4412 2736 hnbttn.exe 102 PID 4412 wrote to memory of 4380 4412 jvjjj.exe 103 PID 4412 wrote to memory of 4380 4412 jvjjj.exe 103 PID 4412 wrote to memory of 4380 4412 jvjjj.exe 103 PID 4380 wrote to memory of 3588 4380 nthtnn.exe 104 PID 4380 wrote to memory of 3588 4380 nthtnn.exe 104 PID 4380 wrote to memory of 3588 4380 nthtnn.exe 104 PID 3588 wrote to memory of 3336 3588 dvjpd.exe 105 PID 3588 wrote to memory of 3336 3588 dvjpd.exe 105 PID 3588 wrote to memory of 3336 3588 dvjpd.exe 105 PID 3336 wrote to memory of 3640 3336 7dddd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c6b1136ab9be80cfde30a8c24091fe0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jjpdd.exec:\jjpdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\xfrrlrl.exec:\xfrrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\rffffrr.exec:\rffffrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\jjdjv.exec:\jjdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\llfxllr.exec:\llfxllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xxllllr.exec:\xxllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9jdvp.exec:\9jdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\bthhnn.exec:\bthhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\hbhbhh.exec:\hbhbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\rxflfff.exec:\rxflfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\djvpj.exec:\djvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vppdj.exec:\vppdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\bnthbn.exec:\bnthbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\5djjj.exec:\5djjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\llfxxrr.exec:\llfxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hbbhbh.exec:\hbbhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\hnbttn.exec:\hnbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\jvjjj.exec:\jvjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\nthtnn.exec:\nthtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\dvjpd.exec:\dvjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\7dddd.exec:\7dddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\htnhhh.exec:\htnhhh.exe23⤵
- Executes dropped EXE
PID:3640 -
\??\c:\dddvv.exec:\dddvv.exe24⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe25⤵
- Executes dropped EXE
PID:3316 -
\??\c:\bbnnnn.exec:\bbnnnn.exe26⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jdjjd.exec:\jdjjd.exe27⤵
- Executes dropped EXE
PID:4776 -
\??\c:\nhbtnn.exec:\nhbtnn.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bnbthh.exec:\bnbthh.exe29⤵
- Executes dropped EXE
PID:4452 -
\??\c:\rxfffrf.exec:\rxfffrf.exe30⤵
- Executes dropped EXE
PID:3040 -
\??\c:\dpjpj.exec:\dpjpj.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe32⤵
- Executes dropped EXE
PID:4184 -
\??\c:\hbbbhh.exec:\hbbbhh.exe33⤵
- Executes dropped EXE
PID:4884 -
\??\c:\dvjdv.exec:\dvjdv.exe34⤵
- Executes dropped EXE
PID:3192 -
\??\c:\7rrrllx.exec:\7rrrllx.exe35⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tbtnbb.exec:\tbtnbb.exe36⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jpdjp.exec:\jpdjp.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe38⤵
- Executes dropped EXE
PID:4960 -
\??\c:\nnbttb.exec:\nnbttb.exe39⤵
- Executes dropped EXE
PID:736 -
\??\c:\9dddv.exec:\9dddv.exe40⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rrrfxxx.exec:\rrrfxxx.exe41⤵
- Executes dropped EXE
PID:392 -
\??\c:\1htnnn.exec:\1htnnn.exe42⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9vpjd.exec:\9vpjd.exe43⤵
- Executes dropped EXE
PID:4144 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe44⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tnnbtn.exec:\tnnbtn.exe45⤵
- Executes dropped EXE
PID:404 -
\??\c:\jpvpp.exec:\jpvpp.exe46⤵
- Executes dropped EXE
PID:1440 -
\??\c:\rfrlfff.exec:\rfrlfff.exe47⤵
- Executes dropped EXE
PID:464 -
\??\c:\9tbbbh.exec:\9tbbbh.exe48⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jdvvj.exec:\jdvvj.exe49⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tbnhbn.exec:\tbnhbn.exe50⤵
- Executes dropped EXE
PID:3952 -
\??\c:\9thbnn.exec:\9thbnn.exe51⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jdddd.exec:\jdddd.exe52⤵
- Executes dropped EXE
PID:4824 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe53⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tbnhhh.exec:\tbnhhh.exe54⤵
- Executes dropped EXE
PID:1128 -
\??\c:\ppppp.exec:\ppppp.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvdvp.exec:\jvdvp.exe56⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fllfrxx.exec:\fllfrxx.exe57⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhnnnn.exec:\nhnnnn.exe58⤵
- Executes dropped EXE
PID:628 -
\??\c:\jjvpj.exec:\jjvpj.exe59⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rllfffx.exec:\rllfffx.exe60⤵
- Executes dropped EXE
PID:4844 -
\??\c:\nbhbtt.exec:\nbhbtt.exe61⤵
- Executes dropped EXE
PID:3844 -
\??\c:\3hbbtt.exec:\3hbbtt.exe62⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pjjdd.exec:\pjjdd.exe63⤵
- Executes dropped EXE
PID:3244 -
\??\c:\vvdvp.exec:\vvdvp.exe64⤵
- Executes dropped EXE
PID:4892 -
\??\c:\3flfffl.exec:\3flfffl.exe65⤵
- Executes dropped EXE
PID:4232 -
\??\c:\xrrlffx.exec:\xrrlffx.exe66⤵PID:4472
-
\??\c:\hbhbnn.exec:\hbhbnn.exe67⤵PID:3708
-
\??\c:\ppvvj.exec:\ppvvj.exe68⤵PID:992
-
\??\c:\3pppj.exec:\3pppj.exe69⤵PID:1504
-
\??\c:\lflfrrx.exec:\lflfrrx.exe70⤵PID:3360
-
\??\c:\hnnhbb.exec:\hnnhbb.exe71⤵PID:4760
-
\??\c:\nbbbtn.exec:\nbbbtn.exe72⤵PID:876
-
\??\c:\ddddd.exec:\ddddd.exe73⤵PID:3620
-
\??\c:\3rffxff.exec:\3rffxff.exe74⤵PID:3996
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe75⤵PID:1952
-
\??\c:\hbntbt.exec:\hbntbt.exe76⤵PID:1152
-
\??\c:\dpppj.exec:\dpppj.exe77⤵PID:2608
-
\??\c:\jvdvd.exec:\jvdvd.exe78⤵PID:3296
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe79⤵PID:1084
-
\??\c:\xlrlllf.exec:\xlrlllf.exe80⤵PID:3720
-
\??\c:\hbhbbb.exec:\hbhbbb.exe81⤵PID:1652
-
\??\c:\htbttt.exec:\htbttt.exe82⤵PID:3300
-
\??\c:\jpjdp.exec:\jpjdp.exe83⤵PID:3940
-
\??\c:\xlrlllf.exec:\xlrlllf.exe84⤵PID:3260
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe85⤵PID:3768
-
\??\c:\bhhbbb.exec:\bhhbbb.exe86⤵PID:4800
-
\??\c:\tbhhhh.exec:\tbhhhh.exe87⤵PID:4912
-
\??\c:\jpvvj.exec:\jpvvj.exe88⤵PID:4336
-
\??\c:\dpdpj.exec:\dpdpj.exe89⤵PID:736
-
\??\c:\3lfrlfl.exec:\3lfrlfl.exe90⤵PID:1376
-
\??\c:\xxxrllf.exec:\xxxrllf.exe91⤵PID:1436
-
\??\c:\btnhbb.exec:\btnhbb.exe92⤵PID:412
-
\??\c:\dvvpv.exec:\dvvpv.exe93⤵PID:4660
-
\??\c:\9jppp.exec:\9jppp.exe94⤵PID:1408
-
\??\c:\xrxxllr.exec:\xrxxllr.exe95⤵PID:724
-
\??\c:\dvjpv.exec:\dvjpv.exe96⤵PID:3348
-
\??\c:\lxrfrxl.exec:\lxrfrxl.exe97⤵PID:228
-
\??\c:\3hbtnh.exec:\3hbtnh.exe98⤵PID:1692
-
\??\c:\thtnhh.exec:\thtnhh.exe99⤵PID:4540
-
\??\c:\jpppp.exec:\jpppp.exe100⤵PID:1704
-
\??\c:\xffxxxr.exec:\xffxxxr.exe101⤵PID:1244
-
\??\c:\bntthn.exec:\bntthn.exe102⤵PID:4828
-
\??\c:\vvdjd.exec:\vvdjd.exe103⤵PID:4052
-
\??\c:\lfffxxf.exec:\lfffxxf.exe104⤵PID:1428
-
\??\c:\fxxrllf.exec:\fxxrllf.exe105⤵PID:4612
-
\??\c:\bttthn.exec:\bttthn.exe106⤵PID:2540
-
\??\c:\1dvpj.exec:\1dvpj.exe107⤵PID:1388
-
\??\c:\dpjdv.exec:\dpjdv.exe108⤵PID:5028
-
\??\c:\frxxrrl.exec:\frxxrrl.exe109⤵PID:2560
-
\??\c:\lxxxfxx.exec:\lxxxfxx.exe110⤵PID:1316
-
\??\c:\btbbhn.exec:\btbbhn.exe111⤵PID:4656
-
\??\c:\vdjjj.exec:\vdjjj.exe112⤵PID:1552
-
\??\c:\vvddv.exec:\vvddv.exe113⤵PID:3340
-
\??\c:\fxffffx.exec:\fxffffx.exe114⤵PID:4724
-
\??\c:\httthh.exec:\httthh.exe115⤵PID:1656
-
\??\c:\hthtnn.exec:\hthtnn.exe116⤵PID:3376
-
\??\c:\vjpdj.exec:\vjpdj.exe117⤵PID:4380
-
\??\c:\jdjjd.exec:\jdjjd.exe118⤵PID:3588
-
\??\c:\lrrrlll.exec:\lrrrlll.exe119⤵PID:3336
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe120⤵PID:400
-
\??\c:\htttbb.exec:\htttbb.exe121⤵PID:4492
-
\??\c:\tntnhh.exec:\tntnhh.exe122⤵PID:5108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-