Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 02:59
Behavioral task
behavioral1
Sample
d7802181f57be93701be7f29cb7e6c00_NEIKI.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
-
Target
d7802181f57be93701be7f29cb7e6c00_NEIKI.exe
-
Size
221KB
-
MD5
d7802181f57be93701be7f29cb7e6c00
-
SHA1
7712eed21792defcf730acbe103270c813edd15f
-
SHA256
906ac2c42248bc9d9d3f85ae7e02b247211dd332c130fd733b55debaa5c2c83f
-
SHA512
1ab2f4ca2d32043c9c9c03fdab3181b45d5b91c2454fae36f75faceef553eacc9dbd65109b378106dec22b6f9596023a961933ee4a97b51515b8535772771cb1
-
SSDEEP
6144:Jcm4FmowdHoS3dGmS4Z1hraHcpOaKHpaztyzo:T4wFHoS3dJS4ZzeFaKHpCco
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5008-6-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1596-8-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4044-19-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1880-25-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4640-32-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3560-39-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2080-49-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3844-55-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2184-62-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/316-54-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2008-72-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3412-83-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2004-88-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3608-95-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3872-102-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2760-97-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5028-114-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1344-109-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1016-131-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1404-146-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4488-152-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2820-154-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1708-164-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/632-171-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4948-180-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1776-190-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4856-191-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3076-198-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3428-205-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1076-207-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1076-210-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/336-212-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4124-217-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4604-219-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/880-226-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2160-240-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/956-256-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1448-262-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1328-266-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4436-277-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4728-290-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4396-296-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5028-303-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2316-305-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3096-311-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4576-313-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3144-325-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3696-335-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/740-339-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3496-371-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1880-404-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4324-410-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1984-421-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1652-417-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/2020-471-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5016-480-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4064-482-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4488-485-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4184-492-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/4736-532-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/3772-671-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1772-696-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/1956-835-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral2/memory/5116-856-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0009000000023437-10.dat family_berbew behavioral2/files/0x00070000000232a4-4.dat family_berbew behavioral2/files/0x000800000002343f-16.dat family_berbew behavioral2/files/0x0007000000023440-22.dat family_berbew behavioral2/files/0x0007000000023441-28.dat family_berbew behavioral2/files/0x0007000000023443-40.dat family_berbew behavioral2/files/0x0007000000023446-60.dat family_berbew behavioral2/files/0x0007000000023445-52.dat family_berbew behavioral2/files/0x0007000000023447-64.dat family_berbew behavioral2/files/0x0007000000023444-46.dat family_berbew behavioral2/files/0x0007000000023442-35.dat family_berbew behavioral2/files/0x0007000000023448-70.dat family_berbew behavioral2/files/0x0007000000023449-76.dat family_berbew behavioral2/files/0x000700000002344a-81.dat family_berbew behavioral2/files/0x000700000002344b-87.dat family_berbew behavioral2/files/0x000700000002344c-92.dat family_berbew behavioral2/files/0x000700000002344d-99.dat family_berbew behavioral2/files/0x000700000002344e-105.dat family_berbew behavioral2/files/0x000700000002344f-111.dat family_berbew behavioral2/files/0x0007000000023450-117.dat family_berbew behavioral2/files/0x0007000000023451-122.dat family_berbew behavioral2/files/0x0007000000023452-127.dat family_berbew behavioral2/files/0x000a000000023438-134.dat family_berbew behavioral2/files/0x0007000000023453-138.dat family_berbew behavioral2/files/0x0007000000023454-145.dat family_berbew behavioral2/files/0x0007000000023455-151.dat family_berbew behavioral2/files/0x00080000000233ca-156.dat family_berbew behavioral2/files/0x0007000000023456-163.dat family_berbew behavioral2/files/0x0007000000023457-167.dat family_berbew behavioral2/files/0x0007000000023458-174.dat family_berbew behavioral2/files/0x0007000000023459-178.dat family_berbew behavioral2/files/0x00080000000233c8-184.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1596 thnthb.exe 4044 jvvvv.exe 2908 5ppjp.exe 1880 dpvvp.exe 4640 9nhbtt.exe 3560 7jjdv.exe 2080 vdpdj.exe 3844 xrfxffl.exe 316 nttthh.exe 2184 nbnhbb.exe 2008 vjjjp.exe 4580 tnttnt.exe 3412 pjvvv.exe 2004 fxxrrxr.exe 3608 hnbtbb.exe 2760 flxxxff.exe 3872 xfffxxl.exe 1344 dvdvj.exe 5028 5pvjd.exe 5004 hbtnnn.exe 4980 ttthbb.exe 1016 frfrlll.exe 2028 9xxfxxf.exe 1404 vjppj.exe 4488 1lrlllr.exe 2820 tntnnn.exe 4972 xrllxxl.exe 1708 lrflfrr.exe 632 9thbbb.exe 4948 djpjv.exe 3692 5hhbtb.exe 1776 jjpjp.exe 4856 fllffll.exe 1224 hnnhbt.exe 3076 7bbtnn.exe 3428 vppjd.exe 1076 rxrllff.exe 336 flllfff.exe 4124 hhbtbb.exe 4604 jpdvp.exe 1908 vvvpp.exe 880 1lrrxxf.exe 2880 7rrrfrl.exe 3868 thhbbb.exe 2588 nbntht.exe 2160 7jjdv.exe 4640 jvvdv.exe 4924 xrxrlll.exe 316 hbbtnn.exe 3216 nbbbtt.exe 956 dvvpj.exe 1448 1vdpd.exe 1328 7rrxrrr.exe 2008 hbnhbt.exe 1400 thhbtt.exe 2848 5djjd.exe 4436 pjjdv.exe 2004 9fllfxr.exe 3680 1fxrlfx.exe 3456 hbnhhh.exe 4728 httnhh.exe 4396 jpvvd.exe 4940 vjvpp.exe 5028 3xlffff.exe -
resource yara_rule behavioral2/memory/5008-0-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/5008-6-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1596-8-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0009000000023437-10.dat upx behavioral2/memory/4044-13-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00070000000232a4-4.dat upx behavioral2/files/0x000800000002343f-16.dat upx behavioral2/memory/4044-19-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023440-22.dat upx behavioral2/memory/1880-25-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023441-28.dat upx behavioral2/memory/4640-32-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3560-39-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023443-40.dat upx behavioral2/memory/2080-49-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/3844-55-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023446-60.dat upx behavioral2/memory/2184-62-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/316-54-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023445-52.dat upx behavioral2/files/0x0007000000023447-64.dat upx behavioral2/files/0x0007000000023444-46.dat upx behavioral2/files/0x0007000000023442-35.dat upx behavioral2/files/0x0007000000023448-70.dat upx behavioral2/memory/4580-73-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2008-72-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023449-76.dat upx behavioral2/files/0x000700000002344a-81.dat upx behavioral2/memory/3412-83-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2004-88-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344b-87.dat upx behavioral2/files/0x000700000002344c-92.dat upx behavioral2/memory/3608-95-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344d-99.dat upx behavioral2/memory/3872-102-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/2760-97-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000700000002344e-105.dat upx behavioral2/files/0x000700000002344f-111.dat upx behavioral2/files/0x0007000000023450-117.dat upx behavioral2/memory/5028-114-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/1344-109-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023451-122.dat upx behavioral2/files/0x0007000000023452-127.dat upx behavioral2/memory/1016-131-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x000a000000023438-134.dat upx behavioral2/files/0x0007000000023453-138.dat upx behavioral2/memory/1404-141-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023454-145.dat upx behavioral2/memory/1404-146-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4488-152-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023455-151.dat upx behavioral2/memory/4488-147-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00080000000233ca-156.dat upx behavioral2/memory/2820-154-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023456-163.dat upx behavioral2/memory/1708-164-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023457-167.dat upx behavioral2/files/0x0007000000023458-174.dat upx behavioral2/memory/632-171-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x0007000000023459-178.dat upx behavioral2/memory/4948-180-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/files/0x00080000000233c8-184.dat upx behavioral2/memory/1776-190-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral2/memory/4856-191-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5008 wrote to memory of 1596 5008 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 80 PID 5008 wrote to memory of 1596 5008 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 80 PID 5008 wrote to memory of 1596 5008 d7802181f57be93701be7f29cb7e6c00_NEIKI.exe 80 PID 1596 wrote to memory of 4044 1596 thnthb.exe 81 PID 1596 wrote to memory of 4044 1596 thnthb.exe 81 PID 1596 wrote to memory of 4044 1596 thnthb.exe 81 PID 4044 wrote to memory of 2908 4044 jvvvv.exe 84 PID 4044 wrote to memory of 2908 4044 jvvvv.exe 84 PID 4044 wrote to memory of 2908 4044 jvvvv.exe 84 PID 2908 wrote to memory of 1880 2908 5ppjp.exe 85 PID 2908 wrote to memory of 1880 2908 5ppjp.exe 85 PID 2908 wrote to memory of 1880 2908 5ppjp.exe 85 PID 1880 wrote to memory of 4640 1880 dpvvp.exe 87 PID 1880 wrote to memory of 4640 1880 dpvvp.exe 87 PID 1880 wrote to memory of 4640 1880 dpvvp.exe 87 PID 4640 wrote to memory of 3560 4640 9nhbtt.exe 88 PID 4640 wrote to memory of 3560 4640 9nhbtt.exe 88 PID 4640 wrote to memory of 3560 4640 9nhbtt.exe 88 PID 3560 wrote to memory of 2080 3560 7jjdv.exe 89 PID 3560 wrote to memory of 2080 3560 7jjdv.exe 89 PID 3560 wrote to memory of 2080 3560 7jjdv.exe 89 PID 2080 wrote to memory of 3844 2080 vdpdj.exe 90 PID 2080 wrote to memory of 3844 2080 vdpdj.exe 90 PID 2080 wrote to memory of 3844 2080 vdpdj.exe 90 PID 3844 wrote to memory of 316 3844 xrfxffl.exe 91 PID 3844 wrote to memory of 316 3844 xrfxffl.exe 91 PID 3844 wrote to memory of 316 3844 xrfxffl.exe 91 PID 316 wrote to memory of 2184 316 nttthh.exe 92 PID 316 wrote to memory of 2184 316 nttthh.exe 92 PID 316 wrote to memory of 2184 316 nttthh.exe 92 PID 2184 wrote to memory of 2008 2184 nbnhbb.exe 93 PID 2184 wrote to memory of 2008 2184 nbnhbb.exe 93 PID 2184 wrote to memory of 2008 2184 nbnhbb.exe 93 PID 2008 wrote to memory of 4580 2008 vjjjp.exe 94 PID 2008 wrote to memory of 4580 2008 vjjjp.exe 94 PID 2008 wrote to memory of 4580 2008 vjjjp.exe 94 PID 4580 wrote to memory of 3412 4580 tnttnt.exe 95 PID 4580 wrote to memory of 3412 4580 tnttnt.exe 95 PID 4580 wrote to memory of 3412 4580 tnttnt.exe 95 PID 3412 wrote to memory of 2004 3412 pjvvv.exe 96 PID 3412 wrote to memory of 2004 3412 pjvvv.exe 96 PID 3412 wrote to memory of 2004 3412 pjvvv.exe 96 PID 2004 wrote to memory of 3608 2004 fxxrrxr.exe 97 PID 2004 wrote to memory of 3608 2004 fxxrrxr.exe 97 PID 2004 wrote to memory of 3608 2004 fxxrrxr.exe 97 PID 3608 wrote to memory of 2760 3608 hnbtbb.exe 98 PID 3608 wrote to memory of 2760 3608 hnbtbb.exe 98 PID 3608 wrote to memory of 2760 3608 hnbtbb.exe 98 PID 2760 wrote to memory of 3872 2760 flxxxff.exe 100 PID 2760 wrote to memory of 3872 2760 flxxxff.exe 100 PID 2760 wrote to memory of 3872 2760 flxxxff.exe 100 PID 3872 wrote to memory of 1344 3872 xfffxxl.exe 101 PID 3872 wrote to memory of 1344 3872 xfffxxl.exe 101 PID 3872 wrote to memory of 1344 3872 xfffxxl.exe 101 PID 1344 wrote to memory of 5028 1344 dvdvj.exe 102 PID 1344 wrote to memory of 5028 1344 dvdvj.exe 102 PID 1344 wrote to memory of 5028 1344 dvdvj.exe 102 PID 5028 wrote to memory of 5004 5028 5pvjd.exe 103 PID 5028 wrote to memory of 5004 5028 5pvjd.exe 103 PID 5028 wrote to memory of 5004 5028 5pvjd.exe 103 PID 5004 wrote to memory of 4980 5004 hbtnnn.exe 104 PID 5004 wrote to memory of 4980 5004 hbtnnn.exe 104 PID 5004 wrote to memory of 4980 5004 hbtnnn.exe 104 PID 4980 wrote to memory of 1016 4980 ttthbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7802181f57be93701be7f29cb7e6c00_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d7802181f57be93701be7f29cb7e6c00_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\thnthb.exec:\thnthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\jvvvv.exec:\jvvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\5ppjp.exec:\5ppjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dpvvp.exec:\dpvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\9nhbtt.exec:\9nhbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\7jjdv.exec:\7jjdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vdpdj.exec:\vdpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\xrfxffl.exec:\xrfxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\nttthh.exec:\nttthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\nbnhbb.exec:\nbnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vjjjp.exec:\vjjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\tnttnt.exec:\tnttnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\pjvvv.exec:\pjvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\hnbtbb.exec:\hnbtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\flxxxff.exec:\flxxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xfffxxl.exec:\xfffxxl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\dvdvj.exec:\dvdvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\5pvjd.exec:\5pvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\hbtnnn.exec:\hbtnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\ttthbb.exec:\ttthbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\frfrlll.exec:\frfrlll.exe23⤵
- Executes dropped EXE
PID:1016 -
\??\c:\9xxfxxf.exec:\9xxfxxf.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vjppj.exec:\vjppj.exe25⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1lrlllr.exec:\1lrlllr.exe26⤵
- Executes dropped EXE
PID:4488 -
\??\c:\tntnnn.exec:\tntnnn.exe27⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xrllxxl.exec:\xrllxxl.exe28⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lrflfrr.exec:\lrflfrr.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9thbbb.exec:\9thbbb.exe30⤵
- Executes dropped EXE
PID:632 -
\??\c:\djpjv.exec:\djpjv.exe31⤵
- Executes dropped EXE
PID:4948 -
\??\c:\5hhbtb.exec:\5hhbtb.exe32⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jjpjp.exec:\jjpjp.exe33⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fllffll.exec:\fllffll.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hnnhbt.exec:\hnnhbt.exe35⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7bbtnn.exec:\7bbtnn.exe36⤵
- Executes dropped EXE
PID:3076 -
\??\c:\vppjd.exec:\vppjd.exe37⤵
- Executes dropped EXE
PID:3428 -
\??\c:\rxrllff.exec:\rxrllff.exe38⤵
- Executes dropped EXE
PID:1076 -
\??\c:\flllfff.exec:\flllfff.exe39⤵
- Executes dropped EXE
PID:336 -
\??\c:\hhbtbb.exec:\hhbtbb.exe40⤵
- Executes dropped EXE
PID:4124 -
\??\c:\jpdvp.exec:\jpdvp.exe41⤵
- Executes dropped EXE
PID:4604 -
\??\c:\vvvpp.exec:\vvvpp.exe42⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1lrrxxf.exec:\1lrrxxf.exe43⤵
- Executes dropped EXE
PID:880 -
\??\c:\7rrrfrl.exec:\7rrrfrl.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\thhbbb.exec:\thhbbb.exe45⤵
- Executes dropped EXE
PID:3868 -
\??\c:\nbntht.exec:\nbntht.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7jjdv.exec:\7jjdv.exe47⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jvvdv.exec:\jvvdv.exe48⤵
- Executes dropped EXE
PID:4640 -
\??\c:\xrxrlll.exec:\xrxrlll.exe49⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hbbtnn.exec:\hbbtnn.exe50⤵
- Executes dropped EXE
PID:316 -
\??\c:\nbbbtt.exec:\nbbbtt.exe51⤵
- Executes dropped EXE
PID:3216 -
\??\c:\dvvpj.exec:\dvvpj.exe52⤵
- Executes dropped EXE
PID:956 -
\??\c:\1vdpd.exec:\1vdpd.exe53⤵
- Executes dropped EXE
PID:1448 -
\??\c:\7rrxrrr.exec:\7rrxrrr.exe54⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hbnhbt.exec:\hbnhbt.exe55⤵
- Executes dropped EXE
PID:2008 -
\??\c:\thhbtt.exec:\thhbtt.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\5djjd.exec:\5djjd.exe57⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjjdv.exec:\pjjdv.exe58⤵
- Executes dropped EXE
PID:4436 -
\??\c:\9fllfxr.exec:\9fllfxr.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1fxrlfx.exec:\1fxrlfx.exe60⤵
- Executes dropped EXE
PID:3680 -
\??\c:\hbnhhh.exec:\hbnhhh.exe61⤵
- Executes dropped EXE
PID:3456 -
\??\c:\httnhh.exec:\httnhh.exe62⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jpvvd.exec:\jpvvd.exe63⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vjvpp.exec:\vjvpp.exe64⤵
- Executes dropped EXE
PID:4940 -
\??\c:\3xlffff.exec:\3xlffff.exe65⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hntnhh.exec:\hntnhh.exe66⤵PID:2316
-
\??\c:\hnnhtt.exec:\hnnhtt.exe67⤵PID:3096
-
\??\c:\vvddv.exec:\vvddv.exe68⤵PID:4576
-
\??\c:\rlxxrff.exec:\rlxxrff.exe69⤵PID:1016
-
\??\c:\fxxxllr.exec:\fxxxllr.exe70⤵PID:2132
-
\??\c:\1bbnhh.exec:\1bbnhh.exe71⤵PID:4008
-
\??\c:\9ttnhh.exec:\9ttnhh.exe72⤵PID:3144
-
\??\c:\jvdjd.exec:\jvdjd.exe73⤵PID:852
-
\??\c:\rffxrrl.exec:\rffxrrl.exe74⤵PID:3696
-
\??\c:\hnnhnt.exec:\hnnhnt.exe75⤵PID:740
-
\??\c:\jjpjj.exec:\jjpjj.exe76⤵PID:1392
-
\??\c:\jjvpj.exec:\jjvpj.exe77⤵PID:4680
-
\??\c:\lffxrfx.exec:\lffxrfx.exe78⤵PID:632
-
\??\c:\3rrlffx.exec:\3rrlffx.exe79⤵PID:3664
-
\??\c:\hbbtbb.exec:\hbbtbb.exe80⤵PID:3632
-
\??\c:\5ttnbb.exec:\5ttnbb.exe81⤵PID:2192
-
\??\c:\pjjpd.exec:\pjjpd.exe82⤵PID:232
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe83⤵PID:4224
-
\??\c:\5xfxxxx.exec:\5xfxxxx.exe84⤵PID:648
-
\??\c:\ttbbhh.exec:\ttbbhh.exe85⤵PID:2356
-
\??\c:\bhhtbt.exec:\bhhtbt.exe86⤵PID:3496
-
\??\c:\ddpjj.exec:\ddpjj.exe87⤵PID:4316
-
\??\c:\djjdd.exec:\djjdd.exe88⤵PID:4412
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe89⤵PID:4380
-
\??\c:\flrxllf.exec:\flrxllf.exe90⤵PID:4648
-
\??\c:\9ttnhh.exec:\9ttnhh.exe91⤵PID:3444
-
\??\c:\hhnntt.exec:\hhnntt.exe92⤵PID:4920
-
\??\c:\pjjdv.exec:\pjjdv.exe93⤵PID:1340
-
\??\c:\vpdjd.exec:\vpdjd.exe94⤵PID:3516
-
\??\c:\1rfrlll.exec:\1rfrlll.exe95⤵PID:1796
-
\??\c:\xlrlffx.exec:\xlrlffx.exe96⤵PID:1144
-
\??\c:\3ntttt.exec:\3ntttt.exe97⤵PID:1880
-
\??\c:\nbhbtn.exec:\nbhbtn.exe98⤵PID:800
-
\??\c:\7vddv.exec:\7vddv.exe99⤵PID:4324
-
\??\c:\9vdvv.exec:\9vdvv.exe100⤵PID:1652
-
\??\c:\1ffxrfx.exec:\1ffxrfx.exe101⤵PID:1984
-
\??\c:\xrrrllf.exec:\xrrrllf.exe102⤵PID:756
-
\??\c:\nbbtbt.exec:\nbbtbt.exe103⤵PID:4232
-
\??\c:\bntnhb.exec:\bntnhb.exe104⤵PID:412
-
\??\c:\5vdvd.exec:\5vdvd.exe105⤵PID:3416
-
\??\c:\7vppv.exec:\7vppv.exe106⤵PID:2520
-
\??\c:\fffrllf.exec:\fffrllf.exe107⤵PID:4348
-
\??\c:\5rxrllf.exec:\5rxrllf.exe108⤵PID:2780
-
\??\c:\tthbtt.exec:\tthbtt.exe109⤵PID:2712
-
\??\c:\nbbnhb.exec:\nbbnhb.exe110⤵PID:1592
-
\??\c:\pdpjd.exec:\pdpjd.exe111⤵PID:4632
-
\??\c:\pjjdv.exec:\pjjdv.exe112⤵PID:2308
-
\??\c:\rlxxrfr.exec:\rlxxrfr.exe113⤵PID:4536
-
\??\c:\fxxxrrf.exec:\fxxxrrf.exe114⤵PID:2436
-
\??\c:\tntntn.exec:\tntntn.exe115⤵PID:1124
-
\??\c:\dpjdd.exec:\dpjdd.exe116⤵PID:4468
-
\??\c:\pjpjd.exec:\pjpjd.exe117⤵PID:3636
-
\??\c:\frfffff.exec:\frfffff.exe118⤵PID:2020
-
\??\c:\fflfxrx.exec:\fflfxrx.exe119⤵PID:1700
-
\??\c:\ntbhhh.exec:\ntbhhh.exe120⤵PID:5016
-
\??\c:\1nhbbb.exec:\1nhbbb.exe121⤵PID:4064
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:4488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-