Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
09/05/2024, 15:00
Behavioral task
behavioral1
Sample
69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
- Target 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe
- Size 211KB
- Sample240509-sdmc5afg3w
- SHA256 da8e28b57626c2527da39e7a8be27251a7125ebf187c96ad52be6efe0617df18
- MD5 69a3b9a1985d6e2a6a010334415fa1e0
- SHA1 991dc42559906353b764d027ee6616c67db99e63
- SHA512 c1d2243ff02a1cfa46d2a7e02052d675171e2c0e4a0ba966e6e9a7582e6482f3d9fb67e38793213b3e57d3fc0aa9ac60ea4ba9e6b3bc31eb611e95124cdccc7a
- SSDEEP 6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+l5:V4wFHoSBK/ubLcfj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1652-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1996-10-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1628-32-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2180-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2848-50-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2724-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2684-46-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2584-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2440-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/348-92-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2808-103-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2064-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/300-130-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1512-140-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/300-137-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2332-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1220-166-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1292-176-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2424-201-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1492-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/632-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1608-263-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1280-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2636-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/876-335-0x0000000000260000-0x0000000000294000-memory.dmp family_blackmoon behavioral1/memory/2680-386-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2640-413-0x00000000003C0000-0x00000000003F4000-memory.dmp family_blackmoon behavioral1/memory/2196-426-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/300-440-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1040-467-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1840-469-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2104-494-0x00000000002C0000-0x00000000002F4000-memory.dmp family_blackmoon behavioral1/memory/488-515-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1612-522-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2984-703-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2916-714-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1220-752-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1524-841-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2512-966-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2924-993-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2268-1009-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1504-1134-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/1652-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x000c00000001432c-5.dat family_berbew behavioral1/memory/1652-7-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1996-10-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0036000000014594-17.dat family_berbew behavioral1/memory/2180-18-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2180-25-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/files/0x0007000000014857-30.dat family_berbew behavioral1/memory/1628-32-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2180-29-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0007000000014971-38.dat family_berbew behavioral1/memory/2848-50-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0007000000014aa2-48.dat family_berbew behavioral1/memory/2724-59-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0009000000014b27-57.dat family_berbew behavioral1/memory/2684-46-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0009000000014b63-64.dat family_berbew behavioral1/memory/2584-68-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2440-76-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0008000000015ca6-75.dat family_berbew behavioral1/files/0x0006000000015cba-83.dat family_berbew behavioral1/files/0x0006000000015cd5-91.dat family_berbew behavioral1/memory/348-92-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015ce1-99.dat family_berbew behavioral1/memory/2808-103-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015ceb-109.dat family_berbew behavioral1/files/0x0006000000015d07-116.dat family_berbew behavioral1/memory/2064-119-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d28-127.dat family_berbew behavioral1/memory/300-130-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2584-128-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/memory/300-135-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/files/0x0006000000015d4a-138.dat family_berbew behavioral1/memory/1512-140-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/300-137-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/files/0x0006000000015d56-147.dat family_berbew behavioral1/files/0x003500000001459f-154.dat family_berbew behavioral1/memory/2332-156-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1220-157-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d5e-164.dat family_berbew behavioral1/memory/1220-166-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d67-174.dat family_berbew behavioral1/memory/1292-176-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d6f-183.dat family_berbew behavioral1/files/0x0006000000015d79-190.dat family_berbew behavioral1/memory/2424-192-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d87-199.dat family_berbew behavioral1/memory/2424-201-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d8f-208.dat family_berbew behavioral1/memory/1492-210-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015d9b-217.dat family_berbew behavioral1/memory/632-220-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/632-228-0x00000000001B0000-0x00000000001E4000-memory.dmp family_berbew behavioral1/files/0x0006000000015e3a-231.dat family_berbew behavioral1/memory/632-230-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000015eaf-238.dat family_berbew behavioral1/files/0x0006000000015f6d-246.dat family_berbew behavioral1/files/0x0006000000015fe9-254.dat family_berbew behavioral1/files/0x0006000000016117-264.dat family_berbew behavioral1/memory/1608-263-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1280-272-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x00060000000161e7-273.dat family_berbew behavioral1/files/0x000600000001630b-281.dat family_berbew behavioral1/files/0x00060000000164b2-289.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 1996 7xrrxfl.exe 2180 8286666.exe 1628 4282828.exe 2684 vdvvd.exe 2848 xxlrxfr.exe 2724 02082.exe 2584 7nbttb.exe 2440 lfxlxfr.exe 348 04408.exe 2952 644280.exe 2808 0466266.exe 2940 7flfrrr.exe 2064 9fxxxff.exe 300 5lxxfxf.exe 1512 rflfffl.exe 2332 1ttttn.exe 1220 pdjdv.exe 844 42624.exe 1292 446824.exe 2264 828082.exe 2424 fxffxrx.exe 1492 5nhhbb.exe 324 866600.exe 632 m4662.exe 1880 lfllrlr.exe 1748 86800.exe 1344 60240.exe 1608 7vjpj.exe 1280 0484002.exe 2880 7jppv.exe 1692 2862820.exe 312 xllllrr.exe 876 400664.exe 2248 vjvpv.exe 3020 1rfxxrr.exe 3068 thhhnh.exe 2636 1dpvd.exe 2164 lxlllff.exe 2120 084460.exe 1628 a8684.exe 1236 464006.exe 2656 dvjdd.exe 2676 08006.exe 2640 9dpjd.exe 2408 9pvjd.exe 2680 6082262.exe 2116 6428868.exe 2960 080466.exe 2820 5dvvv.exe 2944 8622824.exe 2936 rlxfrrx.exe 2972 482628.exe 2196 a8044.exe 300 0802446.exe 1484 1frrrrl.exe 2836 vjpvj.exe 2804 i060006.exe 1040 bbhtnn.exe 1840 flrflfl.exe 1308 jvjjv.exe 2068 60446.exe 2104 0600400.exe 1256 460026.exe 1804 4866228.exe -
resource yara_rule behavioral1/memory/1652-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000c00000001432c-5.dat upx behavioral1/memory/1652-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1996-10-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0036000000014594-17.dat upx behavioral1/memory/2180-18-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2180-25-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/files/0x0007000000014857-30.dat upx behavioral1/memory/1628-32-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2180-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000014971-38.dat upx behavioral1/memory/2848-50-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000014aa2-48.dat upx behavioral1/memory/2724-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000014b27-57.dat upx behavioral1/memory/2684-46-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000014b63-64.dat upx behavioral1/memory/2584-68-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2440-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0008000000015ca6-75.dat upx behavioral1/files/0x0006000000015cba-83.dat upx behavioral1/files/0x0006000000015cd5-91.dat upx behavioral1/memory/348-92-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015ce1-99.dat upx behavioral1/memory/2808-103-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015ceb-109.dat upx behavioral1/files/0x0006000000015d07-116.dat upx behavioral1/memory/2064-119-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d28-127.dat upx behavioral1/memory/300-130-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/300-135-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/files/0x0006000000015d4a-138.dat upx behavioral1/memory/1512-140-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d56-147.dat upx behavioral1/files/0x003500000001459f-154.dat upx behavioral1/memory/2332-156-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1220-157-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d5e-164.dat upx behavioral1/memory/1220-166-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d67-174.dat upx behavioral1/memory/1292-176-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d6f-183.dat upx behavioral1/files/0x0006000000015d79-190.dat upx behavioral1/memory/2424-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d87-199.dat upx behavioral1/memory/2424-201-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d8f-208.dat upx behavioral1/memory/1492-210-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015d9b-217.dat upx behavioral1/memory/632-220-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015e3a-231.dat upx behavioral1/memory/632-230-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000015eaf-238.dat upx behavioral1/files/0x0006000000015f6d-246.dat upx behavioral1/files/0x0006000000015fe9-254.dat upx behavioral1/files/0x0006000000016117-264.dat upx behavioral1/memory/1608-263-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1280-272-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x00060000000161e7-273.dat upx behavioral1/files/0x000600000001630b-281.dat upx behavioral1/files/0x00060000000164b2-289.dat upx behavioral1/memory/2636-328-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2680-386-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2944-406-0x0000000000400000-0x0000000000434000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1996 1652 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 28 PID 1652 wrote to memory of 1996 1652 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 28 PID 1652 wrote to memory of 1996 1652 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 28 PID 1652 wrote to memory of 1996 1652 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 28 PID 1996 wrote to memory of 2180 1996 7xrrxfl.exe 29 PID 1996 wrote to memory of 2180 1996 7xrrxfl.exe 29 PID 1996 wrote to memory of 2180 1996 7xrrxfl.exe 29 PID 1996 wrote to memory of 2180 1996 7xrrxfl.exe 29 PID 2180 wrote to memory of 1628 2180 8286666.exe 30 PID 2180 wrote to memory of 1628 2180 8286666.exe 30 PID 2180 wrote to memory of 1628 2180 8286666.exe 30 PID 2180 wrote to memory of 1628 2180 8286666.exe 30 PID 1628 wrote to memory of 2684 1628 4282828.exe 31 PID 1628 wrote to memory of 2684 1628 4282828.exe 31 PID 1628 wrote to memory of 2684 1628 4282828.exe 31 PID 1628 wrote to memory of 2684 1628 4282828.exe 31 PID 2684 wrote to memory of 2848 2684 vdvvd.exe 32 PID 2684 wrote to memory of 2848 2684 vdvvd.exe 32 PID 2684 wrote to memory of 2848 2684 vdvvd.exe 32 PID 2684 wrote to memory of 2848 2684 vdvvd.exe 32 PID 2848 wrote to memory of 2724 2848 xxlrxfr.exe 33 PID 2848 wrote to memory of 2724 2848 xxlrxfr.exe 33 PID 2848 wrote to memory of 2724 2848 xxlrxfr.exe 33 PID 2848 wrote to memory of 2724 2848 xxlrxfr.exe 33 PID 2724 wrote to memory of 2584 2724 02082.exe 34 PID 2724 wrote to memory of 2584 2724 02082.exe 34 PID 2724 wrote to memory of 2584 2724 02082.exe 34 PID 2724 wrote to memory of 2584 2724 02082.exe 34 PID 2584 wrote to memory of 2440 2584 7nbttb.exe 35 PID 2584 wrote to memory of 2440 2584 7nbttb.exe 35 PID 2584 wrote to memory of 2440 2584 7nbttb.exe 35 PID 2584 wrote to memory of 2440 2584 7nbttb.exe 35 PID 2440 wrote to memory of 348 2440 lfxlxfr.exe 36 PID 2440 wrote to memory of 348 2440 lfxlxfr.exe 36 PID 2440 wrote to memory of 348 2440 lfxlxfr.exe 36 PID 2440 wrote to memory of 348 2440 lfxlxfr.exe 36 PID 348 wrote to memory of 2952 348 04408.exe 37 PID 348 wrote to memory of 2952 348 04408.exe 37 PID 348 wrote to memory of 2952 348 04408.exe 37 PID 348 wrote to memory of 2952 348 04408.exe 37 PID 2952 wrote to memory of 2808 2952 644280.exe 38 PID 2952 wrote to memory of 2808 2952 644280.exe 38 PID 2952 wrote to memory of 2808 2952 644280.exe 38 PID 2952 wrote to memory of 2808 2952 644280.exe 38 PID 2808 wrote to memory of 2940 2808 0466266.exe 39 PID 2808 wrote to memory of 2940 2808 0466266.exe 39 PID 2808 wrote to memory of 2940 2808 0466266.exe 39 PID 2808 wrote to memory of 2940 2808 0466266.exe 39 PID 2940 wrote to memory of 2064 2940 7flfrrr.exe 40 PID 2940 wrote to memory of 2064 2940 7flfrrr.exe 40 PID 2940 wrote to memory of 2064 2940 7flfrrr.exe 40 PID 2940 wrote to memory of 2064 2940 7flfrrr.exe 40 PID 2064 wrote to memory of 300 2064 9fxxxff.exe 41 PID 2064 wrote to memory of 300 2064 9fxxxff.exe 41 PID 2064 wrote to memory of 300 2064 9fxxxff.exe 41 PID 2064 wrote to memory of 300 2064 9fxxxff.exe 41 PID 300 wrote to memory of 1512 300 5lxxfxf.exe 42 PID 300 wrote to memory of 1512 300 5lxxfxf.exe 42 PID 300 wrote to memory of 1512 300 5lxxfxf.exe 42 PID 300 wrote to memory of 1512 300 5lxxfxf.exe 42 PID 1512 wrote to memory of 2332 1512 rflfffl.exe 43 PID 1512 wrote to memory of 2332 1512 rflfffl.exe 43 PID 1512 wrote to memory of 2332 1512 rflfffl.exe 43 PID 1512 wrote to memory of 2332 1512 rflfffl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\7xrrxfl.exec:\7xrrxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\8286666.exec:\8286666.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\4282828.exec:\4282828.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\vdvvd.exec:\vdvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\02082.exec:\02082.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7nbttb.exec:\7nbttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\04408.exec:\04408.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\644280.exec:\644280.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\0466266.exec:\0466266.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\7flfrrr.exec:\7flfrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9fxxxff.exec:\9fxxxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\5lxxfxf.exec:\5lxxfxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\rflfffl.exec:\rflfffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\1ttttn.exec:\1ttttn.exe17⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pdjdv.exec:\pdjdv.exe18⤵
- Executes dropped EXE
PID:1220 -
\??\c:\42624.exec:\42624.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\446824.exec:\446824.exe20⤵
- Executes dropped EXE
PID:1292 -
\??\c:\828082.exec:\828082.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxffxrx.exec:\fxffxrx.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5nhhbb.exec:\5nhhbb.exe23⤵
- Executes dropped EXE
PID:1492 -
\??\c:\866600.exec:\866600.exe24⤵
- Executes dropped EXE
PID:324 -
\??\c:\m4662.exec:\m4662.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\lfllrlr.exec:\lfllrlr.exe26⤵
- Executes dropped EXE
PID:1880 -
\??\c:\86800.exec:\86800.exe27⤵
- Executes dropped EXE
PID:1748 -
\??\c:\60240.exec:\60240.exe28⤵
- Executes dropped EXE
PID:1344 -
\??\c:\7vjpj.exec:\7vjpj.exe29⤵
- Executes dropped EXE
PID:1608 -
\??\c:\0484002.exec:\0484002.exe30⤵
- Executes dropped EXE
PID:1280 -
\??\c:\7jppv.exec:\7jppv.exe31⤵
- Executes dropped EXE
PID:2880 -
\??\c:\2862820.exec:\2862820.exe32⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xllllrr.exec:\xllllrr.exe33⤵
- Executes dropped EXE
PID:312 -
\??\c:\400664.exec:\400664.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\vjvpv.exec:\vjvpv.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1rfxxrr.exec:\1rfxxrr.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\thhhnh.exec:\thhhnh.exe37⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1dpvd.exec:\1dpvd.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lxlllff.exec:\lxlllff.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\084460.exec:\084460.exe40⤵
- Executes dropped EXE
PID:2120 -
\??\c:\a8684.exec:\a8684.exe41⤵
- Executes dropped EXE
PID:1628 -
\??\c:\464006.exec:\464006.exe42⤵
- Executes dropped EXE
PID:1236 -
\??\c:\dvjdd.exec:\dvjdd.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\08006.exec:\08006.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9dpjd.exec:\9dpjd.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9pvjd.exec:\9pvjd.exe46⤵
- Executes dropped EXE
PID:2408 -
\??\c:\6082262.exec:\6082262.exe47⤵
- Executes dropped EXE
PID:2680 -
\??\c:\6428868.exec:\6428868.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\080466.exec:\080466.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5dvvv.exec:\5dvvv.exe50⤵
- Executes dropped EXE
PID:2820 -
\??\c:\8622824.exec:\8622824.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\482628.exec:\482628.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\a8044.exec:\a8044.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\0802446.exec:\0802446.exe55⤵
- Executes dropped EXE
PID:300 -
\??\c:\1frrrrl.exec:\1frrrrl.exe56⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vjpvj.exec:\vjpvj.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\i060006.exec:\i060006.exe58⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bbhtnn.exec:\bbhtnn.exe59⤵
- Executes dropped EXE
PID:1040 -
\??\c:\flrflfl.exec:\flrflfl.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jvjjv.exec:\jvjjv.exe61⤵
- Executes dropped EXE
PID:1308 -
\??\c:\60446.exec:\60446.exe62⤵
- Executes dropped EXE
PID:2068 -
\??\c:\0600400.exec:\0600400.exe63⤵
- Executes dropped EXE
PID:2104 -
\??\c:\460026.exec:\460026.exe64⤵
- Executes dropped EXE
PID:1256 -
\??\c:\4866228.exec:\4866228.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9xxfxxf.exec:\9xxfxxf.exe66⤵PID:488
-
\??\c:\btnntt.exec:\btnntt.exe67⤵PID:1612
-
\??\c:\frlllll.exec:\frlllll.exe68⤵PID:632
-
\??\c:\htbbhh.exec:\htbbhh.exe69⤵PID:2416
-
\??\c:\6462824.exec:\6462824.exe70⤵PID:2284
-
\??\c:\vjjpv.exec:\vjjpv.exe71⤵PID:1748
-
\??\c:\hbnthh.exec:\hbnthh.exe72⤵PID:1876
-
\??\c:\8688062.exec:\8688062.exe73⤵PID:384
-
\??\c:\6644046.exec:\6644046.exe74⤵PID:656
-
\??\c:\xlxxllr.exec:\xlxxllr.exe75⤵PID:2244
-
\??\c:\jdpjp.exec:\jdpjp.exe76⤵PID:352
-
\??\c:\202404.exec:\202404.exe77⤵PID:848
-
\??\c:\9bntbn.exec:\9bntbn.exe78⤵PID:1580
-
\??\c:\02440.exec:\02440.exe79⤵PID:284
-
\??\c:\3ntntn.exec:\3ntntn.exe80⤵PID:1696
-
\??\c:\1vddv.exec:\1vddv.exe81⤵PID:1540
-
\??\c:\jpppv.exec:\jpppv.exe82⤵PID:1684
-
\??\c:\86406.exec:\86406.exe83⤵PID:3004
-
\??\c:\20806.exec:\20806.exe84⤵PID:2556
-
\??\c:\nbnbbh.exec:\nbnbbh.exe85⤵PID:3052
-
\??\c:\5nnnbb.exec:\5nnnbb.exe86⤵PID:2580
-
\??\c:\vpvvv.exec:\vpvvv.exe87⤵PID:2564
-
\??\c:\8688440.exec:\8688440.exe88⤵PID:2828
-
\??\c:\jvjpp.exec:\jvjpp.exe89⤵PID:2492
-
\??\c:\684488.exec:\684488.exe90⤵PID:2500
-
\??\c:\248222.exec:\248222.exe91⤵PID:2512
-
\??\c:\9bnbbt.exec:\9bnbbt.exe92⤵PID:2028
-
\??\c:\2028446.exec:\2028446.exe93⤵PID:2616
-
\??\c:\464688.exec:\464688.exe94⤵PID:1648
-
\??\c:\20220.exec:\20220.exe95⤵PID:1600
-
\??\c:\202282.exec:\202282.exe96⤵PID:2984
-
\??\c:\jjdjv.exec:\jjdjv.exe97⤵PID:2916
-
\??\c:\htbhnn.exec:\htbhnn.exe98⤵PID:1944
-
\??\c:\5tnthh.exec:\5tnthh.exe99⤵PID:2756
-
\??\c:\lfxlllx.exec:\lfxlllx.exe100⤵PID:2504
-
\??\c:\i466228.exec:\i466228.exe101⤵PID:2548
-
\??\c:\nbhhnt.exec:\nbhhnt.exe102⤵PID:2016
-
\??\c:\0864006.exec:\0864006.exe103⤵PID:296
-
\??\c:\200006.exec:\200006.exe104⤵PID:1220
-
\??\c:\lxflxxf.exec:\lxflxxf.exe105⤵PID:1040
-
\??\c:\6222806.exec:\6222806.exe106⤵PID:2324
-
\??\c:\46228.exec:\46228.exe107⤵PID:2320
-
\??\c:\vjvvp.exec:\vjvvp.exe108⤵PID:1184
-
\??\c:\xxrrxrl.exec:\xxrrxrl.exe109⤵PID:2264
-
\??\c:\204406.exec:\204406.exe110⤵PID:2100
-
\??\c:\vjvvj.exec:\vjvvj.exe111⤵PID:2864
-
\??\c:\468660.exec:\468660.exe112⤵PID:488
-
\??\c:\xxxxrlr.exec:\xxxxrlr.exe113⤵PID:904
-
\??\c:\4862884.exec:\4862884.exe114⤵PID:1880
-
\??\c:\202844.exec:\202844.exe115⤵PID:1808
-
\??\c:\bnttbb.exec:\bnttbb.exe116⤵PID:1336
-
\??\c:\1vppp.exec:\1vppp.exe117⤵PID:1524
-
\??\c:\pdjjj.exec:\pdjjj.exe118⤵PID:780
-
\??\c:\1hbtht.exec:\1hbtht.exe119⤵PID:572
-
\??\c:\2664884.exec:\2664884.exe120⤵PID:656
-
\??\c:\420248.exec:\420248.exe121⤵PID:548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-