Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 17:00
Behavioral task
behavioral1
Sample
293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe
-
Size
350KB
-
MD5
293240fe27f10a1273bb502f7d9c8f30
-
SHA1
b340f23aa3daa34da8455476bc881f110c1054f7
-
SHA256
67caeabf4baf55e2b5d677b35a4cd15615f7680a566c9df269f48a7f435ff297
-
SHA512
e8ca2a58b1b90ac803599f688c7bc1f6f4f91b86f8de219c95b22584cca6db5c7a9e17ad0f450c7b553600fdc6993ad5991cd536e0afb399ef2e54f38a2e6e30
-
SSDEEP
6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrHI:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzQ
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/4360-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4728-6-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1764-21-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2520-12-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2556-30-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1188-44-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3124-39-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3964-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1060-69-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4088-76-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1512-82-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3012-89-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3996-94-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2892-104-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1728-111-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3224-114-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3132-123-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3372-129-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4220-140-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/412-153-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4284-159-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4396-167-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4236-180-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2300-189-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2824-193-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3504-202-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2492-206-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/636-213-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2080-217-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/376-234-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3804-244-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4524-261-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3132-270-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1844-284-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/932-288-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/932-292-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1496-299-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1828-303-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1656-314-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2072-325-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4516-338-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3924-347-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1272-352-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2452-365-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/632-368-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/900-378-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4648-388-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4560-411-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1648-438-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3340-454-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3276-471-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2452-493-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3804-500-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4336-544-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2564-572-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1256-606-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2460-670-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3940-711-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/376-721-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1992-886-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4792-951-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4028-1260-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000235f1-3.dat family_berbew behavioral2/files/0x00080000000235f7-10.dat family_berbew behavioral2/files/0x00070000000235f8-13.dat family_berbew behavioral2/files/0x00070000000235f9-23.dat family_berbew behavioral2/files/0x00070000000235fa-28.dat family_berbew behavioral2/files/0x00070000000235fb-35.dat family_berbew behavioral2/files/0x00070000000235fc-41.dat family_berbew behavioral2/files/0x00070000000235fd-48.dat family_berbew behavioral2/files/0x00070000000235fe-53.dat family_berbew behavioral2/files/0x00070000000235ff-57.dat family_berbew behavioral2/files/0x0007000000023600-62.dat family_berbew behavioral2/files/0x0007000000023601-68.dat family_berbew behavioral2/files/0x0007000000023602-73.dat family_berbew behavioral2/files/0x0007000000023603-80.dat family_berbew behavioral2/files/0x0007000000023604-88.dat family_berbew behavioral2/files/0x0007000000023605-92.dat family_berbew behavioral2/files/0x0007000000023606-99.dat family_berbew behavioral2/files/0x00080000000235f5-106.dat family_berbew behavioral2/files/0x0007000000023607-109.dat family_berbew behavioral2/files/0x0007000000023608-117.dat family_berbew behavioral2/files/0x0007000000023609-121.dat family_berbew behavioral2/files/0x000700000002360a-127.dat family_berbew behavioral2/files/0x000700000002360b-133.dat family_berbew behavioral2/files/0x000700000002360c-138.dat family_berbew behavioral2/files/0x000700000002360d-145.dat family_berbew behavioral2/files/0x000700000002360e-149.dat family_berbew behavioral2/files/0x000700000002360f-156.dat family_berbew behavioral2/files/0x0007000000023610-161.dat family_berbew behavioral2/files/0x0007000000023612-166.dat family_berbew behavioral2/files/0x0008000000023611-172.dat family_berbew behavioral2/files/0x0008000000023614-177.dat family_berbew behavioral2/files/0x0007000000023615-184.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4360 dvjjj.exe 2520 pjpjj.exe 1764 xflfxrr.exe 2556 lfrxrxx.exe 1200 3nbbbb.exe 3124 vdpvv.exe 1188 lrfxrfx.exe 2188 xlrlffx.exe 3816 bhtnnh.exe 3964 nttbbn.exe 1060 dddjd.exe 4088 bnbbth.exe 1512 lxlfllr.exe 3012 ttbbtt.exe 3996 lxlxlrx.exe 3144 pvjjj.exe 2892 fxlfxxr.exe 1728 ttbttb.exe 3224 7xxlllf.exe 3132 1nbtbb.exe 3372 rrrfffr.exe 4992 5nhhbb.exe 4220 fxxxrxx.exe 4804 nnhhbt.exe 3068 xrxxffl.exe 412 nttnhh.exe 4284 dvvdp.exe 4396 xfrfffx.exe 4920 ddddv.exe 4236 xrxrlll.exe 4076 bnhhhh.exe 2300 dpjjd.exe 2824 nhbttt.exe 1200 jjpjd.exe 3576 3jjdv.exe 3504 rfffrrr.exe 2492 ttnhhh.exe 2188 vpddd.exe 636 7lrrrrl.exe 2080 1xrrlfx.exe 3816 hhnnhn.exe 1532 djpjd.exe 2304 rrfffll.exe 1952 tnnnnn.exe 376 bthbtb.exe 1072 9djpd.exe 3244 rxxrrrl.exe 3804 xxfrlxx.exe 3996 btnhnt.exe 3144 vvpjd.exe 4228 flrxfxf.exe 4312 fxrlrlx.exe 1728 jddvv.exe 4524 7lfxrxx.exe 2708 rrxxxxx.exe 3132 bntthb.exe 116 tbhhhb.exe 4980 pjdvp.exe 3540 3lffrrf.exe 1844 nhhhbb.exe 4512 ffxxrxf.exe 932 bnbtbb.exe 1596 jpvpj.exe 1496 hbbbtb.exe -
resource yara_rule behavioral2/memory/4360-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4728-6-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1764-21-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2520-12-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2556-25-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2556-30-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1188-44-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3124-39-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3964-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1060-69-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1512-77-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4088-76-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1512-82-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3012-89-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3996-94-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2892-104-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1728-111-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3224-114-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3132-123-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3372-129-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4220-140-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/412-153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4284-159-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4396-167-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4236-180-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2300-189-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2824-193-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3504-202-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2492-206-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/636-213-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2080-217-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1952-227-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/376-234-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3804-244-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4524-261-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3132-270-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3540-277-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1844-284-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/932-292-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1496-299-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1828-303-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1656-314-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/856-320-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2072-325-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4516-338-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3924-347-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1272-352-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2452-365-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/632-368-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/900-378-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4648-388-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4560-411-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4968-418-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1648-438-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3340-454-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3276-471-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2452-493-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3804-500-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4252-516-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2692-526-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4980-530-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4336-540-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4336-544-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2564-572-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4360 4728 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 89 PID 4728 wrote to memory of 4360 4728 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 89 PID 4728 wrote to memory of 4360 4728 293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe 89 PID 4360 wrote to memory of 2520 4360 dvjjj.exe 90 PID 4360 wrote to memory of 2520 4360 dvjjj.exe 90 PID 4360 wrote to memory of 2520 4360 dvjjj.exe 90 PID 2520 wrote to memory of 1764 2520 pjpjj.exe 91 PID 2520 wrote to memory of 1764 2520 pjpjj.exe 91 PID 2520 wrote to memory of 1764 2520 pjpjj.exe 91 PID 1764 wrote to memory of 2556 1764 xflfxrr.exe 92 PID 1764 wrote to memory of 2556 1764 xflfxrr.exe 92 PID 1764 wrote to memory of 2556 1764 xflfxrr.exe 92 PID 2556 wrote to memory of 1200 2556 lfrxrxx.exe 93 PID 2556 wrote to memory of 1200 2556 lfrxrxx.exe 93 PID 2556 wrote to memory of 1200 2556 lfrxrxx.exe 93 PID 1200 wrote to memory of 3124 1200 3nbbbb.exe 94 PID 1200 wrote to memory of 3124 1200 3nbbbb.exe 94 PID 1200 wrote to memory of 3124 1200 3nbbbb.exe 94 PID 3124 wrote to memory of 1188 3124 vdpvv.exe 95 PID 3124 wrote to memory of 1188 3124 vdpvv.exe 95 PID 3124 wrote to memory of 1188 3124 vdpvv.exe 95 PID 1188 wrote to memory of 2188 1188 lrfxrfx.exe 96 PID 1188 wrote to memory of 2188 1188 lrfxrfx.exe 96 PID 1188 wrote to memory of 2188 1188 lrfxrfx.exe 96 PID 2188 wrote to memory of 3816 2188 xlrlffx.exe 97 PID 2188 wrote to memory of 3816 2188 xlrlffx.exe 97 PID 2188 wrote to memory of 3816 2188 xlrlffx.exe 97 PID 3816 wrote to memory of 3964 3816 bhtnnh.exe 98 PID 3816 wrote to memory of 3964 3816 bhtnnh.exe 98 PID 3816 wrote to memory of 3964 3816 bhtnnh.exe 98 PID 3964 wrote to memory of 1060 3964 nttbbn.exe 99 PID 3964 wrote to memory of 1060 3964 nttbbn.exe 99 PID 3964 wrote to memory of 1060 3964 nttbbn.exe 99 PID 1060 wrote to memory of 4088 1060 dddjd.exe 101 PID 1060 wrote to memory of 4088 1060 dddjd.exe 101 PID 1060 wrote to memory of 4088 1060 dddjd.exe 101 PID 4088 wrote to memory of 1512 4088 bnbbth.exe 102 PID 4088 wrote to memory of 1512 4088 bnbbth.exe 102 PID 4088 wrote to memory of 1512 4088 bnbbth.exe 102 PID 1512 wrote to memory of 3012 1512 lxlfllr.exe 104 PID 1512 wrote to memory of 3012 1512 lxlfllr.exe 104 PID 1512 wrote to memory of 3012 1512 lxlfllr.exe 104 PID 3012 wrote to memory of 3996 3012 ttbbtt.exe 105 PID 3012 wrote to memory of 3996 3012 ttbbtt.exe 105 PID 3012 wrote to memory of 3996 3012 ttbbtt.exe 105 PID 3996 wrote to memory of 3144 3996 lxlxlrx.exe 107 PID 3996 wrote to memory of 3144 3996 lxlxlrx.exe 107 PID 3996 wrote to memory of 3144 3996 lxlxlrx.exe 107 PID 3144 wrote to memory of 2892 3144 pvjjj.exe 108 PID 3144 wrote to memory of 2892 3144 pvjjj.exe 108 PID 3144 wrote to memory of 2892 3144 pvjjj.exe 108 PID 2892 wrote to memory of 1728 2892 fxlfxxr.exe 109 PID 2892 wrote to memory of 1728 2892 fxlfxxr.exe 109 PID 2892 wrote to memory of 1728 2892 fxlfxxr.exe 109 PID 1728 wrote to memory of 3224 1728 ttbttb.exe 110 PID 1728 wrote to memory of 3224 1728 ttbttb.exe 110 PID 1728 wrote to memory of 3224 1728 ttbttb.exe 110 PID 3224 wrote to memory of 3132 3224 7xxlllf.exe 111 PID 3224 wrote to memory of 3132 3224 7xxlllf.exe 111 PID 3224 wrote to memory of 3132 3224 7xxlllf.exe 111 PID 3132 wrote to memory of 3372 3132 1nbtbb.exe 112 PID 3132 wrote to memory of 3372 3132 1nbtbb.exe 112 PID 3132 wrote to memory of 3372 3132 1nbtbb.exe 112 PID 3372 wrote to memory of 4992 3372 rrrfffr.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\293240fe27f10a1273bb502f7d9c8f30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\dvjjj.exec:\dvjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\pjpjj.exec:\pjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xflfxrr.exec:\xflfxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\lfrxrxx.exec:\lfrxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3nbbbb.exec:\3nbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\vdpvv.exec:\vdpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\lrfxrfx.exec:\lrfxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\xlrlffx.exec:\xlrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\bhtnnh.exec:\bhtnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\nttbbn.exec:\nttbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\dddjd.exec:\dddjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\bnbbth.exec:\bnbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\lxlfllr.exec:\lxlfllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\ttbbtt.exec:\ttbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lxlxlrx.exec:\lxlxlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\pvjjj.exec:\pvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ttbttb.exec:\ttbttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\7xxlllf.exec:\7xxlllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\1nbtbb.exec:\1nbtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\rrrfffr.exec:\rrrfffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\5nhhbb.exec:\5nhhbb.exe23⤵
- Executes dropped EXE
PID:4992 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe24⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nnhhbt.exec:\nnhhbt.exe25⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xrxxffl.exec:\xrxxffl.exe26⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nttnhh.exec:\nttnhh.exe27⤵
- Executes dropped EXE
PID:412 -
\??\c:\dvvdp.exec:\dvvdp.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\xfrfffx.exec:\xfrfffx.exe29⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ddddv.exec:\ddddv.exe30⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xrxrlll.exec:\xrxrlll.exe31⤵
- Executes dropped EXE
PID:4236 -
\??\c:\bnhhhh.exec:\bnhhhh.exe32⤵
- Executes dropped EXE
PID:4076 -
\??\c:\dpjjd.exec:\dpjjd.exe33⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhbttt.exec:\nhbttt.exe34⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jjpjd.exec:\jjpjd.exe35⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3jjdv.exec:\3jjdv.exe36⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rfffrrr.exec:\rfffrrr.exe37⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ttnhhh.exec:\ttnhhh.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpddd.exec:\vpddd.exe39⤵
- Executes dropped EXE
PID:2188 -
\??\c:\7lrrrrl.exec:\7lrrrrl.exe40⤵
- Executes dropped EXE
PID:636 -
\??\c:\1xrrlfx.exec:\1xrrlfx.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hhnnhn.exec:\hhnnhn.exe42⤵
- Executes dropped EXE
PID:3816 -
\??\c:\djpjd.exec:\djpjd.exe43⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrfffll.exec:\rrfffll.exe44⤵
- Executes dropped EXE
PID:2304 -
\??\c:\tnnnnn.exec:\tnnnnn.exe45⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bthbtb.exec:\bthbtb.exe46⤵
- Executes dropped EXE
PID:376 -
\??\c:\9djpd.exec:\9djpd.exe47⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe48⤵
- Executes dropped EXE
PID:3244 -
\??\c:\xxfrlxx.exec:\xxfrlxx.exe49⤵
- Executes dropped EXE
PID:3804 -
\??\c:\btnhnt.exec:\btnhnt.exe50⤵
- Executes dropped EXE
PID:3996 -
\??\c:\vvpjd.exec:\vvpjd.exe51⤵
- Executes dropped EXE
PID:3144 -
\??\c:\flrxfxf.exec:\flrxfxf.exe52⤵
- Executes dropped EXE
PID:4228 -
\??\c:\fxrlrlx.exec:\fxrlrlx.exe53⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jddvv.exec:\jddvv.exe54⤵
- Executes dropped EXE
PID:1728 -
\??\c:\7lfxrxx.exec:\7lfxrxx.exe55⤵
- Executes dropped EXE
PID:4524 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe56⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bntthb.exec:\bntthb.exe57⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tbhhhb.exec:\tbhhhb.exe58⤵
- Executes dropped EXE
PID:116 -
\??\c:\pjdvp.exec:\pjdvp.exe59⤵
- Executes dropped EXE
PID:4980 -
\??\c:\3lffrrf.exec:\3lffrrf.exe60⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nhhhbb.exec:\nhhhbb.exe61⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ffxxrxf.exec:\ffxxrxf.exe62⤵
- Executes dropped EXE
PID:4512 -
\??\c:\bnbtbb.exec:\bnbtbb.exe63⤵
- Executes dropped EXE
PID:932 -
\??\c:\jpvpj.exec:\jpvpj.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hbbbtb.exec:\hbbbtb.exe65⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jvvvp.exec:\jvvvp.exe66⤵PID:1828
-
\??\c:\xfrlxrx.exec:\xfrlxrx.exe67⤵PID:1976
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe68⤵PID:2972
-
\??\c:\nthbtb.exec:\nthbtb.exe69⤵PID:1536
-
\??\c:\pjvvj.exec:\pjvvj.exe70⤵PID:1656
-
\??\c:\vvdvj.exec:\vvdvj.exe71⤵PID:3864
-
\??\c:\3lxfrfx.exec:\3lxfrfx.exe72⤵PID:856
-
\??\c:\thntnn.exec:\thntnn.exe73⤵PID:2072
-
\??\c:\1dpdv.exec:\1dpdv.exe74⤵PID:3124
-
\??\c:\fxffflf.exec:\fxffflf.exe75⤵PID:3808
-
\??\c:\7xxffll.exec:\7xxffll.exe76⤵PID:4580
-
\??\c:\btnttt.exec:\btnttt.exe77⤵PID:4516
-
\??\c:\ppdpv.exec:\ppdpv.exe78⤵PID:1260
-
\??\c:\nhnhbt.exec:\nhnhbt.exe79⤵PID:3924
-
\??\c:\jppjd.exec:\jppjd.exe80⤵PID:1040
-
\??\c:\7djjj.exec:\7djjj.exe81⤵PID:1272
-
\??\c:\lxffxxx.exec:\lxffxxx.exe82⤵PID:4088
-
\??\c:\7tnhbb.exec:\7tnhbb.exe83⤵PID:1952
-
\??\c:\9pjjd.exec:\9pjjd.exe84⤵PID:376
-
\??\c:\jvdvd.exec:\jvdvd.exe85⤵PID:2452
-
\??\c:\rrrrlll.exec:\rrrrlll.exe86⤵PID:632
-
\??\c:\9ttnhh.exec:\9ttnhh.exe87⤵PID:3804
-
\??\c:\vpppv.exec:\vpppv.exe88⤵PID:900
-
\??\c:\frfxrrx.exec:\frfxrrx.exe89⤵PID:4884
-
\??\c:\rxlffff.exec:\rxlffff.exe90⤵PID:1152
-
\??\c:\hbnnnn.exec:\hbnnnn.exe91⤵PID:4648
-
\??\c:\1jvpv.exec:\1jvpv.exe92⤵PID:3224
-
\??\c:\rfllxxx.exec:\rfllxxx.exe93⤵PID:4696
-
\??\c:\3btttt.exec:\3btttt.exe94⤵PID:1436
-
\??\c:\9ntnht.exec:\9ntnht.exe95⤵PID:4212
-
\??\c:\pdppp.exec:\pdppp.exe96⤵PID:2324
-
\??\c:\5fflfrl.exec:\5fflfrl.exe97⤵PID:4980
-
\??\c:\thttbt.exec:\thttbt.exe98⤵PID:4560
-
\??\c:\nnbthh.exec:\nnbthh.exe99⤵PID:3128
-
\??\c:\1vvvd.exec:\1vvvd.exe100⤵PID:4332
-
\??\c:\xfrlfff.exec:\xfrlfff.exe101⤵PID:4968
-
\??\c:\bhtntt.exec:\bhtntt.exe102⤵PID:4284
-
\??\c:\pvjdj.exec:\pvjdj.exe103⤵PID:4324
-
\??\c:\rxfxlff.exec:\rxfxlff.exe104⤵PID:4356
-
\??\c:\rrrlllf.exec:\rrrlllf.exe105⤵PID:4360
-
\??\c:\nbnnnn.exec:\nbnnnn.exe106⤵PID:3968
-
\??\c:\dppjd.exec:\dppjd.exe107⤵PID:1648
-
\??\c:\1rrxrrl.exec:\1rrxrrl.exe108⤵PID:2556
-
\??\c:\nnnntb.exec:\nnnntb.exe109⤵PID:2564
-
\??\c:\pvvvv.exec:\pvvvv.exe110⤵PID:924
-
\??\c:\lfrllll.exec:\lfrllll.exe111⤵PID:3340
-
\??\c:\nhtbht.exec:\nhtbht.exe112⤵PID:2072
-
\??\c:\hnhbth.exec:\hnhbth.exe113⤵PID:4180
-
\??\c:\rrflrrf.exec:\rrflrrf.exe114⤵PID:1756
-
\??\c:\xrffxrl.exec:\xrffxrl.exe115⤵PID:2080
-
\??\c:\nhhhhh.exec:\nhhhhh.exe116⤵PID:3276
-
\??\c:\pdjdd.exec:\pdjdd.exe117⤵PID:3816
-
\??\c:\rllllrr.exec:\rllllrr.exe118⤵PID:3568
-
\??\c:\7nnnnt.exec:\7nnnnt.exe119⤵PID:4940
-
\??\c:\3djdd.exec:\3djdd.exe120⤵PID:4088
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe121⤵PID:528
-
\??\c:\frxrlff.exec:\frxrlff.exe122⤵PID:3648
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-