Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 01:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe
-
Size
202KB
-
MD5
44de3f9d88956119801dfd144b462af0
-
SHA1
1e4f00b3fe6b99b7087282e76a79b0b53d9bff0b
-
SHA256
1f974bf5312b5af4aeba602b34e850eba1f0b4e4ac7f13c764cb4b621054e604
-
SHA512
c179f38839e454b3609a6d8fcbc7ba50b53cd17fe799633cab838913ad14b272456eddbee065efb020c894cd1ac1fc00df2859ce5d6d44bab7635dce99480cbd
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6T7T:PhOm2sI93UufdC67ciJTU2HVS63T
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2032-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-361-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-410-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4272-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-750-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-739-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-650-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-646-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-528-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-521-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-497-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-400-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1088 vvddd.exe 708 frlrfrx.exe 1016 3xxrllf.exe 1316 pvvjv.exe 1220 vdjjj.exe 2032 1rxrlrl.exe 2348 nnhtbb.exe 2332 5dddv.exe 860 rfxxrrl.exe 2744 bnhhhb.exe 3396 5bnhnb.exe 5028 vdvpd.exe 2788 xlrrrrf.exe 1696 hhbbtn.exe 4956 jvvjd.exe 384 xrllffx.exe 1640 fflllll.exe 4732 ttbttb.exe 4808 jdppp.exe 4548 dppdp.exe 4904 btbtnn.exe 748 nbhhbb.exe 1444 vdvjd.exe 1724 frrllff.exe 2636 rxrlfrf.exe 3508 tnnhht.exe 3420 ppjdd.exe 4908 rlfxrrl.exe 392 xffrfxr.exe 1996 bbhbbb.exe 1168 vjjdd.exe 4416 9rrlffx.exe 804 7fxrlff.exe 2992 bhhbbb.exe 4048 pjppp.exe 2840 pjvjd.exe 4356 xxflrlf.exe 4328 hnhtbn.exe 1688 tnhbnn.exe 3888 1ddjv.exe 1912 pjjdd.exe 4448 llffffx.exe 1220 tnhbbn.exe 988 nhbtnh.exe 3096 jpjvd.exe 3776 dpddv.exe 4200 xrflxxf.exe 4480 1nnhbt.exe 2796 thtbhn.exe 4280 pjvvj.exe 396 lxlrlrl.exe 3472 frrxxfr.exe 2900 9hnhbb.exe 4956 jdppj.exe 2284 9ddpj.exe 1640 rlxrlrl.exe 540 thnthn.exe 4476 vdjjj.exe 4336 pjjvp.exe 4192 7fxfllf.exe 2620 xrxrxrx.exe 3560 thnhth.exe 2824 1tnbnn.exe 5112 dpvjd.exe -
resource yara_rule behavioral2/memory/2032-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-307-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-311-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-361-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-410-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4272-424-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-437-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-550-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-557-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-580-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-697-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-750-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-742-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-739-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-726-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-719-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-680-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-664-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-654-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-650-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-646-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-636-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-616-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-597-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-589-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-570-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-528-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-521-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-504-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-497-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-466-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-446-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3412-422-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-411-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-406-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-400-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-386-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-357-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-216-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-157-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 1088 1348 44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe 82 PID 1348 wrote to memory of 1088 1348 44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe 82 PID 1348 wrote to memory of 1088 1348 44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe 82 PID 1088 wrote to memory of 708 1088 vvddd.exe 83 PID 1088 wrote to memory of 708 1088 vvddd.exe 83 PID 1088 wrote to memory of 708 1088 vvddd.exe 83 PID 708 wrote to memory of 1016 708 frlrfrx.exe 84 PID 708 wrote to memory of 1016 708 frlrfrx.exe 84 PID 708 wrote to memory of 1016 708 frlrfrx.exe 84 PID 1016 wrote to memory of 1316 1016 3xxrllf.exe 85 PID 1016 wrote to memory of 1316 1016 3xxrllf.exe 85 PID 1016 wrote to memory of 1316 1016 3xxrllf.exe 85 PID 1316 wrote to memory of 1220 1316 pvvjv.exe 86 PID 1316 wrote to memory of 1220 1316 pvvjv.exe 86 PID 1316 wrote to memory of 1220 1316 pvvjv.exe 86 PID 1220 wrote to memory of 2032 1220 vdjjj.exe 87 PID 1220 wrote to memory of 2032 1220 vdjjj.exe 87 PID 1220 wrote to memory of 2032 1220 vdjjj.exe 87 PID 2032 wrote to memory of 2348 2032 1rxrlrl.exe 88 PID 2032 wrote to memory of 2348 2032 1rxrlrl.exe 88 PID 2032 wrote to memory of 2348 2032 1rxrlrl.exe 88 PID 2348 wrote to memory of 2332 2348 nnhtbb.exe 89 PID 2348 wrote to memory of 2332 2348 nnhtbb.exe 89 PID 2348 wrote to memory of 2332 2348 nnhtbb.exe 89 PID 2332 wrote to memory of 860 2332 5dddv.exe 90 PID 2332 wrote to memory of 860 2332 5dddv.exe 90 PID 2332 wrote to memory of 860 2332 5dddv.exe 90 PID 860 wrote to memory of 2744 860 rfxxrrl.exe 91 PID 860 wrote to memory of 2744 860 rfxxrrl.exe 91 PID 860 wrote to memory of 2744 860 rfxxrrl.exe 91 PID 2744 wrote to memory of 3396 2744 bnhhhb.exe 92 PID 2744 wrote to memory of 3396 2744 bnhhhb.exe 92 PID 2744 wrote to memory of 3396 2744 bnhhhb.exe 92 PID 3396 wrote to memory of 5028 3396 5bnhnb.exe 93 PID 3396 wrote to memory of 5028 3396 5bnhnb.exe 93 PID 3396 wrote to memory of 5028 3396 5bnhnb.exe 93 PID 5028 wrote to memory of 2788 5028 vdvpd.exe 94 PID 5028 wrote to memory of 2788 5028 vdvpd.exe 94 PID 5028 wrote to memory of 2788 5028 vdvpd.exe 94 PID 2788 wrote to memory of 1696 2788 xlrrrrf.exe 95 PID 2788 wrote to memory of 1696 2788 xlrrrrf.exe 95 PID 2788 wrote to memory of 1696 2788 xlrrrrf.exe 95 PID 1696 wrote to memory of 4956 1696 hhbbtn.exe 96 PID 1696 wrote to memory of 4956 1696 hhbbtn.exe 96 PID 1696 wrote to memory of 4956 1696 hhbbtn.exe 96 PID 4956 wrote to memory of 384 4956 jvvjd.exe 98 PID 4956 wrote to memory of 384 4956 jvvjd.exe 98 PID 4956 wrote to memory of 384 4956 jvvjd.exe 98 PID 384 wrote to memory of 1640 384 xrllffx.exe 140 PID 384 wrote to memory of 1640 384 xrllffx.exe 140 PID 384 wrote to memory of 1640 384 xrllffx.exe 140 PID 1640 wrote to memory of 4732 1640 fflllll.exe 100 PID 1640 wrote to memory of 4732 1640 fflllll.exe 100 PID 1640 wrote to memory of 4732 1640 fflllll.exe 100 PID 4732 wrote to memory of 4808 4732 ttbttb.exe 101 PID 4732 wrote to memory of 4808 4732 ttbttb.exe 101 PID 4732 wrote to memory of 4808 4732 ttbttb.exe 101 PID 4808 wrote to memory of 4548 4808 jdppp.exe 102 PID 4808 wrote to memory of 4548 4808 jdppp.exe 102 PID 4808 wrote to memory of 4548 4808 jdppp.exe 102 PID 4548 wrote to memory of 4904 4548 dppdp.exe 104 PID 4548 wrote to memory of 4904 4548 dppdp.exe 104 PID 4548 wrote to memory of 4904 4548 dppdp.exe 104 PID 4904 wrote to memory of 748 4904 btbtnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2431862252\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2431862252\zmstage.exe1⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\44de3f9d88956119801dfd144b462af0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\frlrfrx.exec:\frlrfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\3xxrllf.exec:\3xxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\pvvjv.exec:\pvvjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\vdjjj.exec:\vdjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\1rxrlrl.exec:\1rxrlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nnhtbb.exec:\nnhtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\5dddv.exec:\5dddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\bnhhhb.exec:\bnhhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5bnhnb.exec:\5bnhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\vdvpd.exec:\vdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\xlrrrrf.exec:\xlrrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hhbbtn.exec:\hhbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jvvjd.exec:\jvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\xrllffx.exec:\xrllffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\fflllll.exec:\fflllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\ttbttb.exec:\ttbttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\jdppp.exec:\jdppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dppdp.exec:\dppdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\btbtnn.exec:\btbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\nbhhbb.exec:\nbhhbb.exe23⤵
- Executes dropped EXE
PID:748 -
\??\c:\vdvjd.exec:\vdvjd.exe24⤵
- Executes dropped EXE
PID:1444 -
\??\c:\frrllff.exec:\frrllff.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rxrlfrf.exec:\rxrlfrf.exe26⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnnhht.exec:\tnnhht.exe27⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ppjdd.exec:\ppjdd.exe28⤵
- Executes dropped EXE
PID:3420 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe29⤵
- Executes dropped EXE
PID:4908 -
\??\c:\xffrfxr.exec:\xffrfxr.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\bbhbbb.exec:\bbhbbb.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vjjdd.exec:\vjjdd.exe32⤵
- Executes dropped EXE
PID:1168 -
\??\c:\9rrlffx.exec:\9rrlffx.exe33⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7fxrlff.exec:\7fxrlff.exe34⤵
- Executes dropped EXE
PID:804 -
\??\c:\bhhbbb.exec:\bhhbbb.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\pjppp.exec:\pjppp.exe36⤵
- Executes dropped EXE
PID:4048 -
\??\c:\pjvjd.exec:\pjvjd.exe37⤵
- Executes dropped EXE
PID:2840 -
\??\c:\xxflrlf.exec:\xxflrlf.exe38⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hnhtbn.exec:\hnhtbn.exe39⤵
- Executes dropped EXE
PID:4328 -
\??\c:\tnhbnn.exec:\tnhbnn.exe40⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1ddjv.exec:\1ddjv.exe41⤵
- Executes dropped EXE
PID:3888 -
\??\c:\pjjdd.exec:\pjjdd.exe42⤵
- Executes dropped EXE
PID:1912 -
\??\c:\llffffx.exec:\llffffx.exe43⤵
- Executes dropped EXE
PID:4448 -
\??\c:\tnhbbn.exec:\tnhbbn.exe44⤵
- Executes dropped EXE
PID:1220 -
\??\c:\nhbtnh.exec:\nhbtnh.exe45⤵
- Executes dropped EXE
PID:988 -
\??\c:\jpjvd.exec:\jpjvd.exe46⤵
- Executes dropped EXE
PID:3096 -
\??\c:\dpddv.exec:\dpddv.exe47⤵
- Executes dropped EXE
PID:3776 -
\??\c:\xrflxxf.exec:\xrflxxf.exe48⤵
- Executes dropped EXE
PID:4200 -
\??\c:\1nnhbt.exec:\1nnhbt.exe49⤵
- Executes dropped EXE
PID:4480 -
\??\c:\thtbhn.exec:\thtbhn.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pjvvj.exec:\pjvvj.exe51⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lxlrlrl.exec:\lxlrlrl.exe52⤵
- Executes dropped EXE
PID:396 -
\??\c:\frrxxfr.exec:\frrxxfr.exe53⤵
- Executes dropped EXE
PID:3472 -
\??\c:\9hnhbb.exec:\9hnhbb.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdppj.exec:\jdppj.exe55⤵
- Executes dropped EXE
PID:4956 -
\??\c:\9ddpj.exec:\9ddpj.exe56⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlxrlrl.exec:\rlxrlrl.exe57⤵
- Executes dropped EXE
PID:1640 -
\??\c:\thnthn.exec:\thnthn.exe58⤵
- Executes dropped EXE
PID:540 -
\??\c:\vdjjj.exec:\vdjjj.exe59⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pjjvp.exec:\pjjvp.exe60⤵
- Executes dropped EXE
PID:4336 -
\??\c:\7fxfllf.exec:\7fxfllf.exe61⤵
- Executes dropped EXE
PID:4192 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe62⤵
- Executes dropped EXE
PID:2620 -
\??\c:\thnhth.exec:\thnhth.exe63⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1tnbnn.exec:\1tnbnn.exe64⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dpvjd.exec:\dpvjd.exe65⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rfllfrr.exec:\rfllfrr.exe66⤵PID:1444
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe67⤵PID:3480
-
\??\c:\1tnbbt.exec:\1tnbbt.exe68⤵PID:1468
-
\??\c:\vdpvj.exec:\vdpvj.exe69⤵PID:376
-
\??\c:\dpvdd.exec:\dpvdd.exe70⤵PID:2312
-
\??\c:\fllfxxf.exec:\fllfxxf.exe71⤵PID:2124
-
\??\c:\thhbtn.exec:\thhbtn.exe72⤵PID:3612
-
\??\c:\httnhb.exec:\httnhb.exe73⤵PID:3360
-
\??\c:\vvddv.exec:\vvddv.exe74⤵PID:1996
-
\??\c:\1jdjd.exec:\1jdjd.exe75⤵PID:2188
-
\??\c:\frlxrfx.exec:\frlxrfx.exe76⤵PID:3512
-
\??\c:\tnhnbb.exec:\tnhnbb.exe77⤵PID:3248
-
\??\c:\nbhhhn.exec:\nbhhhn.exe78⤵PID:2600
-
\??\c:\djpjd.exec:\djpjd.exe79⤵PID:4208
-
\??\c:\djjdv.exec:\djjdv.exe80⤵PID:4360
-
\??\c:\xlrlllx.exec:\xlrlllx.exe81⤵PID:2716
-
\??\c:\xlxxlrr.exec:\xlxxlrr.exe82⤵PID:5048
-
\??\c:\nnhthn.exec:\nnhthn.exe83⤵PID:708
-
\??\c:\bthbhb.exec:\bthbhb.exe84⤵PID:4848
-
\??\c:\5dvjd.exec:\5dvjd.exe85⤵PID:2232
-
\??\c:\pvdpv.exec:\pvdpv.exe86⤵PID:3988
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe87⤵PID:2904
-
\??\c:\rllxrrl.exec:\rllxrrl.exe88⤵PID:1144
-
\??\c:\bbbtnn.exec:\bbbtnn.exe89⤵PID:4936
-
\??\c:\nbnnhh.exec:\nbnnhh.exe90⤵PID:2192
-
\??\c:\djjdv.exec:\djjdv.exe91⤵PID:3200
-
\??\c:\jjddv.exec:\jjddv.exe92⤵PID:3776
-
\??\c:\fxlrxff.exec:\fxlrxff.exe93⤵PID:1424
-
\??\c:\tbnbbh.exec:\tbnbbh.exe94⤵PID:4648
-
\??\c:\nbhhnn.exec:\nbhhnn.exe95⤵PID:2796
-
\??\c:\ddjdv.exec:\ddjdv.exe96⤵PID:4280
-
\??\c:\rffxlff.exec:\rffxlff.exe97⤵PID:4692
-
\??\c:\llxffxx.exec:\llxffxx.exe98⤵PID:3412
-
\??\c:\tttttn.exec:\tttttn.exe99⤵PID:4272
-
\??\c:\djvdv.exec:\djvdv.exe100⤵PID:2588
-
\??\c:\pjpjp.exec:\pjpjp.exe101⤵PID:2052
-
\??\c:\flrfrrl.exec:\flrfrrl.exe102⤵PID:4404
-
\??\c:\llllxff.exec:\llllxff.exe103⤵PID:4352
-
\??\c:\btbbbb.exec:\btbbbb.exe104⤵PID:2940
-
\??\c:\tnnhbb.exec:\tnnhbb.exe105⤵PID:4864
-
\??\c:\pjjdv.exec:\pjjdv.exe106⤵PID:5020
-
\??\c:\pjdvp.exec:\pjdvp.exe107⤵PID:1880
-
\??\c:\3xxrrrl.exec:\3xxrrrl.exe108⤵PID:2632
-
\??\c:\frrfrlx.exec:\frrfrlx.exe109⤵PID:4632
-
\??\c:\bnbttt.exec:\bnbttt.exe110⤵PID:732
-
\??\c:\hntntb.exec:\hntntb.exe111⤵PID:1960
-
\??\c:\dpjvp.exec:\dpjvp.exe112⤵PID:4900
-
\??\c:\3pdvv.exec:\3pdvv.exe113⤵PID:1820
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe114⤵PID:4976
-
\??\c:\tnnnbh.exec:\tnnnbh.exe115⤵PID:4156
-
\??\c:\tbbtbh.exec:\tbbtbh.exe116⤵PID:2124
-
\??\c:\9vjdj.exec:\9vjdj.exe117⤵PID:392
-
\??\c:\5jpjd.exec:\5jpjd.exe118⤵PID:3360
-
\??\c:\frrlfxx.exec:\frrlfxx.exe119⤵PID:1996
-
\??\c:\xrxxffl.exec:\xrxxffl.exe120⤵PID:2352
-
\??\c:\bhhhbt.exec:\bhhhbt.exe121⤵PID:4408
-
\??\c:\7bbtnh.exec:\7bbtnh.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-