Analysis
- max time kernel
150s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 01:22
Behavioral task
behavioral1
Sample
4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe
- Size 350KB
- Sample240511-brhtesfh42
- SHA256 50c4d6746f08f15375236523b8119440cd5d81d0b2e4dc6fdf2b29ba5fce7fcd
- MD5 4a17d79821a7e781d90fd9dc3da48f50
- SHA1 88af85ae4493833182c7c2c44a63b5252fbc02ce
- SHA512 d03196fc8df16dedd1cc60dcc7097590eed9deaa72ca81cc7aa0b02c985327d0ede456d04ce87282a4f38d26cc48fa00ced77075e91e237c0ddbd0842c25d7e9
- SSDEEP 6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrH6H:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1636-5-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1980-10-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4824-17-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4388-23-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4316-29-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3360-36-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2088-43-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2712-50-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1580-44-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/212-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/728-78-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3204-86-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/972-89-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3060-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1996-104-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1388-109-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1200-120-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2024-131-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1056-137-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/384-142-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2376-152-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1588-158-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5024-165-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/908-172-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1600-177-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4440-187-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4080-205-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1580-209-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4196-213-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3216-217-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4520-221-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2692-225-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1896-229-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1448-234-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1092-238-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4600-242-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3256-244-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3684-270-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3508-280-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/776-288-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4788-293-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4924-309-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2624-310-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4624-317-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1972-324-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1560-334-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3180-347-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3864-351-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/820-361-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4408-368-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3628-388-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2704-415-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1580-449-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3244-464-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2164-472-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/820-481-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/452-485-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1812-486-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3964-493-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2196-536-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3328-611-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2684-707-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3964-733-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4112-918-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0009000000023546-3.dat family_berbew behavioral2/files/0x000800000002354c-9.dat family_berbew behavioral2/files/0x000700000002354d-12.dat family_berbew behavioral2/files/0x000700000002354e-21.dat family_berbew behavioral2/files/0x000700000002354f-27.dat family_berbew behavioral2/files/0x0007000000023550-34.dat family_berbew behavioral2/files/0x0007000000023551-41.dat family_berbew behavioral2/files/0x0007000000023552-47.dat family_berbew behavioral2/files/0x0007000000023553-53.dat family_berbew behavioral2/files/0x0007000000023554-58.dat family_berbew behavioral2/files/0x0007000000023555-63.dat family_berbew behavioral2/files/0x0007000000023556-70.dat family_berbew behavioral2/files/0x0007000000023557-74.dat family_berbew behavioral2/files/0x0007000000023558-80.dat family_berbew behavioral2/files/0x0007000000023559-88.dat family_berbew behavioral2/files/0x000800000002354a-92.dat family_berbew behavioral2/files/0x000700000002355a-98.dat family_berbew behavioral2/files/0x000700000002355b-106.dat family_berbew behavioral2/files/0x000700000002355c-112.dat family_berbew behavioral2/files/0x000700000002355d-117.dat family_berbew behavioral2/files/0x000700000002355e-122.dat family_berbew behavioral2/files/0x000700000002355f-128.dat family_berbew behavioral2/files/0x0007000000023560-133.dat family_berbew behavioral2/files/0x0008000000023561-140.dat family_berbew behavioral2/files/0x000a000000023563-145.dat family_berbew behavioral2/files/0x0008000000023566-151.dat family_berbew behavioral2/files/0x0007000000023567-157.dat family_berbew behavioral2/files/0x0007000000023568-163.dat family_berbew behavioral2/files/0x0007000000023569-169.dat family_berbew behavioral2/files/0x00080000000232fa-178.dat family_berbew behavioral2/files/0x000700000002356a-181.dat family_berbew behavioral2/files/0x000700000002356b-188.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 1980 5thbhn.exe 4824 3xxrrlf.exe 4388 hbnhhh.exe 4316 7hhbtt.exe 3360 llxxrff.exe 2088 tnbtnh.exe 1580 xrrrlfx.exe 2712 nhbtnb.exe 464 bbhbtt.exe 212 1nnnhh.exe 4840 flrfxff.exe 4044 vvjpj.exe 728 tnttbt.exe 3204 hbbtnh.exe 972 1nthhb.exe 3060 nnhhtt.exe 1996 xfrrlll.exe 1388 fxffxxx.exe 4612 9hnhhh.exe 1200 7tbtnn.exe 4548 5nnhbb.exe 2024 xfffxxr.exe 1056 7rllfll.exe 384 jjjjj.exe 2376 ttbthh.exe 1588 rlfxrlr.exe 5024 ntthtn.exe 908 pjddv.exe 1600 nttnhb.exe 220 jvddv.exe 4440 xllrllx.exe 4384 pvpdd.exe 4984 xrlfrrf.exe 3360 3nntnn.exe 3240 5nnhbt.exe 4080 pjpdp.exe 1580 1lxlffx.exe 4196 bttbtt.exe 3216 7ttnbt.exe 4520 9vjdv.exe 2692 vjjvp.exe 1896 rfffxxx.exe 1448 ttbhbb.exe 1092 pppjj.exe 4600 pvjdv.exe 3256 9xfxrxr.exe 3200 ttttnn.exe 1684 vpjvp.exe 3920 lllfllf.exe 1948 lrfxxrl.exe 2888 5hnhbb.exe 336 tnthbh.exe 4248 1rlfffx.exe 3684 fxrrlrl.exe 1944 1hbbtb.exe 3508 jpjjj.exe 976 5vdvj.exe 4008 lrxrlll.exe 776 hbbbbh.exe 1484 vddvd.exe 3780 xrxrxrr.exe 1980 hhhbtn.exe 1252 pvddp.exe 4924 dpjdd.exe -
resource yara_rule behavioral2/memory/1636-5-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1980-10-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4824-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4388-19-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4388-23-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3360-31-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4316-29-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3360-36-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2088-43-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2712-50-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1580-44-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/212-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/728-78-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3204-86-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/972-89-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3060-95-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3060-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1996-104-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1388-109-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1200-120-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2024-131-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1056-137-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/384-142-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2376-152-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1588-158-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5024-165-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/908-166-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/908-172-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1600-177-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4440-187-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4080-205-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1580-209-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4196-213-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3216-217-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4520-221-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2692-225-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1896-229-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1448-230-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1448-234-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1092-238-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4600-242-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3256-244-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/336-262-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3684-270-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1944-273-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3508-280-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/976-281-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/776-288-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4788-293-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4924-309-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2624-310-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4624-317-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1972-324-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1560-334-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3180-347-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3864-351-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/820-361-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4408-368-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2420-381-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3628-388-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1512-395-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2612-399-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2704-415-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1600-419-0x0000000000400000-0x000000000042D000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1980 1636 4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe 89 PID 1636 wrote to memory of 1980 1636 4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe 89 PID 1636 wrote to memory of 1980 1636 4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe 89 PID 1980 wrote to memory of 4824 1980 5thbhn.exe 90 PID 1980 wrote to memory of 4824 1980 5thbhn.exe 90 PID 1980 wrote to memory of 4824 1980 5thbhn.exe 90 PID 4824 wrote to memory of 4388 4824 3xxrrlf.exe 91 PID 4824 wrote to memory of 4388 4824 3xxrrlf.exe 91 PID 4824 wrote to memory of 4388 4824 3xxrrlf.exe 91 PID 4388 wrote to memory of 4316 4388 hbnhhh.exe 92 PID 4388 wrote to memory of 4316 4388 hbnhhh.exe 92 PID 4388 wrote to memory of 4316 4388 hbnhhh.exe 92 PID 4316 wrote to memory of 3360 4316 7hhbtt.exe 95 PID 4316 wrote to memory of 3360 4316 7hhbtt.exe 95 PID 4316 wrote to memory of 3360 4316 7hhbtt.exe 95 PID 3360 wrote to memory of 2088 3360 llxxrff.exe 97 PID 3360 wrote to memory of 2088 3360 llxxrff.exe 97 PID 3360 wrote to memory of 2088 3360 llxxrff.exe 97 PID 2088 wrote to memory of 1580 2088 tnbtnh.exe 98 PID 2088 wrote to memory of 1580 2088 tnbtnh.exe 98 PID 2088 wrote to memory of 1580 2088 tnbtnh.exe 98 PID 1580 wrote to memory of 2712 1580 xrrrlfx.exe 99 PID 1580 wrote to memory of 2712 1580 xrrrlfx.exe 99 PID 1580 wrote to memory of 2712 1580 xrrrlfx.exe 99 PID 2712 wrote to memory of 464 2712 nhbtnb.exe 100 PID 2712 wrote to memory of 464 2712 nhbtnb.exe 100 PID 2712 wrote to memory of 464 2712 nhbtnb.exe 100 PID 464 wrote to memory of 212 464 bbhbtt.exe 101 PID 464 wrote to memory of 212 464 bbhbtt.exe 101 PID 464 wrote to memory of 212 464 bbhbtt.exe 101 PID 212 wrote to memory of 4840 212 1nnnhh.exe 102 PID 212 wrote to memory of 4840 212 1nnnhh.exe 102 PID 212 wrote to memory of 4840 212 1nnnhh.exe 102 PID 4840 wrote to memory of 4044 4840 flrfxff.exe 103 PID 4840 wrote to memory of 4044 4840 flrfxff.exe 103 PID 4840 wrote to memory of 4044 4840 flrfxff.exe 103 PID 4044 wrote to memory of 728 4044 vvjpj.exe 104 PID 4044 wrote to memory of 728 4044 vvjpj.exe 104 PID 4044 wrote to memory of 728 4044 vvjpj.exe 104 PID 728 wrote to memory of 3204 728 tnttbt.exe 105 PID 728 wrote to memory of 3204 728 tnttbt.exe 105 PID 728 wrote to memory of 3204 728 tnttbt.exe 105 PID 3204 wrote to memory of 972 3204 hbbtnh.exe 106 PID 3204 wrote to memory of 972 3204 hbbtnh.exe 106 PID 3204 wrote to memory of 972 3204 hbbtnh.exe 106 PID 972 wrote to memory of 3060 972 1nthhb.exe 107 PID 972 wrote to memory of 3060 972 1nthhb.exe 107 PID 972 wrote to memory of 3060 972 1nthhb.exe 107 PID 3060 wrote to memory of 1996 3060 nnhhtt.exe 108 PID 3060 wrote to memory of 1996 3060 nnhhtt.exe 108 PID 3060 wrote to memory of 1996 3060 nnhhtt.exe 108 PID 1996 wrote to memory of 1388 1996 xfrrlll.exe 109 PID 1996 wrote to memory of 1388 1996 xfrrlll.exe 109 PID 1996 wrote to memory of 1388 1996 xfrrlll.exe 109 PID 1388 wrote to memory of 4612 1388 fxffxxx.exe 110 PID 1388 wrote to memory of 4612 1388 fxffxxx.exe 110 PID 1388 wrote to memory of 4612 1388 fxffxxx.exe 110 PID 4612 wrote to memory of 1200 4612 9hnhhh.exe 111 PID 4612 wrote to memory of 1200 4612 9hnhhh.exe 111 PID 4612 wrote to memory of 1200 4612 9hnhhh.exe 111 PID 1200 wrote to memory of 4548 1200 7tbtnn.exe 112 PID 1200 wrote to memory of 4548 1200 7tbtnn.exe 112 PID 1200 wrote to memory of 4548 1200 7tbtnn.exe 112 PID 4548 wrote to memory of 2024 4548 5nnhbb.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4a17d79821a7e781d90fd9dc3da48f50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\5thbhn.exec:\5thbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\3xxrrlf.exec:\3xxrrlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\hbnhhh.exec:\hbnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\7hhbtt.exec:\7hhbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
\??\c:\llxxrff.exec:\llxxrff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\tnbtnh.exec:\tnbtnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\nhbtnb.exec:\nhbtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\bbhbtt.exec:\bbhbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\1nnnhh.exec:\1nnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\flrfxff.exec:\flrfxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\vvjpj.exec:\vvjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\tnttbt.exec:\tnttbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\hbbtnh.exec:\hbbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\1nthhb.exec:\1nthhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\nnhhtt.exec:\nnhhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xfrrlll.exec:\xfrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\fxffxxx.exec:\fxffxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\9hnhhh.exec:\9hnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\7tbtnn.exec:\7tbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\5nnhbb.exec:\5nnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\xfffxxr.exec:\xfffxxr.exe23⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7rllfll.exec:\7rllfll.exe24⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jjjjj.exec:\jjjjj.exe25⤵
- Executes dropped EXE
PID:384 -
\??\c:\ttbthh.exec:\ttbthh.exe26⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlfxrlr.exec:\rlfxrlr.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ntthtn.exec:\ntthtn.exe28⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pjddv.exec:\pjddv.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\nttnhb.exec:\nttnhb.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jvddv.exec:\jvddv.exe31⤵
- Executes dropped EXE
PID:220 -
\??\c:\xllrllx.exec:\xllrllx.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pvpdd.exec:\pvpdd.exe33⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xrlfrrf.exec:\xrlfrrf.exe34⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3nntnn.exec:\3nntnn.exe35⤵
- Executes dropped EXE
PID:3360 -
\??\c:\5nnhbt.exec:\5nnhbt.exe36⤵
- Executes dropped EXE
PID:3240 -
\??\c:\pjpdp.exec:\pjpdp.exe37⤵
- Executes dropped EXE
PID:4080 -
\??\c:\1lxlffx.exec:\1lxlffx.exe38⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bttbtt.exec:\bttbtt.exe39⤵
- Executes dropped EXE
PID:4196 -
\??\c:\7ttnbt.exec:\7ttnbt.exe40⤵
- Executes dropped EXE
PID:3216 -
\??\c:\9vjdv.exec:\9vjdv.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vjjvp.exec:\vjjvp.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rfffxxx.exec:\rfffxxx.exe43⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ttbhbb.exec:\ttbhbb.exe44⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pppjj.exec:\pppjj.exe45⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pvjdv.exec:\pvjdv.exe46⤵
- Executes dropped EXE
PID:4600 -
\??\c:\9xfxrxr.exec:\9xfxrxr.exe47⤵
- Executes dropped EXE
PID:3256 -
\??\c:\ttttnn.exec:\ttttnn.exe48⤵
- Executes dropped EXE
PID:3200 -
\??\c:\vpjvp.exec:\vpjvp.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lllfllf.exec:\lllfllf.exe50⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lrfxxrl.exec:\lrfxxrl.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5hnhbb.exec:\5hnhbb.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnthbh.exec:\tnthbh.exe53⤵
- Executes dropped EXE
PID:336 -
\??\c:\1rlfffx.exec:\1rlfffx.exe54⤵
- Executes dropped EXE
PID:4248 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe55⤵
- Executes dropped EXE
PID:3684 -
\??\c:\1hbbtb.exec:\1hbbtb.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jpjjj.exec:\jpjjj.exe57⤵
- Executes dropped EXE
PID:3508 -
\??\c:\5vdvj.exec:\5vdvj.exe58⤵
- Executes dropped EXE
PID:976 -
\??\c:\lrxrlll.exec:\lrxrlll.exe59⤵
- Executes dropped EXE
PID:4008 -
\??\c:\hbbbbh.exec:\hbbbbh.exe60⤵
- Executes dropped EXE
PID:776 -
\??\c:\vddvd.exec:\vddvd.exe61⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pdjvj.exec:\pdjvj.exe62⤵PID:4788
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe63⤵
- Executes dropped EXE
PID:3780 -
\??\c:\hhhbtn.exec:\hhhbtn.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\pvddp.exec:\pvddp.exe65⤵
- Executes dropped EXE
PID:1252 -
\??\c:\dpjdd.exec:\dpjdd.exe66⤵
- Executes dropped EXE
PID:4924 -
\??\c:\rllfxxx.exec:\rllfxxx.exe67⤵PID:2624
-
\??\c:\tntnhn.exec:\tntnhn.exe68⤵PID:4624
-
\??\c:\ddjdd.exec:\ddjdd.exe69⤵PID:3708
-
\??\c:\9xfxllf.exec:\9xfxllf.exe70⤵PID:1972
-
\??\c:\tbhhbb.exec:\tbhhbb.exe71⤵PID:2492
-
\??\c:\vdvvp.exec:\vdvvp.exe72⤵PID:1976
-
\??\c:\jpdvv.exec:\jpdvv.exe73⤵PID:1560
-
\??\c:\xlffllx.exec:\xlffllx.exe74⤵PID:5052
-
\??\c:\9vdvp.exec:\9vdvp.exe75⤵PID:924
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe76⤵PID:3068
-
\??\c:\9hbtht.exec:\9hbtht.exe77⤵PID:3180
-
\??\c:\dpvpp.exec:\dpvpp.exe78⤵PID:4280
-
\??\c:\7lfxrff.exec:\7lfxrff.exe79⤵PID:3864
-
\??\c:\tthbhh.exec:\tthbhh.exe80⤵PID:3812
-
\??\c:\tbbttn.exec:\tbbttn.exe81⤵PID:820
-
\??\c:\7pvdp.exec:\7pvdp.exe82⤵PID:4920
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe83⤵PID:4408
-
\??\c:\hhhbhh.exec:\hhhbhh.exe84⤵PID:2892
-
\??\c:\dvjjd.exec:\dvjjd.exe85⤵PID:3964
-
\??\c:\7pddv.exec:\7pddv.exe86⤵PID:2564
-
\??\c:\rlllfff.exec:\rlllfff.exe87⤵PID:112
-
\??\c:\1bhtnn.exec:\1bhtnn.exe88⤵PID:2420
-
\??\c:\nthbtt.exec:\nthbtt.exe89⤵PID:1352
-
\??\c:\pjjvp.exec:\pjjvp.exe90⤵PID:3628
-
\??\c:\7rrxlfr.exec:\7rrxlfr.exe91⤵PID:4248
-
\??\c:\frfrlrf.exec:\frfrlrf.exe92⤵PID:1512
-
\??\c:\hbbbtt.exec:\hbbbtt.exe93⤵PID:2612
-
\??\c:\vvvvv.exec:\vvvvv.exe94⤵PID:4136
-
\??\c:\ffxrlll.exec:\ffxrlll.exe95⤵PID:2588
-
\??\c:\5bnnhh.exec:\5bnnhh.exe96⤵PID:4396
-
\??\c:\bnnhbb.exec:\bnnhbb.exe97⤵PID:2704
-
\??\c:\jjdjd.exec:\jjdjd.exe98⤵PID:4788
-
\??\c:\frfxrxx.exec:\frfxrxx.exe99⤵PID:1600
-
\??\c:\hbtnnn.exec:\hbtnnn.exe100⤵PID:1532
-
\??\c:\jddvv.exec:\jddvv.exe101⤵PID:220
-
\??\c:\1fxxfll.exec:\1fxxfll.exe102⤵PID:4388
-
\??\c:\1xlfllr.exec:\1xlfllr.exe103⤵PID:4316
-
\??\c:\5tbtnn.exec:\5tbtnn.exe104⤵PID:1184
-
\??\c:\jddvj.exec:\jddvj.exe105⤵PID:1788
-
\??\c:\7pjvp.exec:\7pjvp.exe106⤵PID:1292
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe107⤵PID:2492
-
\??\c:\tttntb.exec:\tttntb.exe108⤵PID:1580
-
\??\c:\dvjdv.exec:\dvjdv.exe109⤵PID:1560
-
\??\c:\9pvpj.exec:\9pvpj.exe110⤵PID:5052
-
\??\c:\1lrlflx.exec:\1lrlflx.exe111⤵PID:1060
-
\??\c:\hnhbbn.exec:\hnhbbn.exe112⤵PID:3244
-
\??\c:\bbbbtt.exec:\bbbbtt.exe113⤵PID:3276
-
\??\c:\dvjjp.exec:\dvjjp.exe114⤵PID:2852
-
\??\c:\rxlxxxx.exec:\rxlxxxx.exe115⤵PID:2164
-
\??\c:\xlflfrl.exec:\xlflfrl.exe116⤵PID:3204
-
\??\c:\tnhbtt.exec:\tnhbtt.exe117⤵PID:820
-
\??\c:\vdjvp.exec:\vdjvp.exe118⤵PID:452
-
\??\c:\vpdpd.exec:\vpdpd.exe119⤵PID:1812
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe120⤵PID:1684
-
\??\c:\hhhbtn.exec:\hhhbtn.exe121⤵PID:3964
-
\??\c:\tnnhtt.exec:\tnnhtt.exe122⤵PID:1388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-