Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
11/05/2024, 02:27
Behavioral task
behavioral1
Sample
5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe
- Size 469KB
- Sample240511-cxtcsagb9v
- SHA256 3f3d20c290a8b85320e268a0288d0e0d41e6f8fb3691ca8aa1b689655246daa0
- MD5 5b1159e354d1cb0630821457b985c950
- SHA1 47693a4e839208dbf6c8ca800f76f78955c18109
- SHA512 99cb79c28d7a7d488bca7f605f89fbbc4e86b81ceee6358780ee826fcd8a37a23798f497e83ee722afa2522515b310968e60e50c95bbc6d83e52133dc4444a6d
- SSDEEP 12288:57Tc1WjdpKGATTk/6Aihgth7L/QOKs+Q/RIVBjdB/22LX1j:TZpTATrAihgth7L/QOKs+Q/RIVBjdB/V
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3320-5-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2500-11-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1496-17-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4040-30-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3028-35-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3968-25-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1196-48-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2372-55-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2988-50-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/400-62-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1608-74-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4760-68-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/416-87-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3604-85-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/736-110-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/740-117-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4836-131-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2092-107-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3628-101-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/320-159-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2436-164-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2436-168-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1700-176-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1548-172-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1620-190-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1648-193-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1520-200-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/404-202-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2500-211-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4220-215-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2780-219-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3948-229-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4040-231-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4824-237-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3440-241-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3516-257-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/416-274-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4412-286-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4016-290-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4596-297-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3860-313-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3148-324-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3308-334-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1888-351-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4216-356-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4172-375-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2124-409-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2840-416-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4412-444-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4248-448-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5108-489-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2864-506-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3288-537-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2624-606-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/880-610-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4476-632-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2856-660-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3456-668-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5084-823-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4112-855-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2944-955-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/628-974-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/516-984-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2716-1013-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x000800000002340e-9.dat family_berbew behavioral2/files/0x000700000002340f-13.dat family_berbew behavioral2/files/0x0007000000023411-27.dat family_berbew behavioral2/files/0x0007000000023412-34.dat family_berbew behavioral2/files/0x0007000000023410-22.dat family_berbew behavioral2/files/0x0007000000023413-39.dat family_berbew behavioral2/files/0x0007000000023414-45.dat family_berbew behavioral2/files/0x0007000000023411-52.dat family_berbew behavioral2/files/0x0007000000023415-58.dat family_berbew behavioral2/files/0x0007000000023416-64.dat family_berbew behavioral2/files/0x0007000000023417-70.dat family_berbew behavioral2/files/0x0007000000023418-76.dat family_berbew behavioral2/files/0x0007000000023419-82.dat family_berbew behavioral2/files/0x000800000002340c-89.dat family_berbew behavioral2/files/0x000700000002341a-94.dat family_berbew behavioral2/files/0x000800000002341d-108.dat family_berbew behavioral2/files/0x000700000002341e-113.dat family_berbew behavioral2/files/0x000700000002341f-121.dat family_berbew behavioral2/files/0x0007000000023420-125.dat family_berbew behavioral2/files/0x0007000000023421-129.dat family_berbew behavioral2/files/0x0007000000023422-135.dat family_berbew behavioral2/files/0x0007000000023423-141.dat family_berbew behavioral2/files/0x000800000002341b-102.dat family_berbew behavioral2/files/0x000800000001e92c-146.dat family_berbew behavioral2/files/0x0007000000023424-150.dat family_berbew behavioral2/files/0x0007000000023425-155.dat family_berbew behavioral2/files/0x0007000000023426-161.dat family_berbew behavioral2/files/0x0007000000023427-169.dat family_berbew behavioral2/files/0x0007000000023428-174.dat family_berbew behavioral2/files/0x000700000002342a-185.dat family_berbew behavioral2/files/0x0007000000023429-182.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 2500 9ppdp.exe 3240 bntnhb.exe 1496 5lfxrlf.exe 3968 hnbbhh.exe 4040 pddvp.exe 3028 xxrrlxx.exe 1196 tnhbht.exe 2988 bhnhtt.exe 2372 pddvp.exe 400 dvvvj.exe 4760 dpvpd.exe 1608 rffxxfx.exe 3604 1rrlxxr.exe 416 hnhbtn.exe 4208 1vvpj.exe 3628 vvvvd.exe 2092 llxxflr.exe 736 nhtbtt.exe 740 pdppp.exe 2044 httnhh.exe 3672 dvvpj.exe 4836 vpppp.exe 1300 nbtttn.exe 3648 9bhhbb.exe 3224 9vppj.exe 5108 lfxflrf.exe 320 jpddd.exe 2436 lxfffll.exe 1548 9xxxxff.exe 1700 thhhhh.exe 1484 vpddd.exe 1620 ffxxrrl.exe 1648 hnttnn.exe 1520 lrxxxff.exe 404 hhhhht.exe 372 ddjjp.exe 2500 frllxxx.exe 4220 nbtttt.exe 4172 dvjjv.exe 2780 lrfffrr.exe 2412 bbhbbb.exe 3948 jjpvv.exe 4040 fxxxlrx.exe 4508 hnhhhh.exe 4824 vvvdd.exe 3440 rxrrflr.exe 4292 rlrfxxr.exe 5112 hnhhbn.exe 1008 vpvvv.exe 3516 rrffllr.exe 872 hhhnhn.exe 3832 3vppp.exe 696 rrxxxxx.exe 4692 xrrrrrr.exe 2252 htbbbh.exe 416 vvvvv.exe 5028 rfxxlll.exe 4208 5frrrxr.exe 4412 tbhbbh.exe 4016 dpppj.exe 3368 rxxxrrl.exe 4596 hbhbbb.exe 2484 bnnhhh.exe 3928 1dvpp.exe -
resource yara_rule behavioral2/memory/3320-5-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2500-11-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1496-17-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4040-30-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3028-35-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3968-25-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1196-42-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1196-48-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2372-55-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2988-50-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/400-62-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1608-74-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3604-78-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4760-68-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/416-87-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3604-85-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2092-103-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/736-110-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/740-117-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4836-131-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2092-107-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3628-101-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/320-159-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2436-164-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2436-168-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1700-176-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1548-172-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1620-190-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1648-193-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1520-200-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/404-202-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2500-211-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4220-215-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2780-219-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3948-229-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4040-231-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4824-237-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3440-241-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3516-257-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/416-274-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4412-286-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4016-290-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4596-297-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3860-313-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3404-314-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3148-324-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3308-334-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1888-351-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4216-356-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4172-375-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2124-409-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2840-416-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4412-444-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4248-448-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3648-476-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5108-489-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2864-506-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4848-519-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4112-532-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3288-537-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2624-606-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/880-610-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4476-632-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2856-660-0x0000000000400000-0x000000000042B000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3320 wrote to memory of 2500 3320 5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe 82 PID 3320 wrote to memory of 2500 3320 5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe 82 PID 3320 wrote to memory of 2500 3320 5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe 82 PID 2500 wrote to memory of 3240 2500 9ppdp.exe 83 PID 2500 wrote to memory of 3240 2500 9ppdp.exe 83 PID 2500 wrote to memory of 3240 2500 9ppdp.exe 83 PID 3240 wrote to memory of 1496 3240 bntnhb.exe 84 PID 3240 wrote to memory of 1496 3240 bntnhb.exe 84 PID 3240 wrote to memory of 1496 3240 bntnhb.exe 84 PID 1496 wrote to memory of 3968 1496 5lfxrlf.exe 85 PID 1496 wrote to memory of 3968 1496 5lfxrlf.exe 85 PID 1496 wrote to memory of 3968 1496 5lfxrlf.exe 85 PID 3968 wrote to memory of 4040 3968 hnbbhh.exe 86 PID 3968 wrote to memory of 4040 3968 hnbbhh.exe 86 PID 3968 wrote to memory of 4040 3968 hnbbhh.exe 86 PID 4040 wrote to memory of 3028 4040 pddvp.exe 87 PID 4040 wrote to memory of 3028 4040 pddvp.exe 87 PID 4040 wrote to memory of 3028 4040 pddvp.exe 87 PID 3028 wrote to memory of 1196 3028 xxrrlxx.exe 88 PID 3028 wrote to memory of 1196 3028 xxrrlxx.exe 88 PID 3028 wrote to memory of 1196 3028 xxrrlxx.exe 88 PID 1196 wrote to memory of 2988 1196 tnhbht.exe 90 PID 1196 wrote to memory of 2988 1196 tnhbht.exe 90 PID 1196 wrote to memory of 2988 1196 tnhbht.exe 90 PID 2988 wrote to memory of 2372 2988 bhnhtt.exe 91 PID 2988 wrote to memory of 2372 2988 bhnhtt.exe 91 PID 2988 wrote to memory of 2372 2988 bhnhtt.exe 91 PID 2372 wrote to memory of 400 2372 pddvp.exe 93 PID 2372 wrote to memory of 400 2372 pddvp.exe 93 PID 2372 wrote to memory of 400 2372 pddvp.exe 93 PID 400 wrote to memory of 4760 400 dvvvj.exe 94 PID 400 wrote to memory of 4760 400 dvvvj.exe 94 PID 400 wrote to memory of 4760 400 dvvvj.exe 94 PID 4760 wrote to memory of 1608 4760 dpvpd.exe 95 PID 4760 wrote to memory of 1608 4760 dpvpd.exe 95 PID 4760 wrote to memory of 1608 4760 dpvpd.exe 95 PID 1608 wrote to memory of 3604 1608 rffxxfx.exe 96 PID 1608 wrote to memory of 3604 1608 rffxxfx.exe 96 PID 1608 wrote to memory of 3604 1608 rffxxfx.exe 96 PID 3604 wrote to memory of 416 3604 1rrlxxr.exe 98 PID 3604 wrote to memory of 416 3604 1rrlxxr.exe 98 PID 3604 wrote to memory of 416 3604 1rrlxxr.exe 98 PID 416 wrote to memory of 4208 416 hnhbtn.exe 99 PID 416 wrote to memory of 4208 416 hnhbtn.exe 99 PID 416 wrote to memory of 4208 416 hnhbtn.exe 99 PID 4208 wrote to memory of 3628 4208 1vvpj.exe 100 PID 4208 wrote to memory of 3628 4208 1vvpj.exe 100 PID 4208 wrote to memory of 3628 4208 1vvpj.exe 100 PID 3628 wrote to memory of 2092 3628 vvvvd.exe 102 PID 3628 wrote to memory of 2092 3628 vvvvd.exe 102 PID 3628 wrote to memory of 2092 3628 vvvvd.exe 102 PID 2092 wrote to memory of 736 2092 llxxflr.exe 103 PID 2092 wrote to memory of 736 2092 llxxflr.exe 103 PID 2092 wrote to memory of 736 2092 llxxflr.exe 103 PID 736 wrote to memory of 740 736 nhtbtt.exe 104 PID 736 wrote to memory of 740 736 nhtbtt.exe 104 PID 736 wrote to memory of 740 736 nhtbtt.exe 104 PID 740 wrote to memory of 2044 740 pdppp.exe 105 PID 740 wrote to memory of 2044 740 pdppp.exe 105 PID 740 wrote to memory of 2044 740 pdppp.exe 105 PID 2044 wrote to memory of 3672 2044 httnhh.exe 106 PID 2044 wrote to memory of 3672 2044 httnhh.exe 106 PID 2044 wrote to memory of 3672 2044 httnhh.exe 106 PID 3672 wrote to memory of 4836 3672 dvvpj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5b1159e354d1cb0630821457b985c950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\9ppdp.exec:\9ppdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\bntnhb.exec:\bntnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\5lfxrlf.exec:\5lfxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hnbbhh.exec:\hnbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\pddvp.exec:\pddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\xxrrlxx.exec:\xxrrlxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\tnhbht.exec:\tnhbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\bhnhtt.exec:\bhnhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\pddvp.exec:\pddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\dvvvj.exec:\dvvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\dpvpd.exec:\dpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\rffxxfx.exec:\rffxxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\1rrlxxr.exec:\1rrlxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\hnhbtn.exec:\hnhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\1vvpj.exec:\1vvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\vvvvd.exec:\vvvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\llxxflr.exec:\llxxflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\nhtbtt.exec:\nhtbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\pdppp.exec:\pdppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\httnhh.exec:\httnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\vpppp.exec:\vpppp.exe23⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nbtttn.exec:\nbtttn.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\9bhhbb.exec:\9bhhbb.exe25⤵
- Executes dropped EXE
PID:3648 -
\??\c:\9vppj.exec:\9vppj.exe26⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lfxflrf.exec:\lfxflrf.exe27⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jpddd.exec:\jpddd.exe28⤵
- Executes dropped EXE
PID:320 -
\??\c:\lxfffll.exec:\lxfffll.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\9xxxxff.exec:\9xxxxff.exe30⤵
- Executes dropped EXE
PID:1548 -
\??\c:\thhhhh.exec:\thhhhh.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpddd.exec:\vpddd.exe32⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hnttnn.exec:\hnttnn.exe34⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrxxxff.exec:\lrxxxff.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hhhhht.exec:\hhhhht.exe36⤵
- Executes dropped EXE
PID:404 -
\??\c:\ddjjp.exec:\ddjjp.exe37⤵
- Executes dropped EXE
PID:372 -
\??\c:\frllxxx.exec:\frllxxx.exe38⤵
- Executes dropped EXE
PID:2500 -
\??\c:\nbtttt.exec:\nbtttt.exe39⤵
- Executes dropped EXE
PID:4220 -
\??\c:\dvjjv.exec:\dvjjv.exe40⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lrfffrr.exec:\lrfffrr.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bbhbbb.exec:\bbhbbb.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jjpvv.exec:\jjpvv.exe43⤵
- Executes dropped EXE
PID:3948 -
\??\c:\fxxxlrx.exec:\fxxxlrx.exe44⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hnhhhh.exec:\hnhhhh.exe45⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vvvdd.exec:\vvvdd.exe46⤵
- Executes dropped EXE
PID:4824 -
\??\c:\rxrrflr.exec:\rxrrflr.exe47⤵
- Executes dropped EXE
PID:3440 -
\??\c:\rlrfxxr.exec:\rlrfxxr.exe48⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hnhhbn.exec:\hnhhbn.exe49⤵
- Executes dropped EXE
PID:5112 -
\??\c:\vpvvv.exec:\vpvvv.exe50⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rrffllr.exec:\rrffllr.exe51⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hhhnhn.exec:\hhhnhn.exe52⤵
- Executes dropped EXE
PID:872 -
\??\c:\3vppp.exec:\3vppp.exe53⤵
- Executes dropped EXE
PID:3832 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe54⤵
- Executes dropped EXE
PID:696 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe55⤵
- Executes dropped EXE
PID:4692 -
\??\c:\htbbbh.exec:\htbbbh.exe56⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vvvvv.exec:\vvvvv.exe57⤵
- Executes dropped EXE
PID:416 -
\??\c:\rfxxlll.exec:\rfxxlll.exe58⤵
- Executes dropped EXE
PID:5028 -
\??\c:\5frrrxr.exec:\5frrrxr.exe59⤵
- Executes dropped EXE
PID:4208 -
\??\c:\tbhbbh.exec:\tbhbbh.exe60⤵
- Executes dropped EXE
PID:4412 -
\??\c:\dpppj.exec:\dpppj.exe61⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe62⤵
- Executes dropped EXE
PID:3368 -
\??\c:\hbhbbb.exec:\hbhbbb.exe63⤵
- Executes dropped EXE
PID:4596 -
\??\c:\bnnhhh.exec:\bnnhhh.exe64⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1dvpp.exec:\1dvpp.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rxlflll.exec:\rxlflll.exe66⤵PID:436
-
\??\c:\9ffxrxr.exec:\9ffxrxr.exe67⤵PID:1696
-
\??\c:\9bnnnn.exec:\9bnnnn.exe68⤵PID:3860
-
\??\c:\7pvvv.exec:\7pvvv.exe69⤵PID:3404
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe70⤵PID:3648
-
\??\c:\xfffrrx.exec:\xfffrrx.exe71⤵PID:4880
-
\??\c:\tnbbtt.exec:\tnbbtt.exe72⤵PID:3148
-
\??\c:\1jpjj.exec:\1jpjj.exe73⤵PID:3812
-
\??\c:\xfffrxx.exec:\xfffrxx.exe74⤵PID:3328
-
\??\c:\tnbtnt.exec:\tnbtnt.exe75⤵PID:3308
-
\??\c:\btbbnt.exec:\btbbnt.exe76⤵PID:2576
-
\??\c:\9jppp.exec:\9jppp.exe77⤵PID:1480
-
\??\c:\fffxxff.exec:\fffxxff.exe78⤵PID:5084
-
\??\c:\bbnnhh.exec:\bbnnhh.exe79⤵PID:2496
-
\??\c:\bhnntt.exec:\bhnntt.exe80⤵PID:1888
-
\??\c:\pdddd.exec:\pdddd.exe81⤵PID:3564
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe82⤵PID:4216
-
\??\c:\bbhhhh.exec:\bbhhhh.exe83⤵PID:5076
-
\??\c:\nthhnt.exec:\nthhnt.exe84⤵PID:1708
-
\??\c:\pdvvv.exec:\pdvvv.exe85⤵PID:4716
-
\??\c:\llxrrrr.exec:\llxrrrr.exe86⤵PID:220
-
\??\c:\vvjjp.exec:\vvjjp.exe87⤵PID:4112
-
\??\c:\5ddjj.exec:\5ddjj.exe88⤵PID:4172
-
\??\c:\flxrlll.exec:\flxrlll.exe89⤵PID:2780
-
\??\c:\vdjjp.exec:\vdjjp.exe90⤵PID:216
-
\??\c:\xrlxlfx.exec:\xrlxlfx.exe91⤵PID:1684
-
\??\c:\tnnnhh.exec:\tnnnhh.exe92⤵PID:5104
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:4960
-
\??\c:\jdvdv.exec:\jdvdv.exe94⤵PID:884
-
\??\c:\lflfffl.exec:\lflfffl.exe95⤵PID:4872
-
\??\c:\btnhbb.exec:\btnhbb.exe96⤵PID:4884
-
\??\c:\vdjdd.exec:\vdjdd.exe97⤵PID:2372
-
\??\c:\5vdpj.exec:\5vdpj.exe98⤵PID:5008
-
\??\c:\fllfrrf.exec:\fllfrrf.exe99⤵PID:2124
-
\??\c:\9thbnn.exec:\9thbnn.exe100⤵PID:1808
-
\??\c:\pjvjp.exec:\pjvjp.exe101⤵PID:2840
-
\??\c:\lrxrxxr.exec:\lrxrxxr.exe102⤵PID:1892
-
\??\c:\7nhhtt.exec:\7nhhtt.exe103⤵PID:4792
-
\??\c:\3nbthh.exec:\3nbthh.exe104⤵PID:1524
-
\??\c:\lfffxfx.exec:\lfffxfx.exe105⤵PID:4200
-
\??\c:\xllrrrx.exec:\xllrrrx.exe106⤵PID:2364
-
\??\c:\5bbhbh.exec:\5bbhbh.exe107⤵PID:3924
-
\??\c:\dvjpv.exec:\dvjpv.exe108⤵PID:1252
-
\??\c:\7xxxrrf.exec:\7xxxrrf.exe109⤵PID:4412
-
\??\c:\nbhhnn.exec:\nbhhnn.exe110⤵PID:4248
-
\??\c:\nnttbh.exec:\nnttbh.exe111⤵PID:236
-
\??\c:\5rrrrxf.exec:\5rrrrxf.exe112⤵PID:1840
-
\??\c:\lxfxrrf.exec:\lxfxrrf.exe113⤵PID:4324
-
\??\c:\9thhnn.exec:\9thhnn.exe114⤵PID:4836
-
\??\c:\pjdjj.exec:\pjdjj.exe115⤵PID:2608
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe116⤵PID:4632
-
\??\c:\bthbbb.exec:\bthbbb.exe117⤵PID:1804
-
\??\c:\dvddj.exec:\dvddj.exe118⤵PID:4456
-
\??\c:\vdppv.exec:\vdppv.exe119⤵PID:4476
-
\??\c:\rlxffll.exec:\rlxffll.exe120⤵PID:3648
-
\??\c:\1bnbbb.exec:\1bnbbb.exe121⤵PID:852
-
\??\c:\tnbbtt.exec:\tnbbtt.exe122⤵PID:1736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-