Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
12/05/2024, 20:08
Behavioral task
behavioral1
Sample
50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe
- Size 350KB
- Sample240512-ywt4kshc37
- SHA256 9c80a7cfe2a722e1a56c319c1e43b8dcd34501eb5e6cdd2bf3890a7ba5017b83
- MD5 50e6488eaab42f40a83807c1db43eec0
- SHA1 c4948a808ecad150ba60a1df599add512adbc979
- SHA512 ff5551e4ced992e3c78d2c65e724047a7527b26f7f4469b3ee49e078a7aa9ca6d8b788f37917d5557b4955aaae864580d66656ca99ff40ee98f0397009bcfef5
- SSDEEP 6144:4cm7ImGddXvJuzyy/SfVFKpU/sien7NuOpo0HmtDKe0wKyKqiOfm8RCfDK4TrH5:+7TcBuGy/Sa+/sie0OpncKe/KFBOfmzB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4504-3-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3148-13-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4564-10-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/604-25-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/704-24-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4328-37-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4704-42-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5056-52-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3096-55-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4856-61-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1800-65-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3888-76-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3896-79-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2084-90-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1296-96-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3220-102-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1520-113-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1524-128-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2132-133-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2028-136-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2692-153-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3408-159-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1428-172-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3616-169-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/796-176-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3352-187-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5088-193-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2516-196-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2192-207-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3468-216-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2120-219-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3448-230-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2004-247-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1788-251-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4724-261-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/8-274-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2776-275-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2532-286-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3964-293-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1892-303-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4116-307-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5032-309-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1452-312-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3664-319-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2544-331-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/796-355-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5016-387-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4748-411-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4804-422-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1072-434-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1960-438-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3696-442-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4512-446-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4680-450-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3048-460-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4796-494-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/5056-556-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3668-629-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2516-646-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1400-750-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/4452-774-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/2836-800-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/3300-892-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral2/memory/1660-946-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000800000002327d-4.dat family_berbew behavioral2/files/0x00070000000233f6-8.dat family_berbew behavioral2/files/0x00070000000233f7-12.dat family_berbew behavioral2/files/0x00070000000233f8-21.dat family_berbew behavioral2/files/0x00070000000233f9-28.dat family_berbew behavioral2/files/0x00070000000233fa-33.dat family_berbew behavioral2/files/0x00070000000233fb-39.dat family_berbew behavioral2/files/0x00070000000233fc-45.dat family_berbew behavioral2/files/0x00070000000233fd-50.dat family_berbew behavioral2/files/0x00070000000233fe-57.dat family_berbew behavioral2/files/0x00070000000233ff-63.dat family_berbew behavioral2/files/0x0007000000023400-69.dat family_berbew behavioral2/files/0x0007000000023401-74.dat family_berbew behavioral2/files/0x0007000000023402-82.dat family_berbew behavioral2/files/0x00090000000233f1-86.dat family_berbew behavioral2/files/0x0007000000023403-93.dat family_berbew behavioral2/files/0x0007000000023404-98.dat family_berbew behavioral2/files/0x0007000000023405-104.dat family_berbew behavioral2/files/0x0007000000023406-110.dat family_berbew behavioral2/files/0x0007000000023407-116.dat family_berbew behavioral2/files/0x0007000000023408-121.dat family_berbew behavioral2/files/0x0007000000023409-126.dat family_berbew behavioral2/files/0x000700000002340a-134.dat family_berbew behavioral2/files/0x000700000002340b-139.dat family_berbew behavioral2/files/0x000700000002340c-144.dat family_berbew behavioral2/files/0x000700000002340d-150.dat family_berbew behavioral2/files/0x000700000002340f-155.dat family_berbew behavioral2/files/0x0007000000023410-161.dat family_berbew behavioral2/files/0x0007000000023411-167.dat family_berbew behavioral2/files/0x0007000000023412-174.dat family_berbew behavioral2/files/0x0007000000023413-180.dat family_berbew behavioral2/files/0x0007000000023414-185.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4564 jdvvv.exe 3148 rrrlxxr.exe 704 bbnnnb.exe 604 nbhbtn.exe 2128 xlxlfxl.exe 4328 nhtbhh.exe 4704 hnhnnt.exe 5056 lxlflll.exe 3096 bttnhh.exe 4856 1bhbtt.exe 1800 jvdvp.exe 3888 5hnnhn.exe 3896 hhhbtt.exe 2248 xrlrrlr.exe 2084 3ntbtn.exe 1296 jjjdd.exe 3220 jvddv.exe 1520 lfxrrrf.exe 4080 tthbtt.exe 4484 vpjdv.exe 1524 3vjdj.exe 2132 httnht.exe 2028 vpddp.exe 2672 3fffxrl.exe 2736 ttbbbh.exe 2692 ppjdp.exe 3408 5flfrrr.exe 3616 7htntn.exe 1428 jdvvp.exe 796 dvvpj.exe 3588 nhhbbb.exe 3352 tntnbb.exe 5088 vppdp.exe 2516 7lrrrxr.exe 548 lrxrlff.exe 4956 hhtbtn.exe 2192 pvvvv.exe 4592 frxrrxx.exe 3468 nhttnn.exe 2120 nbnnnn.exe 3444 7lfxfrl.exe 2448 9rxrllf.exe 3416 tbnhbb.exe 3448 vvvpv.exe 1224 dppjp.exe 3432 9frlfll.exe 4456 nnhhhh.exe 2004 pppjd.exe 4964 ddpjp.exe 1788 rflfrll.exe 2240 xrxxxxx.exe 4724 nnbbtn.exe 2916 jvddv.exe 3888 frfrlrl.exe 4752 nnbttt.exe 8 3vdvd.exe 2776 pvjvd.exe 228 rrxxrrl.exe 3860 lfrlfxx.exe 2532 1nnbbt.exe 3964 djjdd.exe 3048 xrrrlll.exe 4220 1rfxrrr.exe 1892 thhbtn.exe -
resource yara_rule behavioral2/memory/4504-3-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3148-13-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4564-10-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/704-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/604-25-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/704-24-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4328-37-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4704-42-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5056-52-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3096-55-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4856-61-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1800-65-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3888-76-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3896-79-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2084-90-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1296-96-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3220-102-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1520-113-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1524-128-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2132-133-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2028-136-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2692-153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3408-159-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3616-163-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1428-172-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3616-169-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/796-176-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3352-187-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5088-193-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2516-196-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2192-207-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3468-216-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2120-219-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3444-220-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3448-230-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1224-234-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2004-247-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1788-251-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4724-261-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/8-274-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2776-275-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/228-279-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2532-286-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3964-293-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1892-303-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4116-307-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5032-309-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1452-312-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3664-319-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3652-323-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/2544-331-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/796-355-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/5016-387-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4748-411-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4804-422-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1072-434-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1960-438-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3696-442-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4512-446-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4680-450-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/3048-460-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/4796-494-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/1364-498-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral2/memory/704-535-0x0000000000400000-0x000000000042D000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4504 wrote to memory of 4564 4504 50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe 82 PID 4504 wrote to memory of 4564 4504 50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe 82 PID 4504 wrote to memory of 4564 4504 50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe 82 PID 4564 wrote to memory of 3148 4564 jdvvv.exe 83 PID 4564 wrote to memory of 3148 4564 jdvvv.exe 83 PID 4564 wrote to memory of 3148 4564 jdvvv.exe 83 PID 3148 wrote to memory of 704 3148 rrrlxxr.exe 84 PID 3148 wrote to memory of 704 3148 rrrlxxr.exe 84 PID 3148 wrote to memory of 704 3148 rrrlxxr.exe 84 PID 704 wrote to memory of 604 704 bbnnnb.exe 85 PID 704 wrote to memory of 604 704 bbnnnb.exe 85 PID 704 wrote to memory of 604 704 bbnnnb.exe 85 PID 604 wrote to memory of 2128 604 nbhbtn.exe 86 PID 604 wrote to memory of 2128 604 nbhbtn.exe 86 PID 604 wrote to memory of 2128 604 nbhbtn.exe 86 PID 2128 wrote to memory of 4328 2128 xlxlfxl.exe 87 PID 2128 wrote to memory of 4328 2128 xlxlfxl.exe 87 PID 2128 wrote to memory of 4328 2128 xlxlfxl.exe 87 PID 4328 wrote to memory of 4704 4328 nhtbhh.exe 88 PID 4328 wrote to memory of 4704 4328 nhtbhh.exe 88 PID 4328 wrote to memory of 4704 4328 nhtbhh.exe 88 PID 4704 wrote to memory of 5056 4704 hnhnnt.exe 89 PID 4704 wrote to memory of 5056 4704 hnhnnt.exe 89 PID 4704 wrote to memory of 5056 4704 hnhnnt.exe 89 PID 5056 wrote to memory of 3096 5056 lxlflll.exe 90 PID 5056 wrote to memory of 3096 5056 lxlflll.exe 90 PID 5056 wrote to memory of 3096 5056 lxlflll.exe 90 PID 3096 wrote to memory of 4856 3096 bttnhh.exe 91 PID 3096 wrote to memory of 4856 3096 bttnhh.exe 91 PID 3096 wrote to memory of 4856 3096 bttnhh.exe 91 PID 4856 wrote to memory of 1800 4856 1bhbtt.exe 92 PID 4856 wrote to memory of 1800 4856 1bhbtt.exe 92 PID 4856 wrote to memory of 1800 4856 1bhbtt.exe 92 PID 1800 wrote to memory of 3888 1800 jvdvp.exe 93 PID 1800 wrote to memory of 3888 1800 jvdvp.exe 93 PID 1800 wrote to memory of 3888 1800 jvdvp.exe 93 PID 3888 wrote to memory of 3896 3888 5hnnhn.exe 94 PID 3888 wrote to memory of 3896 3888 5hnnhn.exe 94 PID 3888 wrote to memory of 3896 3888 5hnnhn.exe 94 PID 3896 wrote to memory of 2248 3896 hhhbtt.exe 96 PID 3896 wrote to memory of 2248 3896 hhhbtt.exe 96 PID 3896 wrote to memory of 2248 3896 hhhbtt.exe 96 PID 2248 wrote to memory of 2084 2248 xrlrrlr.exe 97 PID 2248 wrote to memory of 2084 2248 xrlrrlr.exe 97 PID 2248 wrote to memory of 2084 2248 xrlrrlr.exe 97 PID 2084 wrote to memory of 1296 2084 3ntbtn.exe 98 PID 2084 wrote to memory of 1296 2084 3ntbtn.exe 98 PID 2084 wrote to memory of 1296 2084 3ntbtn.exe 98 PID 1296 wrote to memory of 3220 1296 jjjdd.exe 99 PID 1296 wrote to memory of 3220 1296 jjjdd.exe 99 PID 1296 wrote to memory of 3220 1296 jjjdd.exe 99 PID 3220 wrote to memory of 1520 3220 jvddv.exe 100 PID 3220 wrote to memory of 1520 3220 jvddv.exe 100 PID 3220 wrote to memory of 1520 3220 jvddv.exe 100 PID 1520 wrote to memory of 4080 1520 lfxrrrf.exe 102 PID 1520 wrote to memory of 4080 1520 lfxrrrf.exe 102 PID 1520 wrote to memory of 4080 1520 lfxrrrf.exe 102 PID 4080 wrote to memory of 4484 4080 tthbtt.exe 103 PID 4080 wrote to memory of 4484 4080 tthbtt.exe 103 PID 4080 wrote to memory of 4484 4080 tthbtt.exe 103 PID 4484 wrote to memory of 1524 4484 vpjdv.exe 104 PID 4484 wrote to memory of 1524 4484 vpjdv.exe 104 PID 4484 wrote to memory of 1524 4484 vpjdv.exe 104 PID 1524 wrote to memory of 2132 1524 3vjdj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\50e6488eaab42f40a83807c1db43eec0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\jdvvv.exec:\jdvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\bbnnnb.exec:\bbnnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\nbhbtn.exec:\nbhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\xlxlfxl.exec:\xlxlfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nhtbhh.exec:\nhtbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\hnhnnt.exec:\hnhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\lxlflll.exec:\lxlflll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bttnhh.exec:\bttnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\1bhbtt.exec:\1bhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\jvdvp.exec:\jvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\5hnnhn.exec:\5hnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\hhhbtt.exec:\hhhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\xrlrrlr.exec:\xrlrrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\3ntbtn.exec:\3ntbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jjjdd.exec:\jjjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jvddv.exec:\jvddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\lfxrrrf.exec:\lfxrrrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\tthbtt.exec:\tthbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\vpjdv.exec:\vpjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\3vjdj.exec:\3vjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\httnht.exec:\httnht.exe23⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpddp.exec:\vpddp.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3fffxrl.exec:\3fffxrl.exe25⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ttbbbh.exec:\ttbbbh.exe26⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ppjdp.exec:\ppjdp.exe27⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5flfrrr.exec:\5flfrrr.exe28⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7htntn.exec:\7htntn.exe29⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jdvvp.exec:\jdvvp.exe30⤵
- Executes dropped EXE
PID:1428 -
\??\c:\dvvpj.exec:\dvvpj.exe31⤵
- Executes dropped EXE
PID:796 -
\??\c:\nhhbbb.exec:\nhhbbb.exe32⤵
- Executes dropped EXE
PID:3588 -
\??\c:\tntnbb.exec:\tntnbb.exe33⤵
- Executes dropped EXE
PID:3352 -
\??\c:\vppdp.exec:\vppdp.exe34⤵
- Executes dropped EXE
PID:5088 -
\??\c:\7lrrrxr.exec:\7lrrrxr.exe35⤵
- Executes dropped EXE
PID:2516 -
\??\c:\lrxrlff.exec:\lrxrlff.exe36⤵
- Executes dropped EXE
PID:548 -
\??\c:\hhtbtn.exec:\hhtbtn.exe37⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pvvvv.exec:\pvvvv.exe38⤵
- Executes dropped EXE
PID:2192 -
\??\c:\frxrrxx.exec:\frxrrxx.exe39⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nhttnn.exec:\nhttnn.exe40⤵
- Executes dropped EXE
PID:3468 -
\??\c:\nbnnnn.exec:\nbnnnn.exe41⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7lfxfrl.exec:\7lfxfrl.exe42⤵
- Executes dropped EXE
PID:3444 -
\??\c:\9rxrllf.exec:\9rxrllf.exe43⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tbnhbb.exec:\tbnhbb.exe44⤵
- Executes dropped EXE
PID:3416 -
\??\c:\vvvpv.exec:\vvvpv.exe45⤵
- Executes dropped EXE
PID:3448 -
\??\c:\dppjp.exec:\dppjp.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\9frlfll.exec:\9frlfll.exe47⤵
- Executes dropped EXE
PID:3432 -
\??\c:\nnhhhh.exec:\nnhhhh.exe48⤵
- Executes dropped EXE
PID:4456 -
\??\c:\pppjd.exec:\pppjd.exe49⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddpjp.exec:\ddpjp.exe50⤵
- Executes dropped EXE
PID:4964 -
\??\c:\rflfrll.exec:\rflfrll.exe51⤵
- Executes dropped EXE
PID:1788 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe52⤵
- Executes dropped EXE
PID:2240 -
\??\c:\nnbbtn.exec:\nnbbtn.exe53⤵
- Executes dropped EXE
PID:4724 -
\??\c:\jvddv.exec:\jvddv.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frfrlrl.exec:\frfrlrl.exe55⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nnbttt.exec:\nnbttt.exe56⤵
- Executes dropped EXE
PID:4752 -
\??\c:\3vdvd.exec:\3vdvd.exe57⤵
- Executes dropped EXE
PID:8 -
\??\c:\pvjvd.exec:\pvjvd.exe58⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe60⤵
- Executes dropped EXE
PID:3860 -
\??\c:\1nnbbt.exec:\1nnbbt.exe61⤵
- Executes dropped EXE
PID:2532 -
\??\c:\djjdd.exec:\djjdd.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\xrrrlll.exec:\xrrrlll.exe63⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1rfxrrr.exec:\1rfxrrr.exe64⤵
- Executes dropped EXE
PID:4220 -
\??\c:\thhbtn.exec:\thhbtn.exe65⤵
- Executes dropped EXE
PID:1892 -
\??\c:\jddjj.exec:\jddjj.exe66⤵PID:4116
-
\??\c:\7lxxrxx.exec:\7lxxrxx.exe67⤵PID:5032
-
\??\c:\xxlllff.exec:\xxlllff.exe68⤵PID:1452
-
\??\c:\bnnhbb.exec:\bnnhbb.exe69⤵PID:3664
-
\??\c:\jvvvj.exec:\jvvvj.exe70⤵PID:1676
-
\??\c:\pppjv.exec:\pppjv.exe71⤵PID:3652
-
\??\c:\lxfffff.exec:\lxfffff.exe72⤵PID:4272
-
\??\c:\xlrllrf.exec:\xlrllrf.exe73⤵PID:2544
-
\??\c:\bntnnn.exec:\bntnnn.exe74⤵PID:2692
-
\??\c:\pjppj.exec:\pjppj.exe75⤵PID:3488
-
\??\c:\xlfxfxr.exec:\xlfxfxr.exe76⤵PID:3512
-
\??\c:\rflfxxx.exec:\rflfxxx.exe77⤵PID:1400
-
\??\c:\bntbtt.exec:\bntbtt.exe78⤵PID:2820
-
\??\c:\dppjd.exec:\dppjd.exe79⤵PID:3936
-
\??\c:\jdjdv.exec:\jdjdv.exe80⤵PID:796
-
\??\c:\frrlflf.exec:\frrlflf.exe81⤵PID:3588
-
\??\c:\1hnbbb.exec:\1hnbbb.exe82⤵PID:2388
-
\??\c:\vvpjd.exec:\vvpjd.exe83⤵PID:3684
-
\??\c:\pvpdd.exec:\pvpdd.exe84⤵PID:2204
-
\??\c:\xrlxrfl.exec:\xrlxrfl.exe85⤵PID:4360
-
\??\c:\xfllfff.exec:\xfllfff.exe86⤵PID:4444
-
\??\c:\nhhbhh.exec:\nhhbhh.exe87⤵PID:4452
-
\??\c:\dpjjd.exec:\dpjjd.exe88⤵PID:3848
-
\??\c:\vvvpj.exec:\vvvpj.exe89⤵PID:4660
-
\??\c:\3xfrlll.exec:\3xfrlll.exe90⤵PID:3148
-
\??\c:\hhtnhh.exec:\hhtnhh.exe91⤵PID:5016
-
\??\c:\hbhtnn.exec:\hbhtnn.exe92⤵PID:3452
-
\??\c:\dvddp.exec:\dvddp.exe93⤵PID:4700
-
\??\c:\jjjvp.exec:\jjjvp.exe94⤵PID:3864
-
\??\c:\9flfxxr.exec:\9flfxxr.exe95⤵PID:1764
-
\??\c:\hhnnbb.exec:\hhnnbb.exe96⤵PID:4328
-
\??\c:\5hbttt.exec:\5hbttt.exe97⤵PID:2252
-
\??\c:\vdvpd.exec:\vdvpd.exe98⤵PID:4748
-
\??\c:\3llfxxx.exec:\3llfxxx.exe99⤵PID:1176
-
\??\c:\3tnhbb.exec:\3tnhbb.exe100⤵PID:528
-
\??\c:\htbbnn.exec:\htbbnn.exe101⤵PID:1216
-
\??\c:\vpvpp.exec:\vpvpp.exe102⤵PID:4804
-
\??\c:\llrrxfr.exec:\llrrxfr.exe103⤵PID:2164
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe104⤵PID:2956
-
\??\c:\3hnhhh.exec:\3hnhhh.exe105⤵PID:1072
-
\??\c:\pvjpj.exec:\pvjpj.exe106⤵PID:1960
-
\??\c:\lffxllf.exec:\lffxllf.exe107⤵PID:3696
-
\??\c:\bthbth.exec:\bthbth.exe108⤵PID:3296
-
\??\c:\vdvvv.exec:\vdvvv.exe109⤵PID:4512
-
\??\c:\dvvpd.exec:\dvvpd.exe110⤵PID:4680
-
\??\c:\xfllfrr.exec:\xfllfrr.exe111⤵PID:3964
-
\??\c:\lrrrflx.exec:\lrrrflx.exe112⤵PID:3048
-
\??\c:\htnbth.exec:\htnbth.exe113⤵PID:2424
-
\??\c:\9vjdd.exec:\9vjdd.exe114⤵PID:1892
-
\??\c:\vjpjj.exec:\vjpjj.exe115⤵PID:4116
-
\??\c:\lllfxxr.exec:\lllfxxr.exe116⤵PID:5032
-
\??\c:\9bnhtn.exec:\9bnhtn.exe117⤵PID:4556
-
\??\c:\dvvdd.exec:\dvvdd.exe118⤵PID:2072
-
\??\c:\vppjv.exec:\vppjv.exe119⤵PID:576
-
\??\c:\xxrrlxx.exec:\xxrrlxx.exe120⤵PID:1208
-
\??\c:\thhbtn.exec:\thhbtn.exe121⤵PID:840
-
\??\c:\5bnhbb.exec:\5bnhbb.exe122⤵PID:3628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-