Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 21:12
Behavioral task
behavioral1
Sample
5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe
-
Size
463KB
-
MD5
5d549d505d11b326710642081ff4f580
-
SHA1
886a3dac091fb65f5b1272d152b8819e3be9e9f7
-
SHA256
0f9b0d94bbe2067271978c67b5378542a5e91b5d91bcd2ece536f0ab11a439a9
-
SHA512
f39b8b0b0978c221aa92400c10c88d2a78695e1523d45aba5f8a2e74dcc072edf8f63089d482439e4d14dcc5e7cd96dd14f9b7da39e4962cb105020882ee3ffd
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vf:VeR0oykayRFp3lztP+OKaf1Vf
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2564-20-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2264-16-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2704-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2580-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2480-56-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2676-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2192-90-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2644-108-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/356-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3020-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/664-203-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2228-185-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2768-176-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2024-167-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2360-126-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1456-116-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2684-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1792-244-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2288-268-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1968-293-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1660-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2752-320-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2324-322-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2692-346-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2492-348-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2636-360-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2280-362-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2424-423-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1912-583-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1244-671-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3052-906-0x00000000001B0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2820-972-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000c00000001226d-7.dat family_berbew behavioral1/memory/2264-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2564-20-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0034000000015b63-18.dat family_berbew behavioral1/memory/2264-16-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2704-29-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0008000000015cb7-27.dat family_berbew behavioral1/files/0x0007000000015cd6-36.dat family_berbew behavioral1/memory/2580-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000015ce2-44.dat family_berbew behavioral1/files/0x0007000000015cea-54.dat family_berbew behavioral1/memory/2480-56-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0009000000015cf3-63.dat family_berbew behavioral1/memory/2676-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00080000000162cc-73.dat family_berbew behavioral1/files/0x00060000000165d4-81.dat family_berbew behavioral1/memory/2192-90-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016824-89.dat family_berbew behavioral1/files/0x0006000000016a7d-97.dat family_berbew behavioral1/files/0x0006000000016c4a-106.dat family_berbew behavioral1/memory/2644-108-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016c5d-114.dat family_berbew behavioral1/files/0x0006000000016c67-123.dat family_berbew behavioral1/files/0x0006000000016cde-140.dat family_berbew behavioral1/memory/356-142-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d05-149.dat family_berbew behavioral1/files/0x0006000000016d1a-158.dat family_berbew behavioral1/files/0x0006000000016d2b-175.dat family_berbew behavioral1/files/0x0006000000016d3b-193.dat family_berbew behavioral1/files/0x0006000000016d44-201.dat family_berbew behavioral1/files/0x0034000000015bc7-210.dat family_berbew behavioral1/memory/3020-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d4c-218.dat family_berbew behavioral1/files/0x0006000000016d55-227.dat family_berbew behavioral1/files/0x0006000000016d68-235.dat family_berbew behavioral1/memory/664-203-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2228-185-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d33-184.dat family_berbew behavioral1/memory/2768-176-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2024-167-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d22-166.dat family_berbew behavioral1/files/0x0006000000016caf-133.dat family_berbew behavioral1/memory/2360-126-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1456-116-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2480-58-0x0000000000440000-0x000000000047A000-memory.dmp family_berbew behavioral1/memory/2684-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1792-244-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d6c-243.dat family_berbew behavioral1/files/0x0006000000016d70-251.dat family_berbew behavioral1/files/0x0006000000016da0-269.dat family_berbew behavioral1/memory/1632-270-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2288-268-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2288-261-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000016d78-260.dat family_berbew behavioral1/files/0x0006000000016db2-279.dat family_berbew behavioral1/memory/1968-293-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1660-292-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1908-300-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2268-307-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2752-320-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2324-322-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2692-346-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2492-348-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2264 pjdjv.exe 2564 fxlxflx.exe 2704 jjpjd.exe 2580 fxxflrf.exe 2684 hbnntt.exe 2480 ppjpd.exe 2676 xfxxfrf.exe 2532 bnntbn.exe 2092 ddvdj.exe 2192 3xxfxxr.exe 1276 bbbhnt.exe 2644 1vvpj.exe 1456 xrxxfxl.exe 2360 tbntnn.exe 1612 pjvvj.exe 356 rlfflrf.exe 1900 5htntb.exe 2040 jppvd.exe 2024 xrfrxlr.exe 2768 3tttbb.exe 2228 vpvjp.exe 2052 9rffffl.exe 664 nbhbbh.exe 3020 dpdjj.exe 2412 7hbhnt.exe 2088 5vdjv.exe 624 5bhhnt.exe 1792 7pvdd.exe 1688 9dpvd.exe 2288 bnbbtt.exe 1632 7vpvv.exe 1160 djvpp.exe 1660 fxrfllr.exe 1968 9pvpp.exe 1908 dvppd.exe 2268 nnnhtt.exe 2752 dvjjp.exe 2324 5lxxffr.exe 2716 hhhhtb.exe 2464 vpjpd.exe 2692 xxxflxl.exe 2492 7nbbnn.exe 2636 vvvjv.exe 2280 rxxlffr.exe 2916 nhbnbh.exe 2092 fxrxffx.exe 1716 fxxflrf.exe 2484 hnbnhh.exe 1276 dvpdd.exe 2728 rllfllx.exe 1576 lfrrfll.exe 2136 nhhtbh.exe 2424 pdvvp.exe 1612 xrflrrr.exe 1584 llffllx.exe 2444 htnnnn.exe 1588 ppjdj.exe 1088 dvjvv.exe 2024 xrrrffr.exe 3028 9btttb.exe 2768 3hbntb.exe 396 9jdjp.exe 2396 lfrrxfr.exe 484 xfxlflr.exe -
resource yara_rule behavioral1/memory/1976-1-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000c00000001226d-7.dat upx behavioral1/memory/2264-8-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2564-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0034000000015b63-18.dat upx behavioral1/memory/2264-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2704-29-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0008000000015cb7-27.dat upx behavioral1/files/0x0007000000015cd6-36.dat upx behavioral1/memory/2580-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000015ce2-44.dat upx behavioral1/files/0x0007000000015cea-54.dat upx behavioral1/memory/2480-56-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000015cf3-63.dat upx behavioral1/memory/2676-66-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00080000000162cc-73.dat upx behavioral1/files/0x00060000000165d4-81.dat upx behavioral1/memory/2192-90-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016824-89.dat upx behavioral1/files/0x0006000000016a7d-97.dat upx behavioral1/files/0x0006000000016c4a-106.dat upx behavioral1/memory/2644-108-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016c5d-114.dat upx behavioral1/files/0x0006000000016c67-123.dat upx behavioral1/files/0x0006000000016cde-140.dat upx behavioral1/memory/356-142-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d05-149.dat upx behavioral1/files/0x0006000000016d1a-158.dat upx behavioral1/files/0x0006000000016d2b-175.dat upx behavioral1/files/0x0006000000016d3b-193.dat upx behavioral1/files/0x0006000000016d44-201.dat upx behavioral1/files/0x0034000000015bc7-210.dat upx behavioral1/memory/3020-212-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d4c-218.dat upx behavioral1/files/0x0006000000016d55-227.dat upx behavioral1/files/0x0006000000016d68-235.dat upx behavioral1/memory/664-203-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2228-185-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d33-184.dat upx behavioral1/memory/2768-176-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2024-167-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d22-166.dat upx behavioral1/files/0x0006000000016caf-133.dat upx behavioral1/memory/2360-126-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1456-116-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2480-58-0x0000000000440000-0x000000000047A000-memory.dmp upx behavioral1/memory/2684-47-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1792-244-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d6c-243.dat upx behavioral1/files/0x0006000000016d70-251.dat upx behavioral1/files/0x0006000000016da0-269.dat upx behavioral1/memory/1632-270-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2288-268-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2288-261-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000016d78-260.dat upx behavioral1/files/0x0006000000016db2-279.dat upx behavioral1/memory/1968-293-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1660-292-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1908-300-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2268-307-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2752-320-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2324-322-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2692-346-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2492-348-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1976 wrote to memory of 2264 1976 5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2264 1976 5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2264 1976 5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe 28 PID 1976 wrote to memory of 2264 1976 5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe 28 PID 2264 wrote to memory of 2564 2264 pjdjv.exe 29 PID 2264 wrote to memory of 2564 2264 pjdjv.exe 29 PID 2264 wrote to memory of 2564 2264 pjdjv.exe 29 PID 2264 wrote to memory of 2564 2264 pjdjv.exe 29 PID 2564 wrote to memory of 2704 2564 fxlxflx.exe 30 PID 2564 wrote to memory of 2704 2564 fxlxflx.exe 30 PID 2564 wrote to memory of 2704 2564 fxlxflx.exe 30 PID 2564 wrote to memory of 2704 2564 fxlxflx.exe 30 PID 2704 wrote to memory of 2580 2704 jjpjd.exe 31 PID 2704 wrote to memory of 2580 2704 jjpjd.exe 31 PID 2704 wrote to memory of 2580 2704 jjpjd.exe 31 PID 2704 wrote to memory of 2580 2704 jjpjd.exe 31 PID 2580 wrote to memory of 2684 2580 fxxflrf.exe 32 PID 2580 wrote to memory of 2684 2580 fxxflrf.exe 32 PID 2580 wrote to memory of 2684 2580 fxxflrf.exe 32 PID 2580 wrote to memory of 2684 2580 fxxflrf.exe 32 PID 2684 wrote to memory of 2480 2684 hbnntt.exe 33 PID 2684 wrote to memory of 2480 2684 hbnntt.exe 33 PID 2684 wrote to memory of 2480 2684 hbnntt.exe 33 PID 2684 wrote to memory of 2480 2684 hbnntt.exe 33 PID 2480 wrote to memory of 2676 2480 ppjpd.exe 34 PID 2480 wrote to memory of 2676 2480 ppjpd.exe 34 PID 2480 wrote to memory of 2676 2480 ppjpd.exe 34 PID 2480 wrote to memory of 2676 2480 ppjpd.exe 34 PID 2676 wrote to memory of 2532 2676 xfxxfrf.exe 35 PID 2676 wrote to memory of 2532 2676 xfxxfrf.exe 35 PID 2676 wrote to memory of 2532 2676 xfxxfrf.exe 35 PID 2676 wrote to memory of 2532 2676 xfxxfrf.exe 35 PID 2532 wrote to memory of 2092 2532 bnntbn.exe 36 PID 2532 wrote to memory of 2092 2532 bnntbn.exe 36 PID 2532 wrote to memory of 2092 2532 bnntbn.exe 36 PID 2532 wrote to memory of 2092 2532 bnntbn.exe 36 PID 2092 wrote to memory of 2192 2092 ddvdj.exe 37 PID 2092 wrote to memory of 2192 2092 ddvdj.exe 37 PID 2092 wrote to memory of 2192 2092 ddvdj.exe 37 PID 2092 wrote to memory of 2192 2092 ddvdj.exe 37 PID 2192 wrote to memory of 1276 2192 3xxfxxr.exe 38 PID 2192 wrote to memory of 1276 2192 3xxfxxr.exe 38 PID 2192 wrote to memory of 1276 2192 3xxfxxr.exe 38 PID 2192 wrote to memory of 1276 2192 3xxfxxr.exe 38 PID 1276 wrote to memory of 2644 1276 bbbhnt.exe 39 PID 1276 wrote to memory of 2644 1276 bbbhnt.exe 39 PID 1276 wrote to memory of 2644 1276 bbbhnt.exe 39 PID 1276 wrote to memory of 2644 1276 bbbhnt.exe 39 PID 2644 wrote to memory of 1456 2644 1vvpj.exe 40 PID 2644 wrote to memory of 1456 2644 1vvpj.exe 40 PID 2644 wrote to memory of 1456 2644 1vvpj.exe 40 PID 2644 wrote to memory of 1456 2644 1vvpj.exe 40 PID 1456 wrote to memory of 2360 1456 xrxxfxl.exe 41 PID 1456 wrote to memory of 2360 1456 xrxxfxl.exe 41 PID 1456 wrote to memory of 2360 1456 xrxxfxl.exe 41 PID 1456 wrote to memory of 2360 1456 xrxxfxl.exe 41 PID 2360 wrote to memory of 1612 2360 tbntnn.exe 42 PID 2360 wrote to memory of 1612 2360 tbntnn.exe 42 PID 2360 wrote to memory of 1612 2360 tbntnn.exe 42 PID 2360 wrote to memory of 1612 2360 tbntnn.exe 42 PID 1612 wrote to memory of 356 1612 pjvvj.exe 43 PID 1612 wrote to memory of 356 1612 pjvvj.exe 43 PID 1612 wrote to memory of 356 1612 pjvvj.exe 43 PID 1612 wrote to memory of 356 1612 pjvvj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d549d505d11b326710642081ff4f580_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\pjdjv.exec:\pjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\fxlxflx.exec:\fxlxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jjpjd.exec:\jjpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\fxxflrf.exec:\fxxflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hbnntt.exec:\hbnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\ppjpd.exec:\ppjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xfxxfrf.exec:\xfxxfrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bnntbn.exec:\bnntbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ddvdj.exec:\ddvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\3xxfxxr.exec:\3xxfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bbbhnt.exec:\bbbhnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\1vvpj.exec:\1vvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\xrxxfxl.exec:\xrxxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\tbntnn.exec:\tbntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\pjvvj.exec:\pjvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rlfflrf.exec:\rlfflrf.exe17⤵
- Executes dropped EXE
PID:356 -
\??\c:\5htntb.exec:\5htntb.exe18⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jppvd.exec:\jppvd.exe19⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xrfrxlr.exec:\xrfrxlr.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\3tttbb.exec:\3tttbb.exe21⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpvjp.exec:\vpvjp.exe22⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9rffffl.exec:\9rffffl.exe23⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nbhbbh.exec:\nbhbbh.exe24⤵
- Executes dropped EXE
PID:664 -
\??\c:\dpdjj.exec:\dpdjj.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7hbhnt.exec:\7hbhnt.exe26⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5vdjv.exec:\5vdjv.exe27⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5bhhnt.exec:\5bhhnt.exe28⤵
- Executes dropped EXE
PID:624 -
\??\c:\7pvdd.exec:\7pvdd.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9dpvd.exec:\9dpvd.exe30⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bnbbtt.exec:\bnbbtt.exe31⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7vpvv.exec:\7vpvv.exe32⤵
- Executes dropped EXE
PID:1632 -
\??\c:\djvpp.exec:\djvpp.exe33⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxrfllr.exec:\fxrfllr.exe34⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9pvpp.exec:\9pvpp.exe35⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dvppd.exec:\dvppd.exe36⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nnnhtt.exec:\nnnhtt.exe37⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvjjp.exec:\dvjjp.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5lxxffr.exec:\5lxxffr.exe39⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hhhhtb.exec:\hhhhtb.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vpjpd.exec:\vpjpd.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xxxflxl.exec:\xxxflxl.exe42⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7nbbnn.exec:\7nbbnn.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vvvjv.exec:\vvvjv.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rxxlffr.exec:\rxxlffr.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhbnbh.exec:\nhbnbh.exe46⤵
- Executes dropped EXE
PID:2916 -
\??\c:\fxrxffx.exec:\fxrxffx.exe47⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fxxflrf.exec:\fxxflrf.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hnbnhh.exec:\hnbnhh.exe49⤵
- Executes dropped EXE
PID:2484 -
\??\c:\dvpdd.exec:\dvpdd.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rllfllx.exec:\rllfllx.exe51⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lfrrfll.exec:\lfrrfll.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\nhhtbh.exec:\nhhtbh.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pdvvp.exec:\pdvvp.exe54⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xrflrrr.exec:\xrflrrr.exe55⤵
- Executes dropped EXE
PID:1612 -
\??\c:\llffllx.exec:\llffllx.exe56⤵
- Executes dropped EXE
PID:1584 -
\??\c:\htnnnn.exec:\htnnnn.exe57⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ppjdj.exec:\ppjdj.exe58⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvjvv.exec:\dvjvv.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrrrffr.exec:\xrrrffr.exe60⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9btttb.exec:\9btttb.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\3hbntb.exec:\3hbntb.exe62⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9jdjp.exec:\9jdjp.exe63⤵
- Executes dropped EXE
PID:396 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe64⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xfxlflr.exec:\xfxlflr.exe65⤵
- Executes dropped EXE
PID:484 -
\??\c:\1hbhtb.exec:\1hbhtb.exe66⤵PID:2808
-
\??\c:\1jdpp.exec:\1jdpp.exe67⤵PID:408
-
\??\c:\vppvj.exec:\vppvj.exe68⤵PID:2976
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe69⤵PID:320
-
\??\c:\3nbbbh.exec:\3nbbbh.exe70⤵PID:2180
-
\??\c:\9nbtbb.exec:\9nbtbb.exe71⤵PID:444
-
\??\c:\vjppv.exec:\vjppv.exe72⤵PID:1300
-
\??\c:\xrxxffl.exec:\xrxxffl.exe73⤵PID:624
-
\??\c:\9frrrxf.exec:\9frrrxf.exe74⤵PID:1228
-
\??\c:\hbtbhn.exec:\hbtbhn.exe75⤵PID:1684
-
\??\c:\vpvvd.exec:\vpvvd.exe76⤵PID:2436
-
\??\c:\ddvjv.exec:\ddvjv.exe77⤵PID:2208
-
\??\c:\lfxxlll.exec:\lfxxlll.exe78⤵PID:1884
-
\??\c:\1bbbbn.exec:\1bbbbn.exe79⤵PID:1112
-
\??\c:\jjdjv.exec:\jjdjv.exe80⤵PID:1912
-
\??\c:\jvdvv.exec:\jvdvv.exe81⤵PID:2404
-
\??\c:\rlffrxl.exec:\rlffrxl.exe82⤵PID:2008
-
\??\c:\hbnntt.exec:\hbnntt.exe83⤵PID:1640
-
\??\c:\tnbhtb.exec:\tnbhtb.exe84⤵PID:2984
-
\??\c:\jdjvp.exec:\jdjvp.exe85⤵PID:2752
-
\??\c:\3xxfxfl.exec:\3xxfxfl.exe86⤵PID:2564
-
\??\c:\lffllll.exec:\lffllll.exe87⤵PID:2708
-
\??\c:\nhtbhn.exec:\nhtbhn.exe88⤵PID:2464
-
\??\c:\pdjdd.exec:\pdjdd.exe89⤵PID:2692
-
\??\c:\xrfrrxf.exec:\xrfrrxf.exe90⤵PID:2620
-
\??\c:\hbtbhh.exec:\hbtbhh.exe91⤵PID:2472
-
\??\c:\7bttbb.exec:\7bttbb.exe92⤵PID:2280
-
\??\c:\dvvvd.exec:\dvvvd.exe93⤵PID:2232
-
\??\c:\xrffrlr.exec:\xrffrlr.exe94⤵PID:1736
-
\??\c:\fxfllrf.exec:\fxfllrf.exe95⤵PID:1244
-
\??\c:\hthttt.exec:\hthttt.exe96⤵PID:2820
-
\??\c:\dpjpv.exec:\dpjpv.exe97⤵PID:1276
-
\??\c:\vpjvd.exec:\vpjvd.exe98⤵PID:2356
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe99⤵PID:2504
-
\??\c:\htnthn.exec:\htnthn.exe100⤵PID:860
-
\??\c:\tbthnt.exec:\tbthnt.exe101⤵PID:2760
-
\??\c:\dpddd.exec:\dpddd.exe102⤵PID:1476
-
\??\c:\rlflrxf.exec:\rlflrxf.exe103⤵PID:2524
-
\??\c:\5tbhtb.exec:\5tbhtb.exe104⤵PID:1664
-
\??\c:\7bhtbh.exec:\7bhtbh.exe105⤵PID:1220
-
\??\c:\1pddj.exec:\1pddj.exe106⤵PID:2788
-
\??\c:\lrfxllr.exec:\lrfxllr.exe107⤵PID:2824
-
\??\c:\7rlfrlr.exec:\7rlfrlr.exe108⤵PID:2496
-
\??\c:\thnntt.exec:\thnntt.exe109⤵PID:2544
-
\??\c:\thtbhh.exec:\thtbhh.exe110⤵PID:2632
-
\??\c:\9vjjp.exec:\9vjjp.exe111⤵PID:528
-
\??\c:\fffxlrf.exec:\fffxlrf.exe112⤵PID:768
-
\??\c:\hthtbh.exec:\hthtbh.exe113⤵PID:1032
-
\??\c:\1httbt.exec:\1httbt.exe114⤵PID:2216
-
\??\c:\ddpvv.exec:\ddpvv.exe115⤵PID:1420
-
\??\c:\1fxlrrf.exec:\1fxlrrf.exe116⤵PID:2088
-
\??\c:\rxlrxlr.exec:\rxlrxlr.exe117⤵PID:1496
-
\??\c:\3nhhnn.exec:\3nhhnn.exe118⤵PID:1700
-
\??\c:\jvjpv.exec:\jvjpv.exe119⤵PID:1656
-
\??\c:\vpppd.exec:\vpppd.exe120⤵PID:1628
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe121⤵PID:2272
-
\??\c:\5hnbhn.exec:\5hnbhn.exe122⤵PID:2284
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-