Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 12:43
Behavioral task
behavioral1
Sample
b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe
-
Size
470KB
-
MD5
b84ec787916e123f663eae0afe12c800
-
SHA1
4ec60e3bad65ff3e3fee66a6efb00261db82659b
-
SHA256
928fde4de0f361c8da6f8e179529e47d107d8ff8a375dcda78865b20cdadabd1
-
SHA512
60b46d453e975708c38cc9539f395e070c428004afdd4926b26cdb19b9283fc0947e14f36a8e95bbb4bd961f87fb36a7524161defa23592a7e327184720e0229
-
SSDEEP
12288:57Tc1WjdpKGATTk/6Aihgth7L/QOKs+Q/RIVBjdB/22LX1W:TZpTATrAihgth7L/QOKs+Q/RIVBjdB/0
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1560-0-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1824-20-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4024-38-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1944-73-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4112-103-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/996-126-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1612-137-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2472-153-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/652-171-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4996-224-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4744-229-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2144-240-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4792-244-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4520-248-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4340-256-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4748-262-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4852-275-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/640-332-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4692-347-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4596-400-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/804-405-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3060-431-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1536-435-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4848-442-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2936-462-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4280-467-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/224-517-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2012-533-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1492-556-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1512-575-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3676-654-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/380-668-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4424-755-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/952-560-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4852-537-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4696-506-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2084-505-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3760-449-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3660-416-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3440-377-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2704-360-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3256-339-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4320-327-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1784-249-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4996-228-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3220-223-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4676-215-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3572-209-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2728-198-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3076-188-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3988-166-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2116-160-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3672-143-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/756-120-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2900-105-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2012-96-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/3560-86-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4696-84-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2788-61-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/4744-57-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1340-55-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/5000-31-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/2828-25-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral2/memory/1972-12-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000800000002342a-3.dat family_berbew behavioral2/files/0x0007000000023432-14.dat family_berbew behavioral2/files/0x0007000000023433-26.dat family_berbew behavioral2/files/0x0007000000023434-32.dat family_berbew behavioral2/files/0x0007000000023436-43.dat family_berbew behavioral2/files/0x000700000002343a-67.dat family_berbew behavioral2/files/0x000700000002343c-78.dat family_berbew behavioral2/files/0x000700000002343e-90.dat family_berbew behavioral2/files/0x0007000000023440-101.dat family_berbew behavioral2/files/0x0007000000023442-114.dat family_berbew behavioral2/files/0x000800000002342e-118.dat family_berbew behavioral2/files/0x0007000000023444-129.dat family_berbew behavioral2/files/0x0007000000023445-134.dat family_berbew behavioral2/files/0x0007000000023448-154.dat family_berbew behavioral2/files/0x000700000002344b-170.dat family_berbew behavioral2/files/0x000700000002344c-176.dat family_berbew behavioral2/files/0x0003000000022986-182.dat family_berbew behavioral2/files/0x000700000002344d-186.dat family_berbew behavioral2/files/0x000700000002344a-165.dat family_berbew behavioral2/files/0x0007000000023449-159.dat family_berbew behavioral2/files/0x0007000000023447-148.dat family_berbew behavioral2/files/0x0007000000023446-141.dat family_berbew behavioral2/files/0x0007000000023443-125.dat family_berbew behavioral2/files/0x0007000000023441-108.dat family_berbew behavioral2/files/0x000700000002343f-95.dat family_berbew behavioral2/files/0x000700000002343d-82.dat family_berbew behavioral2/files/0x000700000002343b-72.dat family_berbew behavioral2/files/0x0007000000023439-60.dat family_berbew behavioral2/files/0x0007000000023438-53.dat family_berbew behavioral2/files/0x0007000000023437-48.dat family_berbew behavioral2/files/0x0007000000023435-37.dat family_berbew behavioral2/files/0x0007000000023431-11.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1972 rxfrxff.exe 1824 nhhbtn.exe 2828 dvvpj.exe 5000 5bnnth.exe 4024 lrfxrxr.exe 4920 tnnhnh.exe 3220 ddddv.exe 1340 frrxrrr.exe 4744 hhbtnn.exe 2788 pdvdj.exe 1944 9xlrlrl.exe 4792 9nhbtn.exe 4696 pvvpd.exe 3560 nnbbnh.exe 2012 vdjdv.exe 4112 flrfxfx.exe 2900 nhttbb.exe 4036 dvpdd.exe 4636 rflfxrl.exe 756 bttnhh.exe 996 dvvpd.exe 1612 fxrlrlx.exe 3672 hbbhbb.exe 3232 lfllffr.exe 2472 3hhbnh.exe 2116 5ddvj.exe 384 rlffrlf.exe 3988 bnhbnh.exe 652 7jjvp.exe 732 9flxlrx.exe 3304 rlxrxrf.exe 3076 jjvdp.exe 5008 rflfrrf.exe 4692 bbnhtn.exe 2728 pjpjv.exe 3648 rlrlfxr.exe 2396 tnhntn.exe 3572 9djjd.exe 4676 pddvj.exe 3324 xxxxrrl.exe 3220 jdpjd.exe 4996 rrxrrrr.exe 4744 5rrlffx.exe 2464 nhnntn.exe 2144 vpjvp.exe 4792 rffxrlf.exe 4520 nbbttt.exe 1784 vpjdv.exe 2636 7llfxfx.exe 4340 5tnhbb.exe 4748 7ppjj.exe 452 frfrlfx.exe 3528 5rrxrlf.exe 4884 tthbnn.exe 4852 djvpp.exe 1776 lrlxrrf.exe 392 bnnnhn.exe 996 hhbbnt.exe 4256 vvpdv.exe 2376 lxrlffr.exe 3032 bnttbb.exe 3180 dpjvj.exe 4480 lfrlllr.exe 1008 lxfxrrf.exe -
resource yara_rule behavioral2/memory/1560-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1824-20-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4024-38-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1340-49-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1944-73-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4112-97-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4112-103-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/996-126-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1612-137-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2472-153-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/652-171-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4996-224-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4744-229-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2144-240-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4520-245-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4792-244-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4520-248-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4340-256-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4748-262-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4852-275-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4452-317-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1732-328-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/640-332-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4692-347-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2356-361-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4596-400-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/804-405-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3060-431-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1536-435-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4848-442-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2936-462-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3256-468-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4280-467-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3000-483-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/224-517-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2012-533-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1492-556-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3236-561-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1972-565-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1512-575-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3352-619-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3676-654-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/380-668-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4808-699-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4424-755-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3468-777-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4036-594-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/952-560-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4852-537-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3320-510-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4696-506-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2084-505-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2672-479-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/5012-475-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4280-463-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3760-449-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3660-416-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/804-401-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3336-393-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3440-377-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/2704-360-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/1332-340-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/3256-339-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral2/memory/4320-327-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1560 wrote to memory of 1972 1560 b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe 85 PID 1560 wrote to memory of 1972 1560 b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe 85 PID 1560 wrote to memory of 1972 1560 b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe 85 PID 1972 wrote to memory of 1824 1972 rxfrxff.exe 86 PID 1972 wrote to memory of 1824 1972 rxfrxff.exe 86 PID 1972 wrote to memory of 1824 1972 rxfrxff.exe 86 PID 1824 wrote to memory of 2828 1824 nhhbtn.exe 87 PID 1824 wrote to memory of 2828 1824 nhhbtn.exe 87 PID 1824 wrote to memory of 2828 1824 nhhbtn.exe 87 PID 2828 wrote to memory of 5000 2828 dvvpj.exe 89 PID 2828 wrote to memory of 5000 2828 dvvpj.exe 89 PID 2828 wrote to memory of 5000 2828 dvvpj.exe 89 PID 5000 wrote to memory of 4024 5000 5bnnth.exe 91 PID 5000 wrote to memory of 4024 5000 5bnnth.exe 91 PID 5000 wrote to memory of 4024 5000 5bnnth.exe 91 PID 4024 wrote to memory of 4920 4024 lrfxrxr.exe 457 PID 4024 wrote to memory of 4920 4024 lrfxrxr.exe 457 PID 4024 wrote to memory of 4920 4024 lrfxrxr.exe 457 PID 4920 wrote to memory of 3220 4920 tnnhnh.exe 494 PID 4920 wrote to memory of 3220 4920 tnnhnh.exe 494 PID 4920 wrote to memory of 3220 4920 tnnhnh.exe 494 PID 3220 wrote to memory of 1340 3220 ddddv.exe 496 PID 3220 wrote to memory of 1340 3220 ddddv.exe 496 PID 3220 wrote to memory of 1340 3220 ddddv.exe 496 PID 1340 wrote to memory of 4744 1340 frrxrrr.exe 95 PID 1340 wrote to memory of 4744 1340 frrxrrr.exe 95 PID 1340 wrote to memory of 4744 1340 frrxrrr.exe 95 PID 4744 wrote to memory of 2788 4744 hhbtnn.exe 458 PID 4744 wrote to memory of 2788 4744 hhbtnn.exe 458 PID 4744 wrote to memory of 2788 4744 hhbtnn.exe 458 PID 2788 wrote to memory of 1944 2788 pdvdj.exe 312 PID 2788 wrote to memory of 1944 2788 pdvdj.exe 312 PID 2788 wrote to memory of 1944 2788 pdvdj.exe 312 PID 1944 wrote to memory of 4792 1944 9xlrlrl.exe 501 PID 1944 wrote to memory of 4792 1944 9xlrlrl.exe 501 PID 1944 wrote to memory of 4792 1944 9xlrlrl.exe 501 PID 4792 wrote to memory of 4696 4792 9nhbtn.exe 538 PID 4792 wrote to memory of 4696 4792 9nhbtn.exe 538 PID 4792 wrote to memory of 4696 4792 9nhbtn.exe 538 PID 4696 wrote to memory of 3560 4696 pvvpd.exe 102 PID 4696 wrote to memory of 3560 4696 pvvpd.exe 102 PID 4696 wrote to memory of 3560 4696 pvvpd.exe 102 PID 3560 wrote to memory of 2012 3560 nnbbnh.exe 223 PID 3560 wrote to memory of 2012 3560 nnbbnh.exe 223 PID 3560 wrote to memory of 2012 3560 nnbbnh.exe 223 PID 2012 wrote to memory of 4112 2012 vdjdv.exe 104 PID 2012 wrote to memory of 4112 2012 vdjdv.exe 104 PID 2012 wrote to memory of 4112 2012 vdjdv.exe 104 PID 4112 wrote to memory of 2900 4112 flrfxfx.exe 105 PID 4112 wrote to memory of 2900 4112 flrfxfx.exe 105 PID 4112 wrote to memory of 2900 4112 flrfxfx.exe 105 PID 2900 wrote to memory of 4036 2900 nhttbb.exe 106 PID 2900 wrote to memory of 4036 2900 nhttbb.exe 106 PID 2900 wrote to memory of 4036 2900 nhttbb.exe 106 PID 4036 wrote to memory of 4636 4036 dvpdd.exe 107 PID 4036 wrote to memory of 4636 4036 dvpdd.exe 107 PID 4036 wrote to memory of 4636 4036 dvpdd.exe 107 PID 4636 wrote to memory of 756 4636 rflfxrl.exe 108 PID 4636 wrote to memory of 756 4636 rflfxrl.exe 108 PID 4636 wrote to memory of 756 4636 rflfxrl.exe 108 PID 756 wrote to memory of 996 756 bttnhh.exe 109 PID 756 wrote to memory of 996 756 bttnhh.exe 109 PID 756 wrote to memory of 996 756 bttnhh.exe 109 PID 996 wrote to memory of 1612 996 dvvpd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b84ec787916e123f663eae0afe12c800_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rxfrxff.exec:\rxfrxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\nhhbtn.exec:\nhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\dvvpj.exec:\dvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5bnnth.exec:\5bnnth.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\lrfxrxr.exec:\lrfxrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\tnnhnh.exec:\tnnhnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\ddddv.exec:\ddddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\frrxrrr.exec:\frrxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\hhbtnn.exec:\hhbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\pdvdj.exec:\pdvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9xlrlrl.exec:\9xlrlrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\9nhbtn.exec:\9nhbtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\pvvpd.exec:\pvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\nnbbnh.exec:\nnbbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vdjdv.exec:\vdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\flrfxfx.exec:\flrfxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\nhttbb.exec:\nhttbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\dvpdd.exec:\dvpdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\rflfxrl.exec:\rflfxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\bttnhh.exec:\bttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\dvvpd.exec:\dvvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\fxrlrlx.exec:\fxrlrlx.exe23⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbbhbb.exec:\hbbhbb.exe24⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lfllffr.exec:\lfllffr.exe25⤵
- Executes dropped EXE
PID:3232 -
\??\c:\3hhbnh.exec:\3hhbnh.exe26⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5ddvj.exec:\5ddvj.exe27⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rlffrlf.exec:\rlffrlf.exe28⤵
- Executes dropped EXE
PID:384 -
\??\c:\bnhbnh.exec:\bnhbnh.exe29⤵
- Executes dropped EXE
PID:3988 -
\??\c:\7jjvp.exec:\7jjvp.exe30⤵
- Executes dropped EXE
PID:652 -
\??\c:\9flxlrx.exec:\9flxlrx.exe31⤵
- Executes dropped EXE
PID:732 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe32⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jjvdp.exec:\jjvdp.exe33⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rflfrrf.exec:\rflfrrf.exe34⤵
- Executes dropped EXE
PID:5008 -
\??\c:\bbnhtn.exec:\bbnhtn.exe35⤵
- Executes dropped EXE
PID:4692 -
\??\c:\pjpjv.exec:\pjpjv.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe37⤵
- Executes dropped EXE
PID:3648 -
\??\c:\tnhntn.exec:\tnhntn.exe38⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9djjd.exec:\9djjd.exe39⤵
- Executes dropped EXE
PID:3572 -
\??\c:\pddvj.exec:\pddvj.exe40⤵
- Executes dropped EXE
PID:4676 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe41⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jdpjd.exec:\jdpjd.exe42⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe43⤵
- Executes dropped EXE
PID:4996 -
\??\c:\5rrlffx.exec:\5rrlffx.exe44⤵
- Executes dropped EXE
PID:4744 -
\??\c:\nhnntn.exec:\nhnntn.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vpjvp.exec:\vpjvp.exe46⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rffxrlf.exec:\rffxrlf.exe47⤵
- Executes dropped EXE
PID:4792 -
\??\c:\nbbttt.exec:\nbbttt.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vpjdv.exec:\vpjdv.exe49⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7llfxfx.exec:\7llfxfx.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5tnhbb.exec:\5tnhbb.exe51⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7ppjj.exec:\7ppjj.exe52⤵
- Executes dropped EXE
PID:4748 -
\??\c:\frfrlfx.exec:\frfrlfx.exe53⤵
- Executes dropped EXE
PID:452 -
\??\c:\5rrxrlf.exec:\5rrxrlf.exe54⤵
- Executes dropped EXE
PID:3528 -
\??\c:\tthbnn.exec:\tthbnn.exe55⤵
- Executes dropped EXE
PID:4884 -
\??\c:\djvpp.exec:\djvpp.exe56⤵
- Executes dropped EXE
PID:4852 -
\??\c:\lrlxrrf.exec:\lrlxrrf.exe57⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bnnnhn.exec:\bnnnhn.exe58⤵
- Executes dropped EXE
PID:392 -
\??\c:\hhbbnt.exec:\hhbbnt.exe59⤵
- Executes dropped EXE
PID:996 -
\??\c:\vvpdv.exec:\vvpdv.exe60⤵
- Executes dropped EXE
PID:4256 -
\??\c:\lxrlffr.exec:\lxrlffr.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\bnttbb.exec:\bnttbb.exe62⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dpjvj.exec:\dpjvj.exe63⤵
- Executes dropped EXE
PID:3180 -
\??\c:\lfrlllr.exec:\lfrlllr.exe64⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe65⤵
- Executes dropped EXE
PID:1008 -
\??\c:\btbtbb.exec:\btbtbb.exe66⤵PID:4624
-
\??\c:\pvjvp.exec:\pvjvp.exe67⤵PID:4212
-
\??\c:\jdppv.exec:\jdppv.exe68⤵PID:1040
-
\??\c:\7ffrllf.exec:\7ffrllf.exe69⤵PID:4452
-
\??\c:\tttnhh.exec:\tttnhh.exe70⤵PID:1352
-
\??\c:\pppvv.exec:\pppvv.exe71⤵PID:4320
-
\??\c:\pdvpp.exec:\pdvpp.exe72⤵PID:1732
-
\??\c:\lflxrrf.exec:\lflxrrf.exe73⤵PID:640
-
\??\c:\hbbtnn.exec:\hbbtnn.exe74⤵PID:3256
-
\??\c:\hbhbht.exec:\hbhbht.exe75⤵PID:1332
-
\??\c:\jjpdv.exec:\jjpdv.exe76⤵PID:4692
-
\??\c:\ffllfrr.exec:\ffllfrr.exe77⤵PID:4580
-
\??\c:\hhhthn.exec:\hhhthn.exe78⤵PID:4536
-
\??\c:\ddpjj.exec:\ddpjj.exe79⤵PID:1208
-
\??\c:\jppjj.exec:\jppjj.exe80⤵PID:2704
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe81⤵PID:2356
-
\??\c:\3ttnhb.exec:\3ttnhb.exe82⤵PID:4812
-
\??\c:\pjjdv.exec:\pjjdv.exe83⤵PID:3204
-
\??\c:\jdvjd.exec:\jdvjd.exe84⤵PID:3252
-
\??\c:\lxxrlff.exec:\lxxrlff.exe85⤵PID:3440
-
\??\c:\lfxrxrf.exec:\lfxrxrf.exe86⤵PID:1400
-
\??\c:\hhbhbn.exec:\hhbhbn.exe87⤵PID:4172
-
\??\c:\pdjpd.exec:\pdjpd.exe88⤵PID:1652
-
\??\c:\rlffrxx.exec:\rlffrxx.exe89⤵PID:3524
-
\??\c:\hbbtnn.exec:\hbbtnn.exe90⤵PID:3480
-
\??\c:\3flfxrl.exec:\3flfxrl.exe91⤵PID:3336
-
\??\c:\htnbhb.exec:\htnbhb.exe92⤵PID:4596
-
\??\c:\hnthbb.exec:\hnthbb.exe93⤵PID:804
-
\??\c:\9vddv.exec:\9vddv.exe94⤵PID:1232
-
\??\c:\frfrfxr.exec:\frfrfxr.exe95⤵PID:2140
-
\??\c:\nnnbbt.exec:\nnnbbt.exe96⤵PID:1608
-
\??\c:\vvjdp.exec:\vvjdp.exe97⤵PID:3660
-
\??\c:\xlxlrff.exec:\xlxlrff.exe98⤵PID:4572
-
\??\c:\bbbtnh.exec:\bbbtnh.exe99⤵PID:996
-
\??\c:\1bnnnn.exec:\1bnnnn.exe100⤵PID:4256
-
\??\c:\pdppv.exec:\pdppv.exe101⤵PID:3060
-
\??\c:\frxxrrr.exec:\frxxrrr.exe102⤵PID:1536
-
\??\c:\nhhhbt.exec:\nhhhbt.exe103⤵PID:1644
-
\??\c:\1ttnhh.exec:\1ttnhh.exe104⤵PID:4848
-
\??\c:\pjpdp.exec:\pjpdp.exe105⤵PID:8
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe106⤵PID:3760
-
\??\c:\thnhhb.exec:\thnhhb.exe107⤵PID:4304
-
\??\c:\ntnnhh.exec:\ntnnhh.exe108⤵PID:1516
-
\??\c:\dppjd.exec:\dppjd.exe109⤵PID:4484
-
\??\c:\rrlffxf.exec:\rrlffxf.exe110⤵PID:2936
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe111⤵PID:4280
-
\??\c:\hntnbb.exec:\hntnbb.exe112⤵PID:3256
-
\??\c:\5jvpj.exec:\5jvpj.exe113⤵PID:3720
-
\??\c:\fllfrxr.exec:\fllfrxr.exe114⤵PID:5012
-
\??\c:\ttthnh.exec:\ttthnh.exe115⤵PID:2672
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:3000
-
\??\c:\ddddp.exec:\ddddp.exe117⤵PID:4872
-
\??\c:\3llxrrl.exec:\3llxrrl.exe118⤵PID:4456
-
\??\c:\hhbhbb.exec:\hhbhbb.exe119⤵PID:4740
-
\??\c:\bhnbhb.exec:\bhnbhb.exe120⤵PID:5056
-
\??\c:\1djjj.exec:\1djjj.exe121⤵PID:3948
-
\??\c:\xfllllf.exec:\xfllllf.exe122⤵PID:2084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-