Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 22:53
Behavioral task
behavioral1
Sample
4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe
-
Size
252KB
-
MD5
4c5b2ce022f91db743432affd2b4e2d0
-
SHA1
69d21da3ada8265356e89c5c36baa2700286be43
-
SHA256
3fa421194294cf39afffac6db86e893c585ed71060b2f6519266b42c75fc7d58
-
SHA512
a8a7c2f47c2e0e25428febbdabdb926871c7d520877426ba5c2fbf5405181ad23b10fc47d0096fb110f13babbf2aac416ef4f5a2ea38ac8ed3590a5228d874f1
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkP:ccm4FmowdHoSi9EIBftapTs4WZazeEP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4040-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2292-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2028-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3604-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4348-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3624-39-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5040-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3380-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2580-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5012-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2068-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2760-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2880-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4372-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3500-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4972-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/764-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/540-115-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1508-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2320-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2772-149-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3528-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-171-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1076-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1632-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3436-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3616-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4040-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4076-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3652-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/744-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4884-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2512-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1096-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4092-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3312-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2880-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/228-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3972-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3256-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4424-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2536-311-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1272-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2452-339-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-343-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3180-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1240-372-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3856-374-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-389-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2660-411-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4744-427-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/764-446-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1348-450-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2012-500-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1988-520-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/980-545-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1224-550-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4984-647-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1552-698-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3296-753-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1220-995-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/836-1234-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4624-1388-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023276-3.dat family_berbew behavioral2/files/0x000700000002341a-10.dat family_berbew behavioral2/files/0x000700000002341b-14.dat family_berbew behavioral2/files/0x000700000002341c-24.dat family_berbew behavioral2/files/0x000700000002341d-29.dat family_berbew behavioral2/files/0x000700000002341e-35.dat family_berbew behavioral2/files/0x000700000002341f-42.dat family_berbew behavioral2/files/0x0007000000023420-49.dat family_berbew behavioral2/files/0x0007000000023421-53.dat family_berbew behavioral2/files/0x0007000000023422-58.dat family_berbew behavioral2/files/0x0007000000023423-67.dat family_berbew behavioral2/files/0x0007000000023424-70.dat family_berbew behavioral2/files/0x0007000000023425-76.dat family_berbew behavioral2/files/0x0007000000023426-84.dat family_berbew behavioral2/files/0x0007000000023427-87.dat family_berbew behavioral2/files/0x0007000000023428-94.dat family_berbew behavioral2/files/0x0007000000023429-100.dat family_berbew behavioral2/files/0x000700000002342a-108.dat family_berbew behavioral2/files/0x000700000002342b-112.dat family_berbew behavioral2/files/0x000700000002342c-118.dat family_berbew behavioral2/files/0x000700000002342d-125.dat family_berbew behavioral2/files/0x000700000002342e-131.dat family_berbew behavioral2/files/0x000700000002342f-136.dat family_berbew behavioral2/files/0x0007000000023430-140.dat family_berbew behavioral2/files/0x0007000000023431-146.dat family_berbew behavioral2/files/0x0007000000023432-152.dat family_berbew behavioral2/files/0x0007000000023433-156.dat family_berbew behavioral2/files/0x0007000000023434-161.dat family_berbew behavioral2/files/0x0007000000023435-168.dat family_berbew behavioral2/files/0x0007000000023436-174.dat family_berbew behavioral2/files/0x0007000000023437-179.dat family_berbew behavioral2/files/0x0007000000023438-184.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2292 frrlffx.exe 2028 fllfxxx.exe 3604 9btttt.exe 4348 ppppp.exe 5040 xlrffll.exe 3624 fxffxll.exe 3380 nbnhbt.exe 2580 vvdvp.exe 5012 jvvpj.exe 2068 1llffff.exe 2760 9nhnhh.exe 3308 3djdd.exe 2880 rrxxxxx.exe 4372 9httnn.exe 3500 nhnbbn.exe 4972 jdddv.exe 764 1hbttt.exe 540 rxfllll.exe 2152 nbnbbn.exe 1508 pvjpd.exe 2320 tbnhbb.exe 3240 jpjvj.exe 1272 lrxxlxf.exe 4632 pvvpj.exe 2772 lffllrx.exe 2308 5nthtb.exe 3528 nhttnn.exe 4676 jpdvp.exe 1196 ffflllx.exe 1076 nnhthn.exe 836 pjjdv.exe 1632 9hhbbb.exe 3436 pdjvd.exe 656 7tbttn.exe 2852 dvjjj.exe 3616 vjjvp.exe 4100 5lllfll.exe 4436 bntnnn.exe 5000 ppdvp.exe 4040 3rrrllr.exe 4076 hnnhbn.exe 2036 vpjdp.exe 3652 rffxxxx.exe 744 hhhbtb.exe 4348 jdvpp.exe 4712 fxfxrlr.exe 4884 xrrlfxx.exe 3752 nhbtnh.exe 2512 jvvvv.exe 2076 xlxlllf.exe 2712 bhbtnn.exe 3832 vvvvp.exe 1096 5jpjd.exe 4796 7lffxff.exe 2144 5bbhhh.exe 4092 1dpjj.exe 3312 llxrlff.exe 4744 ntnnhh.exe 2880 1vvvv.exe 2596 xlxrrll.exe 4176 rrfxllr.exe 228 nttthb.exe 3972 dvdvv.exe 3256 ppvpp.exe -
resource yara_rule behavioral2/memory/4040-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023276-3.dat upx behavioral2/memory/4040-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2292-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341a-10.dat upx behavioral2/memory/2292-12-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2028-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341b-14.dat upx behavioral2/memory/3604-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341c-24.dat upx behavioral2/memory/4348-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-29.dat upx behavioral2/memory/4348-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-35.dat upx behavioral2/memory/3624-39-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5040-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341f-42.dat upx behavioral2/memory/3380-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023420-49.dat upx behavioral2/files/0x0007000000023421-53.dat upx behavioral2/memory/2580-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023422-58.dat upx behavioral2/memory/5012-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2068-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023423-67.dat upx behavioral2/files/0x0007000000023424-70.dat upx behavioral2/memory/2760-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-76.dat upx behavioral2/files/0x0007000000023426-84.dat upx behavioral2/memory/2880-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023427-87.dat upx behavioral2/memory/4372-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023428-94.dat upx behavioral2/memory/4972-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3500-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023429-100.dat upx behavioral2/memory/4972-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/764-107-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-108.dat upx behavioral2/files/0x000700000002342b-112.dat upx behavioral2/memory/540-115-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342c-118.dat upx behavioral2/memory/1508-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342d-125.dat upx behavioral2/memory/2320-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342e-131.dat upx behavioral2/files/0x000700000002342f-136.dat upx behavioral2/files/0x0007000000023430-140.dat upx behavioral2/files/0x0007000000023431-146.dat upx behavioral2/memory/2772-149-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-152.dat upx behavioral2/files/0x0007000000023433-156.dat upx behavioral2/files/0x0007000000023434-161.dat upx behavioral2/memory/3528-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023435-168.dat upx behavioral2/memory/1196-171-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023436-174.dat upx behavioral2/memory/1076-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023437-179.dat upx behavioral2/files/0x0007000000023438-184.dat upx behavioral2/memory/836-186-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1632-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3436-195-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3616-205-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4040 wrote to memory of 2292 4040 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 2292 4040 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 82 PID 4040 wrote to memory of 2292 4040 4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe 82 PID 2292 wrote to memory of 2028 2292 frrlffx.exe 83 PID 2292 wrote to memory of 2028 2292 frrlffx.exe 83 PID 2292 wrote to memory of 2028 2292 frrlffx.exe 83 PID 2028 wrote to memory of 3604 2028 fllfxxx.exe 84 PID 2028 wrote to memory of 3604 2028 fllfxxx.exe 84 PID 2028 wrote to memory of 3604 2028 fllfxxx.exe 84 PID 3604 wrote to memory of 4348 3604 9btttt.exe 85 PID 3604 wrote to memory of 4348 3604 9btttt.exe 85 PID 3604 wrote to memory of 4348 3604 9btttt.exe 85 PID 4348 wrote to memory of 5040 4348 ppppp.exe 86 PID 4348 wrote to memory of 5040 4348 ppppp.exe 86 PID 4348 wrote to memory of 5040 4348 ppppp.exe 86 PID 5040 wrote to memory of 3624 5040 xlrffll.exe 87 PID 5040 wrote to memory of 3624 5040 xlrffll.exe 87 PID 5040 wrote to memory of 3624 5040 xlrffll.exe 87 PID 3624 wrote to memory of 3380 3624 fxffxll.exe 89 PID 3624 wrote to memory of 3380 3624 fxffxll.exe 89 PID 3624 wrote to memory of 3380 3624 fxffxll.exe 89 PID 3380 wrote to memory of 2580 3380 nbnhbt.exe 90 PID 3380 wrote to memory of 2580 3380 nbnhbt.exe 90 PID 3380 wrote to memory of 2580 3380 nbnhbt.exe 90 PID 2580 wrote to memory of 5012 2580 vvdvp.exe 91 PID 2580 wrote to memory of 5012 2580 vvdvp.exe 91 PID 2580 wrote to memory of 5012 2580 vvdvp.exe 91 PID 5012 wrote to memory of 2068 5012 jvvpj.exe 92 PID 5012 wrote to memory of 2068 5012 jvvpj.exe 92 PID 5012 wrote to memory of 2068 5012 jvvpj.exe 92 PID 2068 wrote to memory of 2760 2068 1llffff.exe 93 PID 2068 wrote to memory of 2760 2068 1llffff.exe 93 PID 2068 wrote to memory of 2760 2068 1llffff.exe 93 PID 2760 wrote to memory of 3308 2760 9nhnhh.exe 94 PID 2760 wrote to memory of 3308 2760 9nhnhh.exe 94 PID 2760 wrote to memory of 3308 2760 9nhnhh.exe 94 PID 3308 wrote to memory of 2880 3308 3djdd.exe 95 PID 3308 wrote to memory of 2880 3308 3djdd.exe 95 PID 3308 wrote to memory of 2880 3308 3djdd.exe 95 PID 2880 wrote to memory of 4372 2880 rrxxxxx.exe 96 PID 2880 wrote to memory of 4372 2880 rrxxxxx.exe 96 PID 2880 wrote to memory of 4372 2880 rrxxxxx.exe 96 PID 4372 wrote to memory of 3500 4372 9httnn.exe 97 PID 4372 wrote to memory of 3500 4372 9httnn.exe 97 PID 4372 wrote to memory of 3500 4372 9httnn.exe 97 PID 3500 wrote to memory of 4972 3500 nhnbbn.exe 98 PID 3500 wrote to memory of 4972 3500 nhnbbn.exe 98 PID 3500 wrote to memory of 4972 3500 nhnbbn.exe 98 PID 4972 wrote to memory of 764 4972 jdddv.exe 99 PID 4972 wrote to memory of 764 4972 jdddv.exe 99 PID 4972 wrote to memory of 764 4972 jdddv.exe 99 PID 764 wrote to memory of 540 764 1hbttt.exe 100 PID 764 wrote to memory of 540 764 1hbttt.exe 100 PID 764 wrote to memory of 540 764 1hbttt.exe 100 PID 540 wrote to memory of 2152 540 rxfllll.exe 101 PID 540 wrote to memory of 2152 540 rxfllll.exe 101 PID 540 wrote to memory of 2152 540 rxfllll.exe 101 PID 2152 wrote to memory of 1508 2152 nbnbbn.exe 102 PID 2152 wrote to memory of 1508 2152 nbnbbn.exe 102 PID 2152 wrote to memory of 1508 2152 nbnbbn.exe 102 PID 1508 wrote to memory of 2320 1508 pvjpd.exe 103 PID 1508 wrote to memory of 2320 1508 pvjpd.exe 103 PID 1508 wrote to memory of 2320 1508 pvjpd.exe 103 PID 2320 wrote to memory of 3240 2320 tbnhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c5b2ce022f91db743432affd2b4e2d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\frrlffx.exec:\frrlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\fllfxxx.exec:\fllfxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9btttt.exec:\9btttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ppppp.exec:\ppppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\xlrffll.exec:\xlrffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\fxffxll.exec:\fxffxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\nbnhbt.exec:\nbnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\vvdvp.exec:\vvdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jvvpj.exec:\jvvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\1llffff.exec:\1llffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9nhnhh.exec:\9nhnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3djdd.exec:\3djdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\9httnn.exec:\9httnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\nhnbbn.exec:\nhnbbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\jdddv.exec:\jdddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\1hbttt.exec:\1hbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rxfllll.exec:\rxfllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nbnbbn.exec:\nbnbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\pvjpd.exec:\pvjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\tbnhbb.exec:\tbnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\jpjvj.exec:\jpjvj.exe23⤵
- Executes dropped EXE
PID:3240 -
\??\c:\lrxxlxf.exec:\lrxxlxf.exe24⤵
- Executes dropped EXE
PID:1272 -
\??\c:\pvvpj.exec:\pvvpj.exe25⤵
- Executes dropped EXE
PID:4632 -
\??\c:\lffllrx.exec:\lffllrx.exe26⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5nthtb.exec:\5nthtb.exe27⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nhttnn.exec:\nhttnn.exe28⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jpdvp.exec:\jpdvp.exe29⤵
- Executes dropped EXE
PID:4676 -
\??\c:\ffflllx.exec:\ffflllx.exe30⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nnhthn.exec:\nnhthn.exe31⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pjjdv.exec:\pjjdv.exe32⤵
- Executes dropped EXE
PID:836 -
\??\c:\9hhbbb.exec:\9hhbbb.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pdjvd.exec:\pdjvd.exe34⤵
- Executes dropped EXE
PID:3436 -
\??\c:\7tbttn.exec:\7tbttn.exe35⤵
- Executes dropped EXE
PID:656 -
\??\c:\dvjjj.exec:\dvjjj.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vjjvp.exec:\vjjvp.exe37⤵
- Executes dropped EXE
PID:3616 -
\??\c:\5lllfll.exec:\5lllfll.exe38⤵
- Executes dropped EXE
PID:4100 -
\??\c:\bntnnn.exec:\bntnnn.exe39⤵
- Executes dropped EXE
PID:4436 -
\??\c:\ppdvp.exec:\ppdvp.exe40⤵
- Executes dropped EXE
PID:5000 -
\??\c:\3rrrllr.exec:\3rrrllr.exe41⤵
- Executes dropped EXE
PID:4040 -
\??\c:\hnnhbn.exec:\hnnhbn.exe42⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vpjdp.exec:\vpjdp.exe43⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rffxxxx.exec:\rffxxxx.exe44⤵
- Executes dropped EXE
PID:3652 -
\??\c:\hhhbtb.exec:\hhhbtb.exe45⤵
- Executes dropped EXE
PID:744 -
\??\c:\jdvpp.exec:\jdvpp.exe46⤵
- Executes dropped EXE
PID:4348 -
\??\c:\fxfxrlr.exec:\fxfxrlr.exe47⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe48⤵
- Executes dropped EXE
PID:4884 -
\??\c:\nhbtnh.exec:\nhbtnh.exe49⤵
- Executes dropped EXE
PID:3752 -
\??\c:\jvvvv.exec:\jvvvv.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xlxlllf.exec:\xlxlllf.exe51⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bhbtnn.exec:\bhbtnn.exe52⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vvvvp.exec:\vvvvp.exe53⤵
- Executes dropped EXE
PID:3832 -
\??\c:\5jpjd.exec:\5jpjd.exe54⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7lffxff.exec:\7lffxff.exe55⤵
- Executes dropped EXE
PID:4796 -
\??\c:\5bbhhh.exec:\5bbhhh.exe56⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1dpjj.exec:\1dpjj.exe57⤵
- Executes dropped EXE
PID:4092 -
\??\c:\llxrlff.exec:\llxrlff.exe58⤵
- Executes dropped EXE
PID:3312 -
\??\c:\ntnnhh.exec:\ntnnhh.exe59⤵
- Executes dropped EXE
PID:4744 -
\??\c:\1vvvv.exec:\1vvvv.exe60⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xlxrrll.exec:\xlxrrll.exe61⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rrfxllr.exec:\rrfxllr.exe62⤵
- Executes dropped EXE
PID:4176 -
\??\c:\nttthb.exec:\nttthb.exe63⤵
- Executes dropped EXE
PID:228 -
\??\c:\dvdvv.exec:\dvdvv.exe64⤵
- Executes dropped EXE
PID:3972 -
\??\c:\ppvpp.exec:\ppvpp.exe65⤵
- Executes dropped EXE
PID:3256 -
\??\c:\3flfxxr.exec:\3flfxxr.exe66⤵PID:1504
-
\??\c:\bbhbhb.exec:\bbhbhb.exe67⤵PID:4424
-
\??\c:\1ppjj.exec:\1ppjj.exe68⤵PID:2536
-
\??\c:\vdppv.exec:\vdppv.exe69⤵PID:1192
-
\??\c:\tbbtbt.exec:\tbbtbt.exe70⤵PID:4228
-
\??\c:\vddvp.exec:\vddvp.exe71⤵PID:1272
-
\??\c:\tnhbtt.exec:\tnhbtt.exe72⤵PID:3440
-
\??\c:\pdpdd.exec:\pdpdd.exe73⤵PID:2936
-
\??\c:\rxffxxx.exec:\rxffxxx.exe74⤵PID:4748
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe75⤵PID:3608
-
\??\c:\tnttbt.exec:\tnttbt.exe76⤵PID:3260
-
\??\c:\vvvpj.exec:\vvvpj.exe77⤵PID:2452
-
\??\c:\jpdvj.exec:\jpdvj.exe78⤵PID:4588
-
\??\c:\7llfxxx.exec:\7llfxxx.exe79⤵PID:4456
-
\??\c:\tbbnht.exec:\tbbnht.exe80⤵PID:3224
-
\??\c:\nhnnhh.exec:\nhnnhh.exe81⤵PID:3180
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:1516
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe83⤵PID:2756
-
\??\c:\1ntnhh.exec:\1ntnhh.exe84⤵PID:808
-
\??\c:\bhtnnn.exec:\bhtnnn.exe85⤵PID:628
-
\??\c:\jppdd.exec:\jppdd.exe86⤵PID:1240
-
\??\c:\xrfflfl.exec:\xrfflfl.exe87⤵PID:3856
-
\??\c:\ffrlllf.exec:\ffrlllf.exe88⤵PID:4440
-
\??\c:\hbtnnn.exec:\hbtnnn.exe89⤵PID:4072
-
\??\c:\9vdvp.exec:\9vdvp.exe90⤵PID:1944
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe91⤵PID:4040
-
\??\c:\nhnnhh.exec:\nhnnhh.exe92⤵PID:3280
-
\??\c:\ddvdj.exec:\ddvdj.exe93⤵PID:3840
-
\??\c:\1lfllrf.exec:\1lfllrf.exe94⤵PID:1316
-
\??\c:\nnhhhh.exec:\nnhhhh.exe95⤵PID:404
-
\??\c:\hthbtt.exec:\hthbtt.exe96⤵PID:1796
-
\??\c:\vvdpj.exec:\vvdpj.exe97⤵PID:1880
-
\??\c:\1rrlfxr.exec:\1rrlfxr.exe98⤵PID:4976
-
\??\c:\llrxffl.exec:\llrxffl.exe99⤵PID:2660
-
\??\c:\5tnhbt.exec:\5tnhbt.exe100⤵PID:5012
-
\??\c:\hntnhb.exec:\hntnhb.exe101⤵PID:4796
-
\??\c:\vvdvp.exec:\vvdvp.exe102⤵PID:4092
-
\??\c:\xrllffr.exec:\xrllffr.exe103⤵PID:3048
-
\??\c:\rllflrl.exec:\rllflrl.exe104⤵PID:4744
-
\??\c:\5bnhbb.exec:\5bnhbb.exe105⤵PID:2848
-
\??\c:\5pvpv.exec:\5pvpv.exe106⤵PID:2392
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe107⤵PID:4480
-
\??\c:\bnnhbb.exec:\bnnhbb.exe108⤵PID:3972
-
\??\c:\vpdpd.exec:\vpdpd.exe109⤵PID:764
-
\??\c:\xfxrfxx.exec:\xfxrfxx.exe110⤵PID:1348
-
\??\c:\nbbtbt.exec:\nbbtbt.exe111⤵PID:388
-
\??\c:\ppvpd.exec:\ppvpd.exe112⤵PID:2320
-
\??\c:\xfxxxrl.exec:\xfxxxrl.exe113⤵PID:1916
-
\??\c:\3nnhbb.exec:\3nnhbb.exe114⤵PID:872
-
\??\c:\3pvvp.exec:\3pvvp.exe115⤵PID:1272
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe116⤵PID:3388
-
\??\c:\9hbtnn.exec:\9hbtnn.exe117⤵PID:4784
-
\??\c:\rlrlfff.exec:\rlrlfff.exe118⤵PID:3640
-
\??\c:\bthbtt.exec:\bthbtt.exe119⤵PID:4616
-
\??\c:\vddvv.exec:\vddvv.exe120⤵PID:3260
-
\??\c:\7vjjd.exec:\7vjjd.exe121⤵PID:2340
-
\??\c:\lxxxxrl.exec:\lxxxxrl.exe122⤵PID:5072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-