Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 14:33
Behavioral task
behavioral1
Sample
d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe
-
Size
440KB
-
MD5
d68cfb48f52348c1245dc7dd9d999490
-
SHA1
494f1d76b30b1aba05985fc2167fda1c97d23c08
-
SHA256
5b4d5e4b063bf5a8da8e4bf52227a25d1cd27e5fad4ae5ea32aea11b7330b9ca
-
SHA512
7c83051f0521d7a0946d6f8198a25003177adedd1918b2f5059da37aa1998d76066c1e2a3339b5624bfcf5f9a429e2e59031602bd58e16ef991f6a0239ed44a4
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHN:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMP
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/744-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3112-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4796-30-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2916-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1528-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4320-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2636-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1408-53-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2316-55-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5024-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5004-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3688-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3064-82-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3288-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1380-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2096-102-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4516-107-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4436-133-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2268-145-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3236-148-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4764-164-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2876-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3924-181-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1944-180-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4364-190-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/436-194-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1900-198-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1540-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3148-203-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1764-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/948-212-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2916-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3512-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4044-233-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4804-243-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1056-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4160-254-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1408-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4780-263-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4208-267-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2580-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3184-279-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5088-303-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4532-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3884-315-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4856-318-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/536-325-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3724-375-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3856-378-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-396-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2844-442-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3644-503-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2516-508-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3924-526-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2132-540-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4372-555-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3112-574-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5096-584-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/756-585-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4592-611-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4640-643-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1268-653-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3656-767-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-881-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x000700000002341d-13.dat family_berbew behavioral2/files/0x000700000002341e-23.dat family_berbew behavioral2/files/0x000700000002341f-27.dat family_berbew behavioral2/files/0x000800000002341c-11.dat family_berbew behavioral2/files/0x0007000000023420-34.dat family_berbew behavioral2/files/0x0007000000023421-39.dat family_berbew behavioral2/files/0x0007000000023422-45.dat family_berbew behavioral2/files/0x0007000000023423-51.dat family_berbew behavioral2/files/0x0007000000023424-57.dat family_berbew behavioral2/files/0x0007000000023425-64.dat family_berbew behavioral2/files/0x0007000000023426-69.dat family_berbew behavioral2/files/0x0007000000023427-74.dat family_berbew behavioral2/files/0x0007000000023428-83.dat family_berbew behavioral2/files/0x000800000002341a-87.dat family_berbew behavioral2/files/0x0007000000023429-93.dat family_berbew behavioral2/files/0x000700000002342a-98.dat family_berbew behavioral2/files/0x000700000002342b-104.dat family_berbew behavioral2/files/0x000700000002342c-110.dat family_berbew behavioral2/files/0x000700000002342d-116.dat family_berbew behavioral2/files/0x000700000002342e-121.dat family_berbew behavioral2/files/0x000700000002342f-126.dat family_berbew behavioral2/files/0x0007000000023430-131.dat family_berbew behavioral2/files/0x0007000000023431-139.dat family_berbew behavioral2/files/0x0007000000023432-144.dat family_berbew behavioral2/files/0x0007000000023433-150.dat family_berbew behavioral2/files/0x0007000000023434-156.dat family_berbew behavioral2/files/0x0007000000023435-161.dat family_berbew behavioral2/files/0x0007000000023436-166.dat family_berbew behavioral2/files/0x0007000000023437-173.dat family_berbew behavioral2/files/0x0007000000023438-177.dat family_berbew behavioral2/files/0x0007000000023439-185.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 1528 pjvvp.exe 2916 rrxxxxf.exe 3112 hnnntt.exe 3744 nbhhbt.exe 4796 jvvvv.exe 4320 rlxxxxx.exe 2636 vjvdv.exe 1408 xxfxxxx.exe 2316 vpjjj.exe 5024 djvvv.exe 5004 frrrrxx.exe 3688 hhnnnt.exe 3064 5djdj.exe 3288 jpddv.exe 1380 5nbnnb.exe 4996 pdjdd.exe 2096 xrrfxfx.exe 4516 ffxlxff.exe 760 rxfxrrr.exe 3884 pvjvd.exe 2412 xlfrffr.exe 4436 1rrfxxr.exe 388 vppjd.exe 2268 dpvpd.exe 3236 bhbttt.exe 2892 pvpdj.exe 4292 ntbnbt.exe 4764 frrffxr.exe 2876 9xrlfxx.exe 1944 bttbnt.exe 3924 hnthbb.exe 4364 vpvjp.exe 436 lrxfxrl.exe 1900 frfrrlr.exe 1540 vdjvd.exe 3148 7rrlxxr.exe 1764 7tbbtn.exe 948 pjdvp.exe 3872 pppjd.exe 4800 httnbt.exe 1528 jvdpd.exe 2916 rrlrxrl.exe 3512 nhnbhb.exe 4044 pjvpp.exe 1952 lffxrrl.exe 4804 nbtntt.exe 1056 nbnhbh.exe 5016 vdjdp.exe 4160 rrrlllf.exe 1408 ntnbtn.exe 4780 tthtnn.exe 4208 1pjjj.exe 2580 xrfrlfr.exe 224 3tbtnh.exe 1296 vjjjv.exe 3184 pvvpd.exe 2404 ffrrxxl.exe 1368 9tnnnn.exe 1044 dvpjj.exe 2444 xlllffx.exe 4904 frfxrrl.exe 2052 bthhbb.exe 5088 jpdjp.exe 4532 xxffffx.exe -
resource yara_rule behavioral2/memory/744-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/744-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341d-13.dat upx behavioral2/memory/3112-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341e-23.dat upx behavioral2/files/0x000700000002341f-27.dat upx behavioral2/memory/4796-30-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2916-14-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002341c-11.dat upx behavioral2/memory/1528-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023420-34.dat upx behavioral2/memory/4320-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023421-39.dat upx behavioral2/memory/2636-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023422-45.dat upx behavioral2/memory/1408-53-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2316-55-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023423-51.dat upx behavioral2/files/0x0007000000023424-57.dat upx behavioral2/memory/5024-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5004-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023425-64.dat upx behavioral2/files/0x0007000000023426-69.dat upx behavioral2/files/0x0007000000023427-74.dat upx behavioral2/memory/3688-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023428-83.dat upx behavioral2/memory/3064-82-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3288-84-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002341a-87.dat upx behavioral2/memory/1380-91-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023429-93.dat upx behavioral2/files/0x000700000002342a-98.dat upx behavioral2/memory/2096-102-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342b-104.dat upx behavioral2/memory/4516-107-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342c-110.dat upx behavioral2/files/0x000700000002342d-116.dat upx behavioral2/memory/3884-117-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342e-121.dat upx behavioral2/files/0x000700000002342f-126.dat upx behavioral2/memory/4436-133-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023430-131.dat upx behavioral2/memory/388-135-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023431-139.dat upx behavioral2/files/0x0007000000023432-144.dat upx behavioral2/memory/2268-145-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3236-148-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023433-150.dat upx behavioral2/files/0x0007000000023434-156.dat upx behavioral2/files/0x0007000000023435-161.dat upx behavioral2/memory/4764-164-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023436-166.dat upx behavioral2/memory/2876-169-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023437-173.dat upx behavioral2/files/0x0007000000023438-177.dat upx behavioral2/memory/3924-181-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1944-180-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023439-185.dat upx behavioral2/memory/4364-190-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/436-194-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1900-198-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1540-202-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3148-203-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 744 wrote to memory of 1528 744 d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe 82 PID 744 wrote to memory of 1528 744 d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe 82 PID 744 wrote to memory of 1528 744 d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe 82 PID 1528 wrote to memory of 2916 1528 pjvvp.exe 83 PID 1528 wrote to memory of 2916 1528 pjvvp.exe 83 PID 1528 wrote to memory of 2916 1528 pjvvp.exe 83 PID 2916 wrote to memory of 3112 2916 rrxxxxf.exe 84 PID 2916 wrote to memory of 3112 2916 rrxxxxf.exe 84 PID 2916 wrote to memory of 3112 2916 rrxxxxf.exe 84 PID 3112 wrote to memory of 3744 3112 hnnntt.exe 85 PID 3112 wrote to memory of 3744 3112 hnnntt.exe 85 PID 3112 wrote to memory of 3744 3112 hnnntt.exe 85 PID 3744 wrote to memory of 4796 3744 nbhhbt.exe 86 PID 3744 wrote to memory of 4796 3744 nbhhbt.exe 86 PID 3744 wrote to memory of 4796 3744 nbhhbt.exe 86 PID 4796 wrote to memory of 4320 4796 jvvvv.exe 87 PID 4796 wrote to memory of 4320 4796 jvvvv.exe 87 PID 4796 wrote to memory of 4320 4796 jvvvv.exe 87 PID 4320 wrote to memory of 2636 4320 rlxxxxx.exe 89 PID 4320 wrote to memory of 2636 4320 rlxxxxx.exe 89 PID 4320 wrote to memory of 2636 4320 rlxxxxx.exe 89 PID 2636 wrote to memory of 1408 2636 vjvdv.exe 90 PID 2636 wrote to memory of 1408 2636 vjvdv.exe 90 PID 2636 wrote to memory of 1408 2636 vjvdv.exe 90 PID 1408 wrote to memory of 2316 1408 xxfxxxx.exe 92 PID 1408 wrote to memory of 2316 1408 xxfxxxx.exe 92 PID 1408 wrote to memory of 2316 1408 xxfxxxx.exe 92 PID 2316 wrote to memory of 5024 2316 vpjjj.exe 93 PID 2316 wrote to memory of 5024 2316 vpjjj.exe 93 PID 2316 wrote to memory of 5024 2316 vpjjj.exe 93 PID 5024 wrote to memory of 5004 5024 djvvv.exe 95 PID 5024 wrote to memory of 5004 5024 djvvv.exe 95 PID 5024 wrote to memory of 5004 5024 djvvv.exe 95 PID 5004 wrote to memory of 3688 5004 frrrrxx.exe 96 PID 5004 wrote to memory of 3688 5004 frrrrxx.exe 96 PID 5004 wrote to memory of 3688 5004 frrrrxx.exe 96 PID 3688 wrote to memory of 3064 3688 hhnnnt.exe 97 PID 3688 wrote to memory of 3064 3688 hhnnnt.exe 97 PID 3688 wrote to memory of 3064 3688 hhnnnt.exe 97 PID 3064 wrote to memory of 3288 3064 5djdj.exe 98 PID 3064 wrote to memory of 3288 3064 5djdj.exe 98 PID 3064 wrote to memory of 3288 3064 5djdj.exe 98 PID 3288 wrote to memory of 1380 3288 jpddv.exe 99 PID 3288 wrote to memory of 1380 3288 jpddv.exe 99 PID 3288 wrote to memory of 1380 3288 jpddv.exe 99 PID 1380 wrote to memory of 4996 1380 5nbnnb.exe 100 PID 1380 wrote to memory of 4996 1380 5nbnnb.exe 100 PID 1380 wrote to memory of 4996 1380 5nbnnb.exe 100 PID 4996 wrote to memory of 2096 4996 pdjdd.exe 101 PID 4996 wrote to memory of 2096 4996 pdjdd.exe 101 PID 4996 wrote to memory of 2096 4996 pdjdd.exe 101 PID 2096 wrote to memory of 4516 2096 xrrfxfx.exe 102 PID 2096 wrote to memory of 4516 2096 xrrfxfx.exe 102 PID 2096 wrote to memory of 4516 2096 xrrfxfx.exe 102 PID 4516 wrote to memory of 760 4516 ffxlxff.exe 103 PID 4516 wrote to memory of 760 4516 ffxlxff.exe 103 PID 4516 wrote to memory of 760 4516 ffxlxff.exe 103 PID 760 wrote to memory of 3884 760 rxfxrrr.exe 104 PID 760 wrote to memory of 3884 760 rxfxrrr.exe 104 PID 760 wrote to memory of 3884 760 rxfxrrr.exe 104 PID 3884 wrote to memory of 2412 3884 pvjvd.exe 105 PID 3884 wrote to memory of 2412 3884 pvjvd.exe 105 PID 3884 wrote to memory of 2412 3884 pvjvd.exe 105 PID 2412 wrote to memory of 4436 2412 xlfrffr.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d68cfb48f52348c1245dc7dd9d999490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\pjvvp.exec:\pjvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\hnnntt.exec:\hnnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\nbhhbt.exec:\nbhhbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\jvvvv.exec:\jvvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\rlxxxxx.exec:\rlxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\vjvdv.exec:\vjvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\vpjjj.exec:\vpjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\djvvv.exec:\djvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frrrrxx.exec:\frrrrxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\hhnnnt.exec:\hhnnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\5djdj.exec:\5djdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\jpddv.exec:\jpddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\5nbnnb.exec:\5nbnnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\pdjdd.exec:\pdjdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xrrfxfx.exec:\xrrfxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\ffxlxff.exec:\ffxlxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\pvjvd.exec:\pvjvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\xlfrffr.exec:\xlfrffr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\1rrfxxr.exec:\1rrfxxr.exe23⤵
- Executes dropped EXE
PID:4436 -
\??\c:\vppjd.exec:\vppjd.exe24⤵
- Executes dropped EXE
PID:388 -
\??\c:\dpvpd.exec:\dpvpd.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\bhbttt.exec:\bhbttt.exe26⤵
- Executes dropped EXE
PID:3236 -
\??\c:\pvpdj.exec:\pvpdj.exe27⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ntbnbt.exec:\ntbnbt.exe28⤵
- Executes dropped EXE
PID:4292 -
\??\c:\frrffxr.exec:\frrffxr.exe29⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9xrlfxx.exec:\9xrlfxx.exe30⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bttbnt.exec:\bttbnt.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnthbb.exec:\hnthbb.exe32⤵
- Executes dropped EXE
PID:3924 -
\??\c:\vpvjp.exec:\vpvjp.exe33⤵
- Executes dropped EXE
PID:4364 -
\??\c:\lrxfxrl.exec:\lrxfxrl.exe34⤵
- Executes dropped EXE
PID:436 -
\??\c:\frfrrlr.exec:\frfrrlr.exe35⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vdjvd.exec:\vdjvd.exe36⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7rrlxxr.exec:\7rrlxxr.exe37⤵
- Executes dropped EXE
PID:3148 -
\??\c:\7tbbtn.exec:\7tbbtn.exe38⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pjdvp.exec:\pjdvp.exe39⤵
- Executes dropped EXE
PID:948 -
\??\c:\pppjd.exec:\pppjd.exe40⤵
- Executes dropped EXE
PID:3872 -
\??\c:\lxfxllf.exec:\lxfxllf.exe41⤵PID:4348
-
\??\c:\httnbt.exec:\httnbt.exe42⤵
- Executes dropped EXE
PID:4800 -
\??\c:\jvdpd.exec:\jvdpd.exe43⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rrlrxrl.exec:\rrlrxrl.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nhnbhb.exec:\nhnbhb.exe45⤵
- Executes dropped EXE
PID:3512 -
\??\c:\pjvpp.exec:\pjvpp.exe46⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lffxrrl.exec:\lffxrrl.exe47⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nbtntt.exec:\nbtntt.exe48⤵
- Executes dropped EXE
PID:4804 -
\??\c:\nbnhbh.exec:\nbnhbh.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vdjdp.exec:\vdjdp.exe50⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rrrlllf.exec:\rrrlllf.exe51⤵
- Executes dropped EXE
PID:4160 -
\??\c:\ntnbtn.exec:\ntnbtn.exe52⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tthtnn.exec:\tthtnn.exe53⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1pjjj.exec:\1pjjj.exe54⤵
- Executes dropped EXE
PID:4208 -
\??\c:\xrfrlfr.exec:\xrfrlfr.exe55⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3tbtnh.exec:\3tbtnh.exe56⤵
- Executes dropped EXE
PID:224 -
\??\c:\vjjjv.exec:\vjjjv.exe57⤵
- Executes dropped EXE
PID:1296 -
\??\c:\pvvpd.exec:\pvvpd.exe58⤵
- Executes dropped EXE
PID:3184 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9tnnnn.exec:\9tnnnn.exe60⤵
- Executes dropped EXE
PID:1368 -
\??\c:\dvpjj.exec:\dvpjj.exe61⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xlllffx.exec:\xlllffx.exe62⤵
- Executes dropped EXE
PID:2444 -
\??\c:\frfxrrl.exec:\frfxrrl.exe63⤵
- Executes dropped EXE
PID:4904 -
\??\c:\bthhbb.exec:\bthhbb.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jpdjp.exec:\jpdjp.exe65⤵
- Executes dropped EXE
PID:5088 -
\??\c:\xxffffx.exec:\xxffffx.exe66⤵
- Executes dropped EXE
PID:4532 -
\??\c:\bnnbtn.exec:\bnnbtn.exe67⤵PID:4624
-
\??\c:\tttnnh.exec:\tttnnh.exe68⤵PID:4404
-
\??\c:\pvpvp.exec:\pvpvp.exe69⤵PID:3884
-
\??\c:\9xrfxxr.exec:\9xrfxxr.exe70⤵PID:4856
-
\??\c:\9bbnbb.exec:\9bbnbb.exe71⤵PID:536
-
\??\c:\nhnbtn.exec:\nhnbtn.exe72⤵PID:4436
-
\??\c:\jvjdd.exec:\jvjdd.exe73⤵PID:1720
-
\??\c:\3rxrfxr.exec:\3rxrfxr.exe74⤵PID:3644
-
\??\c:\vdpdj.exec:\vdpdj.exe75⤵PID:3304
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe76⤵PID:3432
-
\??\c:\xrffrrl.exec:\xrffrrl.exe77⤵PID:1932
-
\??\c:\tttbnn.exec:\tttbnn.exe78⤵PID:1448
-
\??\c:\pjjdv.exec:\pjjdv.exe79⤵PID:4428
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe80⤵PID:2796
-
\??\c:\flrlxrr.exec:\flrlxrr.exe81⤵PID:1756
-
\??\c:\9nhbbt.exec:\9nhbbt.exe82⤵PID:2980
-
\??\c:\jppdp.exec:\jppdp.exe83⤵PID:3348
-
\??\c:\vddvp.exec:\vddvp.exe84⤵PID:3240
-
\??\c:\fllffxx.exec:\fllffxx.exe85⤵PID:2232
-
\??\c:\rflxrll.exec:\rflxrll.exe86⤵PID:2132
-
\??\c:\3tnhbt.exec:\3tnhbt.exe87⤵PID:3724
-
\??\c:\9ppjd.exec:\9ppjd.exe88⤵PID:3856
-
\??\c:\9ddjv.exec:\9ddjv.exe89⤵PID:1540
-
\??\c:\rfxlffx.exec:\rfxlffx.exe90⤵PID:1488
-
\??\c:\lfrfxlx.exec:\lfrfxlx.exe91⤵PID:4372
-
\??\c:\nnnhtb.exec:\nnnhtb.exe92⤵PID:1624
-
\??\c:\jjpjd.exec:\jjpjd.exe93⤵PID:4356
-
\??\c:\ppppj.exec:\ppppj.exe94⤵PID:4348
-
\??\c:\lffrlfx.exec:\lffrlfx.exe95⤵PID:3228
-
\??\c:\nbnhtn.exec:\nbnhtn.exe96⤵PID:1528
-
\??\c:\tnbtnn.exec:\tnbtnn.exe97⤵PID:3524
-
\??\c:\dvvjd.exec:\dvvjd.exe98⤵PID:684
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe99⤵PID:5096
-
\??\c:\7rlxrrl.exec:\7rlxrrl.exe100⤵PID:4796
-
\??\c:\httnhh.exec:\httnhh.exe101⤵PID:1952
-
\??\c:\pvdvj.exec:\pvdvj.exe102⤵PID:4580
-
\??\c:\dvvjp.exec:\dvvjp.exe103⤵PID:1820
-
\??\c:\1rrffxl.exec:\1rrffxl.exe104⤵PID:2636
-
\??\c:\nbtnhh.exec:\nbtnhh.exe105⤵PID:4160
-
\??\c:\1tnhbt.exec:\1tnhbt.exe106⤵PID:1408
-
\??\c:\pdpjv.exec:\pdpjv.exe107⤵PID:2848
-
\??\c:\flllrrl.exec:\flllrrl.exe108⤵PID:2844
-
\??\c:\tnnhbb.exec:\tnnhbb.exe109⤵PID:2624
-
\??\c:\bbhhht.exec:\bbhhht.exe110⤵PID:676
-
\??\c:\pjjjd.exec:\pjjjd.exe111⤵PID:4144
-
\??\c:\lrxrffx.exec:\lrxrffx.exe112⤵PID:3316
-
\??\c:\hhhbtt.exec:\hhhbtt.exe113⤵PID:376
-
\??\c:\htnhtn.exec:\htnhtn.exe114⤵PID:4640
-
\??\c:\dvvpd.exec:\dvvpd.exe115⤵PID:4472
-
\??\c:\lrlrrrl.exec:\lrlrrrl.exe116⤵PID:4028
-
\??\c:\rllfxfx.exec:\rllfxfx.exe117⤵PID:4508
-
\??\c:\7nnttt.exec:\7nnttt.exe118⤵PID:3692
-
\??\c:\djvvp.exec:\djvvp.exe119⤵PID:3248
-
\??\c:\jdpdv.exec:\jdpdv.exe120⤵PID:760
-
\??\c:\rrxrrfx.exec:\rrxrrfx.exe121⤵PID:3736
-
\??\c:\bttnhb.exec:\bttnhb.exe122⤵PID:952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-