Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:42
Behavioral task
behavioral1
Sample
173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe
-
Size
440KB
-
MD5
173fa2409a1bfb3540085b864bb38330
-
SHA1
d20682d6e0716a1079c95194bcba46ccb1b367cf
-
SHA256
9e30bc0562efb2908f5944625616f7902c2ed24b1b5f909ce3473299a7f64488
-
SHA512
599599706ed4782707176baaceed23e7eab2a9836f4712c2ee3dfb6750a16ce9cecca9cd659c73ee5e3335b9117141019556a4e8d9faea95475945921d564889
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHt:kKxbNndhjEJd1kNpeUgI95yRoZHgoJM3
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/5104-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3948-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2396-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2572-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-28-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3720-38-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1848-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3692-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4304-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4496-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4424-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5020-71-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5020-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2600-79-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4332-94-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3724-101-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4220-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3600-108-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4756-133-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4244-149-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4604-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/540-161-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2312-168-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2828-173-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3100-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4712-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3860-195-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4760-205-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4404-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-217-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2440-224-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3260-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2120-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3328-236-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1900-240-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3336-244-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2832-249-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3664-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2260-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/220-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3028-276-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1032-281-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4708-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3084-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4756-322-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4508-333-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3032-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/636-352-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1084-356-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2968-381-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2780-406-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5100-416-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3420-472-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/636-501-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4188-524-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1100-631-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4716-632-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2948-646-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5016-656-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4436-694-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1176-707-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2084-773-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/936-840-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\bbtnht.exe family_berbew C:\1dvpj.exe family_berbew C:\xrxxfff.exe family_berbew C:\bbnnhn.exe family_berbew C:\frrffrx.exe family_berbew \??\c:\nnnnnn.exe family_berbew C:\pvjpj.exe family_berbew C:\tthbhh.exe family_berbew C:\tbbbhh.exe family_berbew C:\jdpdd.exe family_berbew C:\rflrrrr.exe family_berbew C:\5vdvp.exe family_berbew C:\vjddd.exe family_berbew \??\c:\1vvvp.exe family_berbew C:\thnbbt.exe family_berbew C:\pjdvp.exe family_berbew \??\c:\rfxrxrr.exe family_berbew \??\c:\jjvpd.exe family_berbew \??\c:\vvpjp.exe family_berbew C:\1rxrlrf.exe family_berbew \??\c:\ntnhnb.exe family_berbew \??\c:\ffffxxr.exe family_berbew C:\vdvpj.exe family_berbew \??\c:\thbbtn.exe family_berbew C:\jdvpd.exe family_berbew C:\lxxlllf.exe family_berbew \??\c:\pjpjd.exe family_berbew C:\lrrllrl.exe family_berbew \??\c:\bbbtnh.exe family_berbew C:\pdpjd.exe family_berbew C:\jdjdv.exe family_berbew C:\xfrrrrr.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
bbtnht.exe1dvpj.exexrxxfff.exebbnnhn.exefrrffrx.exennnnnn.exepvjpj.exetthbhh.exetbbbhh.exejdpdd.exerflrrrr.exe5vdvp.exevjddd.exe1vvvp.exethnbbt.exepjdvp.exerfxrxrr.exejjvpd.exevvpjp.exe1rxrlrf.exentnhnb.exeffffxxr.exevdvpj.exethbbtn.exejdvpd.exelxxlllf.exepjpjd.exelrrllrl.exebbbtnh.exepdpjd.exejdjdv.exexfrrrrr.exepvjdd.exefffxllx.exe5ttnbt.exedjpjd.exe3xxlxxr.exebnhhbb.exe5pjdp.exedjvpd.exe3xxrxxx.exetnhbbt.exevdpjp.exexlllfxl.exehbbtnn.exedpvpp.exerlrrrxx.exenthnnh.exe9rllfff.exebhnntt.exetttnnn.exerflfxxx.exehhbhtt.exedvpjj.exexfxxxxr.exennhhhb.exeddvpp.exelxffffx.exetbhbtt.exedvdvv.exeddpjj.exe7fllffr.exennnnhh.exeddvvv.exepid process 3948 bbtnht.exe 2396 1dvpj.exe 2572 xrxxfff.exe 1912 bbnnhn.exe 1848 frrffrx.exe 3720 nnnnnn.exe 3692 pvjpj.exe 4304 tthbhh.exe 4496 tbbbhh.exe 4424 jdpdd.exe 2032 rflrrrr.exe 5020 5vdvp.exe 2600 vjddd.exe 1860 1vvvp.exe 4332 thnbbt.exe 1092 pjdvp.exe 3724 rfxrxrr.exe 3600 jjvpd.exe 5084 vvpjp.exe 4220 1rxrlrf.exe 4068 ntnhnb.exe 4756 ffffxxr.exe 3228 vdvpj.exe 5076 thbbtn.exe 4520 jdvpd.exe 4244 lxxlllf.exe 4604 pjpjd.exe 540 lrrllrl.exe 2312 bbbtnh.exe 2828 pdpjd.exe 3100 jdjdv.exe 4712 xfrrrrr.exe 4812 pvjdd.exe 3860 fffxllx.exe 3292 5ttnbt.exe 3944 djpjd.exe 4760 3xxlxxr.exe 2812 bnhhbb.exe 3348 5pjdp.exe 4988 djvpd.exe 3708 3xxrxxx.exe 2440 tnhbbt.exe 3260 vdpjp.exe 2120 xlllfxl.exe 3328 hbbtnn.exe 1900 dpvpp.exe 3336 rlrrrxx.exe 3472 nthnnh.exe 2832 9rllfff.exe 4948 bhnntt.exe 2464 tttnnn.exe 4304 rflfxxx.exe 3664 hhbhtt.exe 2260 dvpjj.exe 220 xfxxxxr.exe 3276 nnhhhb.exe 3028 ddvpp.exe 1032 lxffffx.exe 3964 tbhbtt.exe 4708 dvdvv.exe 3084 ddpjj.exe 536 7fllffr.exe 4588 nnnnhh.exe 4128 ddvvv.exe -
Processes:
resource yara_rule behavioral2/memory/5104-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5104-6-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3948-8-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bbtnht.exe upx C:\1dvpj.exe upx behavioral2/memory/2396-13-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrxxfff.exe upx behavioral2/memory/2396-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2572-20-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\bbnnhn.exe upx behavioral2/memory/1912-28-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\frrffrx.exe upx behavioral2/memory/1848-31-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnnnnn.exe upx behavioral2/memory/3720-38-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1848-36-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pvjpj.exe upx C:\tthbhh.exe upx behavioral2/memory/3692-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4304-51-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tbbbhh.exe upx C:\jdpdd.exe upx behavioral2/memory/4496-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4424-60-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rflrrrr.exe upx C:\5vdvp.exe upx behavioral2/memory/5020-71-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\vjddd.exe upx behavioral2/memory/5020-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2600-79-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1vvvp.exe upx C:\thnbbt.exe upx C:\pjdvp.exe upx behavioral2/memory/4332-94-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rfxrxrr.exe upx behavioral2/memory/3724-101-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\jjvpd.exe upx \??\c:\vvpjp.exe upx C:\1rxrlrf.exe upx behavioral2/memory/4220-118-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ntnhnb.exe upx behavioral2/memory/3600-108-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\ffffxxr.exe upx C:\vdvpj.exe upx behavioral2/memory/4756-133-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\thbbtn.exe upx C:\jdvpd.exe upx C:\lxxlllf.exe upx behavioral2/memory/4244-149-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\pjpjd.exe upx behavioral2/memory/4604-156-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lrrllrl.exe upx behavioral2/memory/540-161-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bbbtnh.exe upx behavioral2/memory/2312-168-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pdpjd.exe upx behavioral2/memory/2828-173-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jdjdv.exe upx behavioral2/memory/3100-182-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xfrrrrr.exe upx behavioral2/memory/4712-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3860-195-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4760-205-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4404-210-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exebbtnht.exe1dvpj.exexrxxfff.exebbnnhn.exefrrffrx.exennnnnn.exepvjpj.exetthbhh.exetbbbhh.exejdpdd.exerflrrrr.exe5vdvp.exevjddd.exe1vvvp.exethnbbt.exepjdvp.exerfxrxrr.exejjvpd.exevvpjp.exe1rxrlrf.exentnhnb.exedescription pid process target process PID 5104 wrote to memory of 3948 5104 173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe bbtnht.exe PID 5104 wrote to memory of 3948 5104 173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe bbtnht.exe PID 5104 wrote to memory of 3948 5104 173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe bbtnht.exe PID 3948 wrote to memory of 2396 3948 bbtnht.exe 1dvpj.exe PID 3948 wrote to memory of 2396 3948 bbtnht.exe 1dvpj.exe PID 3948 wrote to memory of 2396 3948 bbtnht.exe 1dvpj.exe PID 2396 wrote to memory of 2572 2396 1dvpj.exe xrxxfff.exe PID 2396 wrote to memory of 2572 2396 1dvpj.exe xrxxfff.exe PID 2396 wrote to memory of 2572 2396 1dvpj.exe xrxxfff.exe PID 2572 wrote to memory of 1912 2572 xrxxfff.exe bbnnhn.exe PID 2572 wrote to memory of 1912 2572 xrxxfff.exe bbnnhn.exe PID 2572 wrote to memory of 1912 2572 xrxxfff.exe bbnnhn.exe PID 1912 wrote to memory of 1848 1912 bbnnhn.exe frrffrx.exe PID 1912 wrote to memory of 1848 1912 bbnnhn.exe frrffrx.exe PID 1912 wrote to memory of 1848 1912 bbnnhn.exe frrffrx.exe PID 1848 wrote to memory of 3720 1848 frrffrx.exe nnnnnn.exe PID 1848 wrote to memory of 3720 1848 frrffrx.exe nnnnnn.exe PID 1848 wrote to memory of 3720 1848 frrffrx.exe nnnnnn.exe PID 3720 wrote to memory of 3692 3720 nnnnnn.exe pvjpj.exe PID 3720 wrote to memory of 3692 3720 nnnnnn.exe pvjpj.exe PID 3720 wrote to memory of 3692 3720 nnnnnn.exe pvjpj.exe PID 3692 wrote to memory of 4304 3692 pvjpj.exe tthbhh.exe PID 3692 wrote to memory of 4304 3692 pvjpj.exe tthbhh.exe PID 3692 wrote to memory of 4304 3692 pvjpj.exe tthbhh.exe PID 4304 wrote to memory of 4496 4304 tthbhh.exe tbbbhh.exe PID 4304 wrote to memory of 4496 4304 tthbhh.exe tbbbhh.exe PID 4304 wrote to memory of 4496 4304 tthbhh.exe tbbbhh.exe PID 4496 wrote to memory of 4424 4496 tbbbhh.exe jdpdd.exe PID 4496 wrote to memory of 4424 4496 tbbbhh.exe jdpdd.exe PID 4496 wrote to memory of 4424 4496 tbbbhh.exe jdpdd.exe PID 4424 wrote to memory of 2032 4424 jdpdd.exe rflrrrr.exe PID 4424 wrote to memory of 2032 4424 jdpdd.exe rflrrrr.exe PID 4424 wrote to memory of 2032 4424 jdpdd.exe rflrrrr.exe PID 2032 wrote to memory of 5020 2032 rflrrrr.exe 5vdvp.exe PID 2032 wrote to memory of 5020 2032 rflrrrr.exe 5vdvp.exe PID 2032 wrote to memory of 5020 2032 rflrrrr.exe 5vdvp.exe PID 5020 wrote to memory of 2600 5020 5vdvp.exe vjddd.exe PID 5020 wrote to memory of 2600 5020 5vdvp.exe vjddd.exe PID 5020 wrote to memory of 2600 5020 5vdvp.exe vjddd.exe PID 2600 wrote to memory of 1860 2600 vjddd.exe 1vvvp.exe PID 2600 wrote to memory of 1860 2600 vjddd.exe 1vvvp.exe PID 2600 wrote to memory of 1860 2600 vjddd.exe 1vvvp.exe PID 1860 wrote to memory of 4332 1860 1vvvp.exe thnbbt.exe PID 1860 wrote to memory of 4332 1860 1vvvp.exe thnbbt.exe PID 1860 wrote to memory of 4332 1860 1vvvp.exe thnbbt.exe PID 4332 wrote to memory of 1092 4332 thnbbt.exe pjdvp.exe PID 4332 wrote to memory of 1092 4332 thnbbt.exe pjdvp.exe PID 4332 wrote to memory of 1092 4332 thnbbt.exe pjdvp.exe PID 1092 wrote to memory of 3724 1092 pjdvp.exe rfxrxrr.exe PID 1092 wrote to memory of 3724 1092 pjdvp.exe rfxrxrr.exe PID 1092 wrote to memory of 3724 1092 pjdvp.exe rfxrxrr.exe PID 3724 wrote to memory of 3600 3724 rfxrxrr.exe jjvpd.exe PID 3724 wrote to memory of 3600 3724 rfxrxrr.exe jjvpd.exe PID 3724 wrote to memory of 3600 3724 rfxrxrr.exe jjvpd.exe PID 3600 wrote to memory of 5084 3600 jjvpd.exe vvpjp.exe PID 3600 wrote to memory of 5084 3600 jjvpd.exe vvpjp.exe PID 3600 wrote to memory of 5084 3600 jjvpd.exe vvpjp.exe PID 5084 wrote to memory of 4220 5084 vvpjp.exe 1rxrlrf.exe PID 5084 wrote to memory of 4220 5084 vvpjp.exe 1rxrlrf.exe PID 5084 wrote to memory of 4220 5084 vvpjp.exe 1rxrlrf.exe PID 4220 wrote to memory of 4068 4220 1rxrlrf.exe ntnhnb.exe PID 4220 wrote to memory of 4068 4220 1rxrlrf.exe ntnhnb.exe PID 4220 wrote to memory of 4068 4220 1rxrlrf.exe ntnhnb.exe PID 4068 wrote to memory of 4756 4068 ntnhnb.exe ffffxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\173fa2409a1bfb3540085b864bb38330_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\bbtnht.exec:\bbtnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\1dvpj.exec:\1dvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\xrxxfff.exec:\xrxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbnnhn.exec:\bbnnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\frrffrx.exec:\frrffrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\nnnnnn.exec:\nnnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\pvjpj.exec:\pvjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\tthbhh.exec:\tthbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\tbbbhh.exec:\tbbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\jdpdd.exec:\jdpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\rflrrrr.exec:\rflrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\5vdvp.exec:\5vdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\vjddd.exec:\vjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1vvvp.exec:\1vvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\thnbbt.exec:\thnbbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\pjdvp.exec:\pjdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\rfxrxrr.exec:\rfxrxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\jjvpd.exec:\jjvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\vvpjp.exec:\vvpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\1rxrlrf.exec:\1rxrlrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\ntnhnb.exec:\ntnhnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\ffffxxr.exec:\ffffxxr.exe23⤵
- Executes dropped EXE
PID:4756 -
\??\c:\vdvpj.exec:\vdvpj.exe24⤵
- Executes dropped EXE
PID:3228 -
\??\c:\thbbtn.exec:\thbbtn.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jdvpd.exec:\jdvpd.exe26⤵
- Executes dropped EXE
PID:4520 -
\??\c:\lxxlllf.exec:\lxxlllf.exe27⤵
- Executes dropped EXE
PID:4244 -
\??\c:\pjpjd.exec:\pjpjd.exe28⤵
- Executes dropped EXE
PID:4604 -
\??\c:\lrrllrl.exec:\lrrllrl.exe29⤵
- Executes dropped EXE
PID:540 -
\??\c:\bbbtnh.exec:\bbbtnh.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pdpjd.exec:\pdpjd.exe31⤵
- Executes dropped EXE
PID:2828 -
\??\c:\jdjdv.exec:\jdjdv.exe32⤵
- Executes dropped EXE
PID:3100 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe33⤵
- Executes dropped EXE
PID:4712 -
\??\c:\pvjdd.exec:\pvjdd.exe34⤵
- Executes dropped EXE
PID:4812 -
\??\c:\fffxllx.exec:\fffxllx.exe35⤵
- Executes dropped EXE
PID:3860 -
\??\c:\5ttnbt.exec:\5ttnbt.exe36⤵
- Executes dropped EXE
PID:3292 -
\??\c:\djpjd.exec:\djpjd.exe37⤵
- Executes dropped EXE
PID:3944 -
\??\c:\3xxlxxr.exec:\3xxlxxr.exe38⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bnhhbb.exec:\bnhhbb.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5pjdp.exec:\5pjdp.exe40⤵
- Executes dropped EXE
PID:3348 -
\??\c:\nnbbnb.exec:\nnbbnb.exe41⤵PID:4404
-
\??\c:\djvpd.exec:\djvpd.exe42⤵
- Executes dropped EXE
PID:4988 -
\??\c:\3xxrxxx.exec:\3xxrxxx.exe43⤵
- Executes dropped EXE
PID:3708 -
\??\c:\tnhbbt.exec:\tnhbbt.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vdpjp.exec:\vdpjp.exe45⤵
- Executes dropped EXE
PID:3260 -
\??\c:\xlllfxl.exec:\xlllfxl.exe46⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbbtnn.exec:\hbbtnn.exe47⤵
- Executes dropped EXE
PID:3328 -
\??\c:\dpvpp.exec:\dpvpp.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe49⤵
- Executes dropped EXE
PID:3336 -
\??\c:\nthnnh.exec:\nthnnh.exe50⤵
- Executes dropped EXE
PID:3472 -
\??\c:\9rllfff.exec:\9rllfff.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bhnntt.exec:\bhnntt.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\tttnnn.exec:\tttnnn.exe53⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rflfxxx.exec:\rflfxxx.exe54⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hhbhtt.exec:\hhbhtt.exe55⤵
- Executes dropped EXE
PID:3664 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xfxxxxr.exec:\xfxxxxr.exe57⤵
- Executes dropped EXE
PID:220 -
\??\c:\nnhhhb.exec:\nnhhhb.exe58⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ddvpp.exec:\ddvpp.exe59⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxffffx.exec:\lxffffx.exe60⤵
- Executes dropped EXE
PID:1032 -
\??\c:\tbhbtt.exec:\tbhbtt.exe61⤵
- Executes dropped EXE
PID:3964 -
\??\c:\dvdvv.exec:\dvdvv.exe62⤵
- Executes dropped EXE
PID:4708 -
\??\c:\ddpjj.exec:\ddpjj.exe63⤵
- Executes dropped EXE
PID:3084 -
\??\c:\7fllffr.exec:\7fllffr.exe64⤵
- Executes dropped EXE
PID:536 -
\??\c:\nnnnhh.exec:\nnnnhh.exe65⤵
- Executes dropped EXE
PID:4588 -
\??\c:\ddvvv.exec:\ddvvv.exe66⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rxrxxlx.exec:\rxrxxlx.exe67⤵PID:4268
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:4892
-
\??\c:\fllffff.exec:\fllffff.exe69⤵PID:3988
-
\??\c:\nbbtnn.exec:\nbbtnn.exe70⤵PID:1252
-
\??\c:\bbhhhh.exec:\bbhhhh.exe71⤵PID:3540
-
\??\c:\pjddj.exec:\pjddj.exe72⤵PID:4756
-
\??\c:\rxxrffx.exec:\rxxrffx.exe73⤵PID:3228
-
\??\c:\nbtttt.exec:\nbtttt.exe74⤵PID:1972
-
\??\c:\jpjdv.exec:\jpjdv.exe75⤵PID:4508
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe76⤵PID:3032
-
\??\c:\llflrxl.exec:\llflrxl.exe77⤵PID:3132
-
\??\c:\tttnnn.exec:\tttnnn.exe78⤵PID:3896
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵PID:3740
-
\??\c:\rlflfrl.exec:\rlflfrl.exe80⤵PID:636
-
\??\c:\9ntnhh.exec:\9ntnhh.exe81⤵PID:1084
-
\??\c:\vvpjj.exec:\vvpjj.exe82⤵PID:5012
-
\??\c:\9pdvp.exec:\9pdvp.exe83⤵PID:1432
-
\??\c:\rlllflf.exec:\rlllflf.exe84⤵PID:4504
-
\??\c:\nhhhnh.exec:\nhhhnh.exe85⤵PID:2244
-
\??\c:\9ntnhh.exec:\9ntnhh.exe86⤵PID:772
-
\??\c:\dvjdv.exec:\dvjdv.exe87⤵PID:4576
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe88⤵PID:2400
-
\??\c:\bntnhh.exec:\bntnhh.exe89⤵PID:2968
-
\??\c:\bbnntb.exec:\bbnntb.exe90⤵PID:3444
-
\??\c:\5jvpv.exec:\5jvpv.exe91⤵PID:2204
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe92⤵PID:4352
-
\??\c:\lrllllf.exec:\lrllllf.exe93⤵PID:1192
-
\??\c:\tthbtt.exec:\tthbtt.exe94⤵PID:2680
-
\??\c:\dpjjd.exec:\dpjjd.exe95⤵PID:3900
-
\??\c:\rlrfxxr.exec:\rlrfxxr.exe96⤵PID:896
-
\??\c:\nnnnnt.exec:\nnnnnt.exe97⤵PID:2780
-
\??\c:\bnhhbb.exec:\bnhhbb.exe98⤵PID:3340
-
\??\c:\jddjp.exec:\jddjp.exe99⤵PID:4444
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe100⤵PID:5100
-
\??\c:\3tbbtb.exec:\3tbbtb.exe101⤵PID:2188
-
\??\c:\hbnhhh.exec:\hbnhhh.exe102⤵PID:1332
-
\??\c:\jjpjj.exec:\jjpjj.exe103⤵PID:2464
-
\??\c:\rlrlllf.exec:\rlrlllf.exe104⤵PID:4304
-
\??\c:\hhhbbt.exec:\hhhbbt.exe105⤵PID:3664
-
\??\c:\3nhnhh.exec:\3nhnhh.exe106⤵PID:4140
-
\??\c:\vvjdv.exec:\vvjdv.exe107⤵PID:1988
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe108⤵PID:408
-
\??\c:\xrrlllf.exec:\xrrlllf.exe109⤵PID:1036
-
\??\c:\3ttnhn.exec:\3ttnhn.exe110⤵PID:5072
-
\??\c:\1vdvp.exec:\1vdvp.exe111⤵PID:4332
-
\??\c:\1rfxffl.exec:\1rfxffl.exe112⤵PID:4572
-
\??\c:\hhbbtt.exec:\hhbbtt.exe113⤵PID:3600
-
\??\c:\nbhbbb.exec:\nbhbbb.exe114⤵PID:4916
-
\??\c:\1dvpj.exec:\1dvpj.exe115⤵PID:4268
-
\??\c:\fxlrxrl.exec:\fxlrxrl.exe116⤵PID:4892
-
\??\c:\bhnnnn.exec:\bhnnnn.exe117⤵PID:3988
-
\??\c:\3nttbn.exec:\3nttbn.exe118⤵PID:3420
-
\??\c:\jjdvp.exec:\jjdvp.exe119⤵PID:1108
-
\??\c:\rlxlxrr.exec:\rlxlxrr.exe120⤵PID:2944
-
\??\c:\frfxrrl.exec:\frfxrrl.exe121⤵PID:5076
-
\??\c:\bbbtnh.exec:\bbbtnh.exe122⤵PID:4184
-
\??\c:\9jppd.exec:\9jppd.exe123⤵PID:5112
-
\??\c:\vjvdd.exec:\vjvdd.exe124⤵PID:2948
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe125⤵PID:3132
-
\??\c:\nhnhhh.exec:\nhnhhh.exe126⤵PID:3064
-
\??\c:\3pvpd.exec:\3pvpd.exe127⤵PID:540
-
\??\c:\rlxxrll.exec:\rlxxrll.exe128⤵PID:636
-
\??\c:\thnnnn.exec:\thnnnn.exe129⤵PID:1084
-
\??\c:\btttnn.exec:\btttnn.exe130⤵PID:1612
-
\??\c:\7pjjd.exec:\7pjjd.exe131⤵PID:1588
-
\??\c:\nnnhbb.exec:\nnnhbb.exe132⤵PID:3040
-
\??\c:\thnnnn.exec:\thnnnn.exe133⤵PID:2244
-
\??\c:\jdjdp.exec:\jdjdp.exe134⤵PID:4188
-
\??\c:\lflfxxl.exec:\lflfxxl.exe135⤵PID:4612
-
\??\c:\5ttnhh.exec:\5ttnhh.exe136⤵PID:1792
-
\??\c:\9hnhtt.exec:\9hnhtt.exe137⤵PID:1688
-
\??\c:\xxrrllf.exec:\xxrrllf.exe138⤵PID:4324
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe139⤵PID:3348
-
\??\c:\thtbtb.exec:\thtbtb.exe140⤵PID:5104
-
\??\c:\vpppj.exec:\vpppj.exe141⤵PID:1192
-
\??\c:\5rxxxfx.exec:\5rxxxfx.exe142⤵PID:4796
-
\??\c:\hthbtt.exec:\hthbtt.exe143⤵PID:3588
-
\??\c:\tbnhtb.exec:\tbnhtb.exe144⤵PID:2192
-
\??\c:\jdvvj.exec:\jdvvj.exe145⤵PID:2104
-
\??\c:\9xfrffx.exec:\9xfrffx.exe146⤵PID:3340
-
\??\c:\hhttnt.exec:\hhttnt.exe147⤵PID:4388
-
\??\c:\jdpdd.exec:\jdpdd.exe148⤵PID:4636
-
\??\c:\7vvpj.exec:\7vvpj.exe149⤵PID:3504
-
\??\c:\xxffxxr.exec:\xxffxxr.exe150⤵PID:1332
-
\??\c:\7tbtbb.exec:\7tbtbb.exe151⤵PID:2464
-
\??\c:\dvppp.exec:\dvppp.exe152⤵PID:5036
-
\??\c:\1lllfll.exec:\1lllfll.exe153⤵PID:2324
-
\??\c:\1xfflrx.exec:\1xfflrx.exe154⤵PID:2032
-
\??\c:\nnbbtt.exec:\nnbbtt.exe155⤵PID:3252
-
\??\c:\jvvvv.exec:\jvvvv.exe156⤵PID:2540
-
\??\c:\fxflllf.exec:\fxflllf.exe157⤵PID:4272
-
\??\c:\nbnnnt.exec:\nbnnnt.exe158⤵PID:4608
-
\??\c:\djjvp.exec:\djjvp.exe159⤵PID:3828
-
\??\c:\jvdvp.exec:\jvdvp.exe160⤵PID:4460
-
\??\c:\lllrrxr.exec:\lllrrxr.exe161⤵PID:3724
-
\??\c:\btnhhn.exec:\btnhhn.exe162⤵PID:4048
-
\??\c:\pdpjj.exec:\pdpjj.exe163⤵PID:3468
-
\??\c:\xlxrlrr.exec:\xlxrlrr.exe164⤵PID:3600
-
\??\c:\bbhntt.exec:\bbhntt.exe165⤵PID:744
-
\??\c:\vddvj.exec:\vddvj.exe166⤵PID:1184
-
\??\c:\ffffxxx.exec:\ffffxxx.exe167⤵PID:996
-
\??\c:\5rrrllf.exec:\5rrrllf.exe168⤵PID:3232
-
\??\c:\7bnhhn.exec:\7bnhhn.exe169⤵PID:1536
-
\??\c:\1hnhbb.exec:\1hnhbb.exe170⤵PID:1100
-
\??\c:\5djdv.exec:\5djdv.exe171⤵PID:4716
-
\??\c:\3tbtnb.exec:\3tbtnb.exe172⤵PID:5076
-
\??\c:\5ddjd.exec:\5ddjd.exe173⤵PID:1016
-
\??\c:\vjjvj.exec:\vjjvj.exe174⤵PID:3032
-
\??\c:\7xxfxfl.exec:\7xxfxfl.exe175⤵PID:2948
-
\??\c:\hthbnn.exec:\hthbnn.exe176⤵PID:3132
-
\??\c:\jddvv.exec:\jddvv.exe177⤵PID:5016
-
\??\c:\dpvpp.exec:\dpvpp.exe178⤵PID:540
-
\??\c:\rlrrrfl.exec:\rlrrrfl.exe179⤵PID:2828
-
\??\c:\bnhtbb.exec:\bnhtbb.exe180⤵PID:1368
-
\??\c:\vjjjj.exec:\vjjjj.exe181⤵PID:2592
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe182⤵PID:2184
-
\??\c:\tntnnn.exec:\tntnnn.exe183⤵PID:3756
-
\??\c:\pdjjj.exec:\pdjjj.exe184⤵PID:2244
-
\??\c:\llxxfff.exec:\llxxfff.exe185⤵PID:2460
-
\??\c:\rrxllll.exec:\rrxllll.exe186⤵PID:3444
-
\??\c:\jpddd.exec:\jpddd.exe187⤵PID:1688
-
\??\c:\9jjdp.exec:\9jjdp.exe188⤵PID:4324
-
\??\c:\lllrlfx.exec:\lllrlfx.exe189⤵PID:240
-
\??\c:\nnhtnn.exec:\nnhtnn.exe190⤵PID:4436
-
\??\c:\hhhtnh.exec:\hhhtnh.exe191⤵PID:4392
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe192⤵PID:2092
-
\??\c:\7frrxlr.exec:\7frrxlr.exe193⤵PID:116
-
\??\c:\hbnttn.exec:\hbnttn.exe194⤵PID:1176
-
\??\c:\5jjpd.exec:\5jjpd.exe195⤵PID:4364
-
\??\c:\vdppj.exec:\vdppj.exe196⤵PID:2416
-
\??\c:\ffrxxxx.exec:\ffrxxxx.exe197⤵PID:2044
-
\??\c:\7ntnhh.exec:\7ntnhh.exe198⤵PID:4472
-
\??\c:\ppvvd.exec:\ppvvd.exe199⤵PID:640
-
\??\c:\rlxxlxr.exec:\rlxxlxr.exe200⤵PID:2284
-
\??\c:\bnbbtt.exec:\bnbbtt.exe201⤵PID:2252
-
\??\c:\nhhbnb.exec:\nhhbnb.exe202⤵PID:1196
-
\??\c:\pjvpp.exec:\pjvpp.exe203⤵PID:3312
-
\??\c:\fxlllfl.exec:\fxlllfl.exe204⤵PID:3964
-
\??\c:\ntbttt.exec:\ntbttt.exe205⤵PID:1256
-
\??\c:\htbttt.exec:\htbttt.exe206⤵PID:3084
-
\??\c:\5jdvj.exec:\5jdvj.exe207⤵PID:392
-
\??\c:\rrffrxf.exec:\rrffrxf.exe208⤵PID:3268
-
\??\c:\5xrlffx.exec:\5xrlffx.exe209⤵PID:4128
-
\??\c:\tbnnnn.exec:\tbnnnn.exe210⤵PID:3840
-
\??\c:\dvpjv.exec:\dvpjv.exe211⤵PID:1412
-
\??\c:\xlrllrr.exec:\xlrllrr.exe212⤵PID:1540
-
\??\c:\1rxrllf.exec:\1rxrllf.exe213⤵PID:452
-
\??\c:\tntnnh.exec:\tntnnh.exe214⤵PID:4060
-
\??\c:\pjppv.exec:\pjppv.exe215⤵PID:3520
-
\??\c:\dvdvp.exec:\dvdvp.exe216⤵PID:2084
-
\??\c:\lrxfrlf.exec:\lrxfrlf.exe217⤵PID:396
-
\??\c:\tnbbbh.exec:\tnbbbh.exe218⤵PID:3212
-
\??\c:\3jjdv.exec:\3jjdv.exe219⤵PID:2944
-
\??\c:\pjpdj.exec:\pjpdj.exe220⤵PID:2352
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe221⤵PID:2276
-
\??\c:\hthtnt.exec:\hthtnt.exe222⤵PID:3768
-
\??\c:\jdvpd.exec:\jdvpd.exe223⤵PID:1016
-
\??\c:\jjddd.exec:\jjddd.exe224⤵PID:3896
-
\??\c:\ntntnt.exec:\ntntnt.exe225⤵PID:3740
-
\??\c:\pjjpj.exec:\pjjpj.exe226⤵PID:4664
-
\??\c:\9jpjv.exec:\9jpjv.exe227⤵PID:3464
-
\??\c:\5flfllr.exec:\5flfllr.exe228⤵PID:5012
-
\??\c:\bnbttn.exec:\bnbttn.exe229⤵PID:3140
-
\??\c:\dvvpp.exec:\dvvpp.exe230⤵PID:3244
-
\??\c:\vvdvv.exec:\vvdvv.exe231⤵PID:4712
-
\??\c:\xxllllf.exec:\xxllllf.exe232⤵PID:2184
-
\??\c:\thbttt.exec:\thbttt.exe233⤵PID:4188
-
\??\c:\5pvjp.exec:\5pvjp.exe234⤵PID:3580
-
\??\c:\vpdvj.exec:\vpdvj.exe235⤵PID:4340
-
\??\c:\xfrrlff.exec:\xfrrlff.exe236⤵PID:2204
-
\??\c:\nnhnnb.exec:\nnhnnb.exe237⤵PID:936
-
\??\c:\jjjvv.exec:\jjjvv.exe238⤵PID:824
-
\??\c:\xrffxfx.exec:\xrffxfx.exe239⤵PID:2680
-
\??\c:\lffxxrr.exec:\lffxxrr.exe240⤵PID:3880
-
\??\c:\hbbbtt.exec:\hbbbtt.exe241⤵PID:4796
-
\??\c:\ddjjv.exec:\ddjjv.exe242⤵PID:1080