Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 01:51
Behavioral task
behavioral1
Sample
700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe
- Size 441KB
- Sample240518-b98skaef99
- SHA256 ab78cf4d1ed1892d5019510210cf181d8bc2cae6e6b71d6b45f984a1a1b66168
- MD5 700687b1755a8dd043b5c08640f4d490
- SHA1 075a22cb5a9342f1f8d63b14857c99ea4ce017b9
- SHA512 c483cd1ea26d6174eb80379aa33f05d013adfbc4b9ef22ff76f545fa143e8de9824fd6ac997aec625d7a31d3ea41d84efab279477c18d61f1058ff706ee036f9
- SSDEEP 12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmH/:kKxbNndhjEJd1kNpeUgI95yRoZHgoJM1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1364-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4816-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2616-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4328-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3812-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1232-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2268-44-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3804-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1872-66-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1648-62-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1636-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3060-83-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/768-97-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4576-103-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2836-109-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1028-121-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1440-129-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5096-128-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2908-146-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2384-134-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/692-167-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2424-175-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2688-188-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2428-189-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2540-197-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1008-201-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1088-207-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2004-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1096-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/668-225-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4312-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4288-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-237-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3340-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-261-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4724-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1228-269-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4564-276-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5032-282-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2020-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4744-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3172-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2336-304-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/452-311-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4224-339-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/224-367-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-415-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1576-428-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3016-456-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4684-464-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4332-494-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1364-498-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4140-514-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4288-518-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1352-528-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4472-544-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4016-557-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/32-588-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4216-595-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3108-641-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4492-667-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4544-686-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2140-708-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4804-766-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000600000002328f-3.dat family_berbew behavioral2/files/0x000800000002340f-9.dat family_berbew behavioral2/files/0x0007000000023413-14.dat family_berbew behavioral2/files/0x0007000000023414-23.dat family_berbew behavioral2/files/0x0007000000023415-28.dat family_berbew behavioral2/files/0x0007000000023416-33.dat family_berbew behavioral2/files/0x0007000000023418-40.dat family_berbew behavioral2/files/0x0007000000023419-47.dat family_berbew behavioral2/files/0x000700000002341a-52.dat family_berbew behavioral2/files/0x000700000002341b-57.dat family_berbew behavioral2/files/0x000700000002341c-64.dat family_berbew behavioral2/files/0x000700000002341d-68.dat family_berbew behavioral2/files/0x000700000002341f-74.dat family_berbew behavioral2/files/0x0007000000023421-86.dat family_berbew behavioral2/files/0x0008000000023410-91.dat family_berbew behavioral2/files/0x0007000000023420-80.dat family_berbew behavioral2/files/0x0007000000023422-95.dat family_berbew behavioral2/files/0x0007000000023423-101.dat family_berbew behavioral2/files/0x0007000000023424-107.dat family_berbew behavioral2/files/0x0007000000023425-113.dat family_berbew behavioral2/files/0x0007000000023426-118.dat family_berbew behavioral2/files/0x0007000000023427-126.dat family_berbew behavioral2/files/0x0007000000023428-132.dat family_berbew behavioral2/files/0x0007000000023429-139.dat family_berbew behavioral2/files/0x000700000002342a-144.dat family_berbew behavioral2/files/0x000700000002342b-150.dat family_berbew behavioral2/files/0x000700000002342c-156.dat family_berbew behavioral2/files/0x000700000002342d-160.dat family_berbew behavioral2/files/0x000700000002342e-165.dat family_berbew behavioral2/files/0x000700000002342f-172.dat family_berbew behavioral2/files/0x0007000000023430-178.dat family_berbew behavioral2/files/0x0007000000023431-183.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3812 9bhbtt.exe 4328 vjpjd.exe 4816 vppjv.exe 2616 rrxxflf.exe 1232 hnttnn.exe 3804 ddjjj.exe 2268 vvvvd.exe 4512 lfllrxl.exe 1352 ttthbb.exe 1648 bnttbb.exe 1872 hbtnbb.exe 1928 vvjjj.exe 1636 3xxrrxx.exe 3060 hnhntb.exe 432 xlxrlff.exe 768 ddppv.exe 4576 pvvvp.exe 2836 tbtbtn.exe 3896 rrxrrfx.exe 1028 ddvvj.exe 5096 xllfffx.exe 1440 ttbttt.exe 2384 jjppj.exe 5004 rllfffx.exe 2908 hntttt.exe 2128 7vvpd.exe 4284 lrlxrfl.exe 692 djppv.exe 3864 jdjvd.exe 2424 xlrrxxx.exe 3968 5hbbtt.exe 2688 5vdvp.exe 2428 vjppv.exe 2212 fxlfrrf.exe 2540 thtnht.exe 1008 jdjdj.exe 1088 fxxrfrf.exe 4332 bhthhn.exe 5044 ddvjj.exe 2004 lrxxfff.exe 1096 7nttnn.exe 668 pjdvd.exe 4312 lfrfxfr.exe 4288 1rlfxfx.exe 3468 hthhbh.exe 4772 pjvvj.exe 3804 xlffxlr.exe 3340 9vddd.exe 3568 flllflr.exe 4944 ttbhhh.exe 4444 pdvvp.exe 4764 rlrrrrl.exe 4988 thbtnn.exe 4724 tnnhhb.exe 1228 dddvv.exe 3060 rrxxxxx.exe 4564 7hbtnt.exe 5032 1nntnh.exe 2020 xlrrfll.exe 4744 nnnhhb.exe 3172 3dppv.exe 4548 rllllxx.exe 1620 djvjd.exe 2336 5bbtnn.exe -
resource yara_rule behavioral2/memory/1364-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000600000002328f-3.dat upx behavioral2/memory/1364-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002340f-9.dat upx behavioral2/files/0x0007000000023413-14.dat upx behavioral2/memory/4816-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-23.dat upx behavioral2/files/0x0007000000023415-28.dat upx behavioral2/files/0x0007000000023416-33.dat upx behavioral2/memory/2616-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4328-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3812-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1232-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023418-40.dat upx behavioral2/memory/2268-44-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023419-47.dat upx behavioral2/files/0x000700000002341a-52.dat upx behavioral2/memory/3804-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341b-57.dat upx behavioral2/files/0x000700000002341c-64.dat upx behavioral2/memory/1872-66-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1648-62-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341d-68.dat upx behavioral2/files/0x000700000002341f-74.dat upx behavioral2/memory/1636-75-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023421-86.dat upx behavioral2/files/0x0008000000023410-91.dat upx behavioral2/memory/3060-83-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023420-80.dat upx behavioral2/files/0x0007000000023422-95.dat upx behavioral2/memory/768-97-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023423-101.dat upx behavioral2/memory/4576-103-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023424-107.dat upx behavioral2/memory/2836-109-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023425-113.dat upx behavioral2/files/0x0007000000023426-118.dat upx behavioral2/memory/1028-121-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5096-122-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023427-126.dat upx behavioral2/memory/1440-129-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5096-128-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023428-132.dat upx behavioral2/files/0x0007000000023429-139.dat upx behavioral2/files/0x000700000002342a-144.dat upx behavioral2/files/0x000700000002342b-150.dat upx behavioral2/memory/2908-146-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2384-134-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2128-151-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342c-156.dat upx behavioral2/files/0x000700000002342d-160.dat upx behavioral2/files/0x000700000002342e-165.dat upx behavioral2/memory/692-167-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342f-172.dat upx behavioral2/memory/2424-175-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023430-178.dat upx behavioral2/files/0x0007000000023431-183.dat upx behavioral2/memory/2688-188-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2428-189-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2540-197-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1008-201-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1088-207-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2004-215-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1096-219-0x0000000000400000-0x0000000000434000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1364 wrote to memory of 3812 1364 700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe 84 PID 1364 wrote to memory of 3812 1364 700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe 84 PID 1364 wrote to memory of 3812 1364 700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe 84 PID 3812 wrote to memory of 4328 3812 9bhbtt.exe 85 PID 3812 wrote to memory of 4328 3812 9bhbtt.exe 85 PID 3812 wrote to memory of 4328 3812 9bhbtt.exe 85 PID 4328 wrote to memory of 4816 4328 vjpjd.exe 86 PID 4328 wrote to memory of 4816 4328 vjpjd.exe 86 PID 4328 wrote to memory of 4816 4328 vjpjd.exe 86 PID 4816 wrote to memory of 2616 4816 vppjv.exe 87 PID 4816 wrote to memory of 2616 4816 vppjv.exe 87 PID 4816 wrote to memory of 2616 4816 vppjv.exe 87 PID 2616 wrote to memory of 1232 2616 rrxxflf.exe 88 PID 2616 wrote to memory of 1232 2616 rrxxflf.exe 88 PID 2616 wrote to memory of 1232 2616 rrxxflf.exe 88 PID 1232 wrote to memory of 3804 1232 hnttnn.exe 89 PID 1232 wrote to memory of 3804 1232 hnttnn.exe 89 PID 1232 wrote to memory of 3804 1232 hnttnn.exe 89 PID 3804 wrote to memory of 2268 3804 ddjjj.exe 90 PID 3804 wrote to memory of 2268 3804 ddjjj.exe 90 PID 3804 wrote to memory of 2268 3804 ddjjj.exe 90 PID 2268 wrote to memory of 4512 2268 vvvvd.exe 91 PID 2268 wrote to memory of 4512 2268 vvvvd.exe 91 PID 2268 wrote to memory of 4512 2268 vvvvd.exe 91 PID 4512 wrote to memory of 1352 4512 lfllrxl.exe 92 PID 4512 wrote to memory of 1352 4512 lfllrxl.exe 92 PID 4512 wrote to memory of 1352 4512 lfllrxl.exe 92 PID 1352 wrote to memory of 1648 1352 ttthbb.exe 93 PID 1352 wrote to memory of 1648 1352 ttthbb.exe 93 PID 1352 wrote to memory of 1648 1352 ttthbb.exe 93 PID 1648 wrote to memory of 1872 1648 bnttbb.exe 94 PID 1648 wrote to memory of 1872 1648 bnttbb.exe 94 PID 1648 wrote to memory of 1872 1648 bnttbb.exe 94 PID 1872 wrote to memory of 1928 1872 hbtnbb.exe 95 PID 1872 wrote to memory of 1928 1872 hbtnbb.exe 95 PID 1872 wrote to memory of 1928 1872 hbtnbb.exe 95 PID 1928 wrote to memory of 1636 1928 vvjjj.exe 96 PID 1928 wrote to memory of 1636 1928 vvjjj.exe 96 PID 1928 wrote to memory of 1636 1928 vvjjj.exe 96 PID 1636 wrote to memory of 3060 1636 3xxrrxx.exe 97 PID 1636 wrote to memory of 3060 1636 3xxrrxx.exe 97 PID 1636 wrote to memory of 3060 1636 3xxrrxx.exe 97 PID 3060 wrote to memory of 432 3060 hnhntb.exe 98 PID 3060 wrote to memory of 432 3060 hnhntb.exe 98 PID 3060 wrote to memory of 432 3060 hnhntb.exe 98 PID 432 wrote to memory of 768 432 xlxrlff.exe 99 PID 432 wrote to memory of 768 432 xlxrlff.exe 99 PID 432 wrote to memory of 768 432 xlxrlff.exe 99 PID 768 wrote to memory of 4576 768 ddppv.exe 100 PID 768 wrote to memory of 4576 768 ddppv.exe 100 PID 768 wrote to memory of 4576 768 ddppv.exe 100 PID 4576 wrote to memory of 2836 4576 pvvvp.exe 101 PID 4576 wrote to memory of 2836 4576 pvvvp.exe 101 PID 4576 wrote to memory of 2836 4576 pvvvp.exe 101 PID 2836 wrote to memory of 3896 2836 tbtbtn.exe 102 PID 2836 wrote to memory of 3896 2836 tbtbtn.exe 102 PID 2836 wrote to memory of 3896 2836 tbtbtn.exe 102 PID 3896 wrote to memory of 1028 3896 rrxrrfx.exe 103 PID 3896 wrote to memory of 1028 3896 rrxrrfx.exe 103 PID 3896 wrote to memory of 1028 3896 rrxrrfx.exe 103 PID 1028 wrote to memory of 5096 1028 ddvvj.exe 104 PID 1028 wrote to memory of 5096 1028 ddvvj.exe 104 PID 1028 wrote to memory of 5096 1028 ddvvj.exe 104 PID 5096 wrote to memory of 1440 5096 xllfffx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\700687b1755a8dd043b5c08640f4d490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\9bhbtt.exec:\9bhbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\vjpjd.exec:\vjpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\vppjv.exec:\vppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\rrxxflf.exec:\rrxxflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hnttnn.exec:\hnttnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\ddjjj.exec:\ddjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\vvvvd.exec:\vvvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\lfllrxl.exec:\lfllrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\ttthbb.exec:\ttthbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\bnttbb.exec:\bnttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\hbtnbb.exec:\hbtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvjjj.exec:\vvjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\3xxrrxx.exec:\3xxrrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\hnhntb.exec:\hnhntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xlxrlff.exec:\xlxrlff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\ddppv.exec:\ddppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\pvvvp.exec:\pvvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\tbtbtn.exec:\tbtbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\ddvvj.exec:\ddvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xllfffx.exec:\xllfffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\ttbttt.exec:\ttbttt.exe23⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jjppj.exec:\jjppj.exe24⤵
- Executes dropped EXE
PID:2384 -
\??\c:\rllfffx.exec:\rllfffx.exe25⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hntttt.exec:\hntttt.exe26⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7vvpd.exec:\7vvpd.exe27⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lrlxrfl.exec:\lrlxrfl.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\djppv.exec:\djppv.exe29⤵
- Executes dropped EXE
PID:692 -
\??\c:\jdjvd.exec:\jdjvd.exe30⤵
- Executes dropped EXE
PID:3864 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5hbbtt.exec:\5hbbtt.exe32⤵
- Executes dropped EXE
PID:3968 -
\??\c:\5vdvp.exec:\5vdvp.exe33⤵
- Executes dropped EXE
PID:2688 -
\??\c:\vjppv.exec:\vjppv.exe34⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\thtnht.exec:\thtnht.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jdjdj.exec:\jdjdj.exe37⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fxxrfrf.exec:\fxxrfrf.exe38⤵
- Executes dropped EXE
PID:1088 -
\??\c:\bhthhn.exec:\bhthhn.exe39⤵
- Executes dropped EXE
PID:4332 -
\??\c:\ddvjj.exec:\ddvjj.exe40⤵
- Executes dropped EXE
PID:5044 -
\??\c:\lrxxfff.exec:\lrxxfff.exe41⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7nttnn.exec:\7nttnn.exe42⤵
- Executes dropped EXE
PID:1096 -
\??\c:\pjdvd.exec:\pjdvd.exe43⤵
- Executes dropped EXE
PID:668 -
\??\c:\lfrfxfr.exec:\lfrfxfr.exe44⤵
- Executes dropped EXE
PID:4312 -
\??\c:\1rlfxfx.exec:\1rlfxfx.exe45⤵
- Executes dropped EXE
PID:4288 -
\??\c:\hthhbh.exec:\hthhbh.exe46⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pjvvj.exec:\pjvvj.exe47⤵
- Executes dropped EXE
PID:4772 -
\??\c:\xlffxlr.exec:\xlffxlr.exe48⤵
- Executes dropped EXE
PID:3804 -
\??\c:\9vddd.exec:\9vddd.exe49⤵
- Executes dropped EXE
PID:3340 -
\??\c:\flllflr.exec:\flllflr.exe50⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ttbhhh.exec:\ttbhhh.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pdvvp.exec:\pdvvp.exe52⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe53⤵
- Executes dropped EXE
PID:4764 -
\??\c:\thbtnn.exec:\thbtnn.exe54⤵
- Executes dropped EXE
PID:4988 -
\??\c:\tnnhhb.exec:\tnnhhb.exe55⤵
- Executes dropped EXE
PID:4724 -
\??\c:\dddvv.exec:\dddvv.exe56⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7hbtnt.exec:\7hbtnt.exe58⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1nntnh.exec:\1nntnh.exe59⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xlrrfll.exec:\xlrrfll.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nnnhhb.exec:\nnnhhb.exe61⤵
- Executes dropped EXE
PID:4744 -
\??\c:\3dppv.exec:\3dppv.exe62⤵
- Executes dropped EXE
PID:3172 -
\??\c:\rllllxx.exec:\rllllxx.exe63⤵
- Executes dropped EXE
PID:4548 -
\??\c:\djvjd.exec:\djvjd.exe64⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5bbtnn.exec:\5bbtnn.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nbnhhn.exec:\nbnhhn.exe66⤵PID:3008
-
\??\c:\1pdvd.exec:\1pdvd.exe67⤵PID:452
-
\??\c:\rllrlxl.exec:\rllrlxl.exe68⤵PID:2952
-
\??\c:\nnhtnh.exec:\nnhtnh.exe69⤵PID:3064
-
\??\c:\dddvv.exec:\dddvv.exe70⤵PID:2256
-
\??\c:\llflflx.exec:\llflflx.exe71⤵PID:1012
-
\??\c:\ttttnn.exec:\ttttnn.exe72⤵PID:2128
-
\??\c:\dvjjp.exec:\dvjjp.exe73⤵PID:4952
-
\??\c:\9jjdd.exec:\9jjdd.exe74⤵PID:5064
-
\??\c:\rxffxff.exec:\rxffxff.exe75⤵PID:4148
-
\??\c:\nnbbtt.exec:\nnbbtt.exe76⤵PID:4532
-
\??\c:\3jpjd.exec:\3jpjd.exe77⤵PID:4224
-
\??\c:\9lfllrl.exec:\9lfllrl.exe78⤵PID:3144
-
\??\c:\3rrlflf.exec:\3rrlflf.exe79⤵PID:2184
-
\??\c:\hhnhhh.exec:\hhnhhh.exe80⤵PID:4848
-
\??\c:\7vdvp.exec:\7vdvp.exe81⤵PID:2208
-
\??\c:\xrfxxff.exec:\xrfxxff.exe82⤵PID:4424
-
\??\c:\7xfxxxx.exec:\7xfxxxx.exe83⤵PID:1720
-
\??\c:\tnntnt.exec:\tnntnt.exe84⤵PID:5044
-
\??\c:\vppjj.exec:\vppjj.exe85⤵PID:224
-
\??\c:\lllllll.exec:\lllllll.exe86⤵PID:2616
-
\??\c:\nnnhbn.exec:\nnnhbn.exe87⤵PID:4816
-
\??\c:\vvjpv.exec:\vvjpv.exe88⤵PID:3088
-
\??\c:\3rxrlll.exec:\3rxrlll.exe89⤵PID:4288
-
\??\c:\5rrrlfr.exec:\5rrrlfr.exe90⤵PID:4136
-
\??\c:\nhttnt.exec:\nhttnt.exe91⤵PID:4772
-
\??\c:\vppjj.exec:\vppjj.exe92⤵PID:4888
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe93⤵PID:2408
-
\??\c:\5ttthn.exec:\5ttthn.exe94⤵PID:3212
-
\??\c:\7pvvp.exec:\7pvvp.exe95⤵PID:2220
-
\??\c:\3llllll.exec:\3llllll.exe96⤵PID:2000
-
\??\c:\ntnnhh.exec:\ntnnhh.exe97⤵PID:2892
-
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:4492
-
\??\c:\9vjdv.exec:\9vjdv.exe99⤵PID:1180
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe100⤵PID:4588
-
\??\c:\hntnhb.exec:\hntnhb.exe101⤵PID:5092
-
\??\c:\pjddd.exec:\pjddd.exe102⤵PID:2348
-
\??\c:\9lflxfx.exec:\9lflxfx.exe103⤵PID:2708
-
\??\c:\hntnnn.exec:\hntnnn.exe104⤵PID:1576
-
\??\c:\dvpjj.exec:\dvpjj.exe105⤵PID:3480
-
\??\c:\frrffrf.exec:\frrffrf.exe106⤵PID:3288
-
\??\c:\5lxrllf.exec:\5lxrllf.exe107⤵PID:1432
-
\??\c:\hnnntn.exec:\hnnntn.exe108⤵PID:1016
-
\??\c:\pdppp.exec:\pdppp.exe109⤵PID:3920
-
\??\c:\5vjvv.exec:\5vjvv.exe110⤵PID:2388
-
\??\c:\xfxrxlx.exec:\xfxrxlx.exe111⤵PID:452
-
\??\c:\nntnnn.exec:\nntnnn.exe112⤵PID:2952
-
\??\c:\9jjjv.exec:\9jjjv.exe113⤵PID:3016
-
\??\c:\frflrrx.exec:\frflrrx.exe114⤵PID:2172
-
\??\c:\7ffffxx.exec:\7ffffxx.exe115⤵PID:3492
-
\??\c:\htttbh.exec:\htttbh.exe116⤵PID:4684
-
\??\c:\pjppj.exec:\pjppj.exe117⤵PID:388
-
\??\c:\frfrlff.exec:\frfrlff.exe118⤵PID:5048
-
\??\c:\9lrxxxx.exec:\9lrxxxx.exe119⤵PID:684
-
\??\c:\bbbtnn.exec:\bbbtnn.exe120⤵PID:5116
-
\??\c:\dvdvp.exec:\dvdvp.exe121⤵PID:2688
-
\??\c:\fllfxxr.exec:\fllfxxr.exe122⤵PID:3392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-