Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 03:55
Behavioral task
behavioral1
Sample
8702e323644efc8f4533384280dec760_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 8702e323644efc8f4533384280dec760_NeikiAnalytics.exe
- Size 441KB
- Sample240518-eg7xcaah95
- SHA256 8cf8c99a6200bbb789af08f5b98e0840b40e861300a686105d796f1408f1903e
- MD5 8702e323644efc8f4533384280dec760
- SHA1 5ac0063a900f82cbe194719fce4ed9a66c0ae1f2
- SHA512 949889397df5c740cc3e5313a6de14f510e651a7af7fe24937b270970478096c121aa2aac59e15ff52cd20b7511a42adfedefd19020c9f71f1fbb3f4db79f105
- SSDEEP 12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHc:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMK
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3968-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/900-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3188-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4908-252-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3224-298-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/976-279-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4620-269-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2356-256-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2268-248-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2028-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4932-222-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4876-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4264-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/772-304-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1844-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3420-184-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3916-161-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/632-150-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1460-141-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1848-135-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1548-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1324-118-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5000-116-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4340-106-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2236-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/772-77-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3484-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4380-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/656-55-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4588-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/216-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1208-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4412-24-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1892-311-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3704-14-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3376-331-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5032-345-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2196-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4936-367-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-386-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4436-390-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-406-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4912-429-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4404-457-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2656-461-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/996-468-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1520-469-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4728-480-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3540-492-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2760-514-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-565-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3924-599-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2324-671-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3152-675-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2436-680-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/440-692-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3476-799-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1476-803-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1600-881-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3672-930-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3160-934-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1360-1032-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2520-1172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000a0000000233d8-3.dat family_berbew behavioral2/files/0x00080000000233f4-11.dat family_berbew behavioral2/files/0x00070000000233f8-13.dat family_berbew behavioral2/files/0x00070000000233f9-21.dat family_berbew behavioral2/files/0x00070000000233fa-27.dat family_berbew behavioral2/files/0x00070000000233fb-34.dat family_berbew behavioral2/files/0x00070000000233fc-40.dat family_berbew behavioral2/files/0x00070000000233ff-57.dat family_berbew behavioral2/files/0x0007000000023400-63.dat family_berbew behavioral2/files/0x0007000000023401-67.dat family_berbew behavioral2/files/0x0007000000023404-85.dat family_berbew behavioral2/files/0x0007000000023407-100.dat family_berbew behavioral2/files/0x000700000002340b-126.dat family_berbew behavioral2/files/0x000700000002340d-137.dat family_berbew behavioral2/files/0x000700000002340f-147.dat family_berbew behavioral2/files/0x0007000000023411-158.dat family_berbew behavioral2/files/0x0007000000023415-180.dat family_berbew behavioral2/files/0x0007000000023414-175.dat family_berbew behavioral2/files/0x0007000000023413-170.dat family_berbew behavioral2/files/0x0007000000023412-165.dat family_berbew behavioral2/files/0x0007000000023410-154.dat family_berbew behavioral2/files/0x000700000002340e-143.dat family_berbew behavioral2/files/0x000700000002340c-131.dat family_berbew behavioral2/files/0x000700000002340a-120.dat family_berbew behavioral2/files/0x0007000000023409-112.dat family_berbew behavioral2/files/0x0007000000023408-108.dat family_berbew behavioral2/files/0x0007000000023406-96.dat family_berbew behavioral2/files/0x0007000000023405-91.dat family_berbew behavioral2/files/0x0007000000023403-79.dat family_berbew behavioral2/files/0x0007000000023402-73.dat family_berbew behavioral2/files/0x00070000000233fe-51.dat family_berbew behavioral2/files/0x00070000000233fd-46.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 900 rrxrrlf.exe 3704 vjjdv.exe 3248 xfxrlfx.exe 4412 hbhtnh.exe 1208 vjvvj.exe 216 5vpjd.exe 4588 rrxrrfx.exe 656 bthhtt.exe 4380 bntntt.exe 5096 vjjdp.exe 3556 llllfxr.exe 772 xffrlfx.exe 3484 hntnhn.exe 2236 jpjpj.exe 4848 rrxrxrr.exe 4348 lxfxllf.exe 4340 5bbhbt.exe 5000 jdvpj.exe 1324 1ddvj.exe 1548 lxfxlff.exe 2444 ttbbnn.exe 1848 pddpj.exe 1460 jjdpj.exe 632 9xfrrrl.exe 3364 ntbtnn.exe 1432 5tbtnn.exe 3916 dvvpd.exe 1888 rfrrlff.exe 348 7rrrllx.exe 2516 bntnhh.exe 3420 1jpjv.exe 4440 pvjvj.exe 5072 flrfrrr.exe 4016 7nnnhh.exe 1376 bnnhbb.exe 1844 jdjvj.exe 3188 fxxrffx.exe 4508 hbhbnn.exe 4264 ntbtnh.exe 4876 pddvj.exe 2488 llrlfff.exe 4932 lxxrllf.exe 4436 htttnh.exe 2028 jjpvd.exe 4968 dvvdp.exe 2412 5rxlfxr.exe 2348 hhnhbt.exe 2924 htbthb.exe 4724 5vjvp.exe 2268 ffxlrfx.exe 4908 nntnhh.exe 2356 3bhbhb.exe 3868 5pvpp.exe 4292 lxfrfxx.exe 4280 xxxrlfx.exe 4620 nhhbnh.exe 4160 pddvv.exe 856 dvddv.exe 976 fxlfrrr.exe 904 5hnttt.exe 3160 nhhbnn.exe 4092 pdjdv.exe 2944 xllfxxl.exe 3544 bthhbn.exe -
resource yara_rule behavioral2/memory/3968-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000a0000000233d8-3.dat upx behavioral2/memory/3968-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/900-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00080000000233f4-11.dat upx behavioral2/files/0x00070000000233f8-13.dat upx behavioral2/files/0x00070000000233f9-21.dat upx behavioral2/files/0x00070000000233fa-27.dat upx behavioral2/files/0x00070000000233fb-34.dat upx behavioral2/files/0x00070000000233fc-40.dat upx behavioral2/files/0x00070000000233ff-57.dat upx behavioral2/files/0x0007000000023400-63.dat upx behavioral2/files/0x0007000000023401-67.dat upx behavioral2/files/0x0007000000023404-85.dat upx behavioral2/files/0x0007000000023407-100.dat upx behavioral2/files/0x000700000002340b-126.dat upx behavioral2/files/0x000700000002340d-137.dat upx behavioral2/files/0x000700000002340f-147.dat upx behavioral2/files/0x0007000000023411-158.dat upx behavioral2/files/0x0007000000023415-180.dat upx behavioral2/memory/3188-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4908-252-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3224-298-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/976-279-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4620-269-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2356-256-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2268-248-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2028-229-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4932-222-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4876-215-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4264-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/772-304-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1844-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1892-307-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3420-184-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-175.dat upx behavioral2/files/0x0007000000023413-170.dat upx behavioral2/files/0x0007000000023412-165.dat upx behavioral2/memory/3916-161-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023410-154.dat upx behavioral2/memory/632-150-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340e-143.dat upx behavioral2/memory/1460-141-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1848-135-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340c-131.dat upx behavioral2/memory/1548-124-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340a-120.dat upx behavioral2/memory/1324-118-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5000-116-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023409-112.dat upx behavioral2/files/0x0007000000023408-108.dat upx behavioral2/memory/4340-106-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4348-104-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023406-96.dat upx behavioral2/files/0x0007000000023405-91.dat upx behavioral2/memory/2236-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023403-79.dat upx behavioral2/memory/772-77-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3484-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023402-73.dat upx behavioral2/memory/4380-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/656-55-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x00070000000233fe-51.dat upx behavioral2/files/0x00070000000233fd-46.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3968 wrote to memory of 900 3968 8702e323644efc8f4533384280dec760_NeikiAnalytics.exe 82 PID 3968 wrote to memory of 900 3968 8702e323644efc8f4533384280dec760_NeikiAnalytics.exe 82 PID 3968 wrote to memory of 900 3968 8702e323644efc8f4533384280dec760_NeikiAnalytics.exe 82 PID 900 wrote to memory of 3704 900 rrxrrlf.exe 83 PID 900 wrote to memory of 3704 900 rrxrrlf.exe 83 PID 900 wrote to memory of 3704 900 rrxrrlf.exe 83 PID 3704 wrote to memory of 3248 3704 vjjdv.exe 84 PID 3704 wrote to memory of 3248 3704 vjjdv.exe 84 PID 3704 wrote to memory of 3248 3704 vjjdv.exe 84 PID 3248 wrote to memory of 4412 3248 xfxrlfx.exe 85 PID 3248 wrote to memory of 4412 3248 xfxrlfx.exe 85 PID 3248 wrote to memory of 4412 3248 xfxrlfx.exe 85 PID 4412 wrote to memory of 1208 4412 hbhtnh.exe 86 PID 4412 wrote to memory of 1208 4412 hbhtnh.exe 86 PID 4412 wrote to memory of 1208 4412 hbhtnh.exe 86 PID 1208 wrote to memory of 216 1208 vjvvj.exe 87 PID 1208 wrote to memory of 216 1208 vjvvj.exe 87 PID 1208 wrote to memory of 216 1208 vjvvj.exe 87 PID 216 wrote to memory of 4588 216 5vpjd.exe 88 PID 216 wrote to memory of 4588 216 5vpjd.exe 88 PID 216 wrote to memory of 4588 216 5vpjd.exe 88 PID 4588 wrote to memory of 656 4588 rrxrrfx.exe 89 PID 4588 wrote to memory of 656 4588 rrxrrfx.exe 89 PID 4588 wrote to memory of 656 4588 rrxrrfx.exe 89 PID 656 wrote to memory of 4380 656 bthhtt.exe 90 PID 656 wrote to memory of 4380 656 bthhtt.exe 90 PID 656 wrote to memory of 4380 656 bthhtt.exe 90 PID 4380 wrote to memory of 5096 4380 bntntt.exe 91 PID 4380 wrote to memory of 5096 4380 bntntt.exe 91 PID 4380 wrote to memory of 5096 4380 bntntt.exe 91 PID 5096 wrote to memory of 3556 5096 vjjdp.exe 92 PID 5096 wrote to memory of 3556 5096 vjjdp.exe 92 PID 5096 wrote to memory of 3556 5096 vjjdp.exe 92 PID 3556 wrote to memory of 772 3556 llllfxr.exe 93 PID 3556 wrote to memory of 772 3556 llllfxr.exe 93 PID 3556 wrote to memory of 772 3556 llllfxr.exe 93 PID 772 wrote to memory of 3484 772 xffrlfx.exe 94 PID 772 wrote to memory of 3484 772 xffrlfx.exe 94 PID 772 wrote to memory of 3484 772 xffrlfx.exe 94 PID 3484 wrote to memory of 2236 3484 hntnhn.exe 95 PID 3484 wrote to memory of 2236 3484 hntnhn.exe 95 PID 3484 wrote to memory of 2236 3484 hntnhn.exe 95 PID 2236 wrote to memory of 4848 2236 jpjpj.exe 96 PID 2236 wrote to memory of 4848 2236 jpjpj.exe 96 PID 2236 wrote to memory of 4848 2236 jpjpj.exe 96 PID 4848 wrote to memory of 4348 4848 rrxrxrr.exe 97 PID 4848 wrote to memory of 4348 4848 rrxrxrr.exe 97 PID 4848 wrote to memory of 4348 4848 rrxrxrr.exe 97 PID 4348 wrote to memory of 4340 4348 lxfxllf.exe 98 PID 4348 wrote to memory of 4340 4348 lxfxllf.exe 98 PID 4348 wrote to memory of 4340 4348 lxfxllf.exe 98 PID 4340 wrote to memory of 5000 4340 5bbhbt.exe 99 PID 4340 wrote to memory of 5000 4340 5bbhbt.exe 99 PID 4340 wrote to memory of 5000 4340 5bbhbt.exe 99 PID 5000 wrote to memory of 1324 5000 jdvpj.exe 100 PID 5000 wrote to memory of 1324 5000 jdvpj.exe 100 PID 5000 wrote to memory of 1324 5000 jdvpj.exe 100 PID 1324 wrote to memory of 1548 1324 1ddvj.exe 101 PID 1324 wrote to memory of 1548 1324 1ddvj.exe 101 PID 1324 wrote to memory of 1548 1324 1ddvj.exe 101 PID 1548 wrote to memory of 2444 1548 lxfxlff.exe 102 PID 1548 wrote to memory of 2444 1548 lxfxlff.exe 102 PID 1548 wrote to memory of 2444 1548 lxfxlff.exe 102 PID 2444 wrote to memory of 1848 2444 ttbbnn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8702e323644efc8f4533384280dec760_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8702e323644efc8f4533384280dec760_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\vjjdv.exec:\vjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\hbhtnh.exec:\hbhtnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\vjvvj.exec:\vjvvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\5vpjd.exec:\5vpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\bthhtt.exec:\bthhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\bntntt.exec:\bntntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\vjjdp.exec:\vjjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\llllfxr.exec:\llllfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\xffrlfx.exec:\xffrlfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\hntnhn.exec:\hntnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\jpjpj.exec:\jpjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rrxrxrr.exec:\rrxrxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\lxfxllf.exec:\lxfxllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\5bbhbt.exec:\5bbhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\jdvpj.exec:\jdvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\1ddvj.exec:\1ddvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\lxfxlff.exec:\lxfxlff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\ttbbnn.exec:\ttbbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\pddpj.exec:\pddpj.exe23⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jjdpj.exec:\jjdpj.exe24⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9xfrrrl.exec:\9xfrrrl.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\ntbtnn.exec:\ntbtnn.exe26⤵
- Executes dropped EXE
PID:3364 -
\??\c:\5tbtnn.exec:\5tbtnn.exe27⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dvvpd.exec:\dvvpd.exe28⤵
- Executes dropped EXE
PID:3916 -
\??\c:\rfrrlff.exec:\rfrrlff.exe29⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7rrrllx.exec:\7rrrllx.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\bntnhh.exec:\bntnhh.exe31⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1jpjv.exec:\1jpjv.exe32⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pvjvj.exec:\pvjvj.exe33⤵
- Executes dropped EXE
PID:4440 -
\??\c:\flrfrrr.exec:\flrfrrr.exe34⤵
- Executes dropped EXE
PID:5072 -
\??\c:\7nnnhh.exec:\7nnnhh.exe35⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bnnhbb.exec:\bnnhbb.exe36⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jdjvj.exec:\jdjvj.exe37⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fxxrffx.exec:\fxxrffx.exe38⤵
- Executes dropped EXE
PID:3188 -
\??\c:\hbhbnn.exec:\hbhbnn.exe39⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ntbtnh.exec:\ntbtnh.exe40⤵
- Executes dropped EXE
PID:4264 -
\??\c:\pddvj.exec:\pddvj.exe41⤵
- Executes dropped EXE
PID:4876 -
\??\c:\llrlfff.exec:\llrlfff.exe42⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lxxrllf.exec:\lxxrllf.exe43⤵
- Executes dropped EXE
PID:4932 -
\??\c:\htttnh.exec:\htttnh.exe44⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jjpvd.exec:\jjpvd.exe45⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dvvdp.exec:\dvvdp.exe46⤵
- Executes dropped EXE
PID:4968 -
\??\c:\5rxlfxr.exec:\5rxlfxr.exe47⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hhnhbt.exec:\hhnhbt.exe48⤵
- Executes dropped EXE
PID:2348 -
\??\c:\htbthb.exec:\htbthb.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5vjvp.exec:\5vjvp.exe50⤵
- Executes dropped EXE
PID:4724 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe51⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nntnhh.exec:\nntnhh.exe52⤵
- Executes dropped EXE
PID:4908 -
\??\c:\3bhbhb.exec:\3bhbhb.exe53⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5pvpp.exec:\5pvpp.exe54⤵
- Executes dropped EXE
PID:3868 -
\??\c:\lxfrfxx.exec:\lxfrfxx.exe55⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xxxrlfx.exec:\xxxrlfx.exe56⤵
- Executes dropped EXE
PID:4280 -
\??\c:\nhhbnh.exec:\nhhbnh.exe57⤵
- Executes dropped EXE
PID:4620 -
\??\c:\pddvv.exec:\pddvv.exe58⤵
- Executes dropped EXE
PID:4160 -
\??\c:\dvddv.exec:\dvddv.exe59⤵
- Executes dropped EXE
PID:856 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe60⤵
- Executes dropped EXE
PID:976 -
\??\c:\5hnttt.exec:\5hnttt.exe61⤵
- Executes dropped EXE
PID:904 -
\??\c:\nhhbnn.exec:\nhhbnn.exe62⤵
- Executes dropped EXE
PID:3160 -
\??\c:\pdjdv.exec:\pdjdv.exe63⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xllfxxl.exec:\xllfxxl.exe64⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bthhbn.exec:\bthhbn.exe65⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnbbtn.exec:\tnbbtn.exe66⤵PID:3848
-
\??\c:\jjjjj.exec:\jjjjj.exe67⤵PID:3224
-
\??\c:\xlrfrlf.exec:\xlrfrlf.exe68⤵PID:3960
-
\??\c:\nhnhbb.exec:\nhnhbb.exe69⤵PID:772
-
\??\c:\ddppp.exec:\ddppp.exe70⤵PID:1892
-
\??\c:\xlxxlrx.exec:\xlxxlrx.exe71⤵PID:2076
-
\??\c:\bhnbth.exec:\bhnbth.exe72⤵PID:2404
-
\??\c:\pjpjd.exec:\pjpjd.exe73⤵PID:4008
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe74⤵PID:1052
-
\??\c:\1rfxrlr.exec:\1rfxrlr.exe75⤵PID:3412
-
\??\c:\lxffffx.exec:\lxffffx.exe76⤵PID:4592
-
\??\c:\nhhhhn.exec:\nhhhhn.exe77⤵PID:3376
-
\??\c:\nnthhb.exec:\nnthhb.exe78⤵PID:2720
-
\??\c:\dvdpd.exec:\dvdpd.exe79⤵PID:4612
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe80⤵PID:5032
-
\??\c:\7bnhnn.exec:\7bnhnn.exe81⤵PID:5020
-
\??\c:\jpddv.exec:\jpddv.exe82⤵PID:2196
-
\??\c:\rrfxxrl.exec:\rrfxxrl.exe83⤵PID:2516
-
\??\c:\lrfrfff.exec:\lrfrfff.exe84⤵PID:1380
-
\??\c:\pjjdv.exec:\pjjdv.exe85⤵PID:4440
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe86⤵PID:5040
-
\??\c:\xrlffxr.exec:\xrlffxr.exe87⤵PID:4936
-
\??\c:\hbhtnn.exec:\hbhtnn.exe88⤵PID:4352
-
\??\c:\tbbtnh.exec:\tbbtnh.exe89⤵PID:1844
-
\??\c:\7vpjj.exec:\7vpjj.exe90⤵PID:3188
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe91⤵PID:4732
-
\??\c:\nhbtnn.exec:\nhbtnn.exe92⤵PID:2488
-
\??\c:\5xrfxxx.exec:\5xrfxxx.exe93⤵PID:4436
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe94⤵PID:3000
-
\??\c:\ttnntt.exec:\ttnntt.exe95⤵PID:5004
-
\??\c:\jdppd.exec:\jdppd.exe96⤵PID:4828
-
\??\c:\9jvpd.exec:\9jvpd.exe97⤵PID:628
-
\??\c:\ffffffx.exec:\ffffffx.exe98⤵PID:4724
-
\??\c:\tttntt.exec:\tttntt.exe99⤵PID:1912
-
\??\c:\tnbthh.exec:\tnbthh.exe100⤵PID:1740
-
\??\c:\dvvjd.exec:\dvvjd.exe101⤵PID:5012
-
\??\c:\7hbnhb.exec:\7hbnhb.exe102⤵PID:3632
-
\??\c:\tnnnhh.exec:\tnnnhh.exe103⤵PID:4024
-
\??\c:\5pvpv.exec:\5pvpv.exe104⤵PID:3080
-
\??\c:\7lxrrrf.exec:\7lxrrrf.exe105⤵PID:4568
-
\??\c:\frfxrlf.exec:\frfxrlf.exe106⤵PID:4912
-
\??\c:\hbhbtb.exec:\hbhbtb.exe107⤵PID:4548
-
\??\c:\djvpd.exec:\djvpd.exe108⤵PID:4300
-
\??\c:\fxxrllf.exec:\fxxrllf.exe109⤵PID:208
-
\??\c:\nhnhtt.exec:\nhnhtt.exe110⤵PID:1020
-
\??\c:\3jvpd.exec:\3jvpd.exe111⤵PID:1816
-
\??\c:\xlfrrll.exec:\xlfrrll.exe112⤵PID:964
-
\??\c:\frfxfff.exec:\frfxfff.exe113⤵PID:3660
-
\??\c:\1hbtnt.exec:\1hbtnt.exe114⤵PID:4404
-
\??\c:\nbnhtt.exec:\nbnhtt.exe115⤵PID:2656
-
\??\c:\5rllxxl.exec:\5rllxxl.exe116⤵PID:2328
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe117⤵PID:996
-
\??\c:\tthbhh.exec:\tthbhh.exe118⤵PID:1520
-
\??\c:\jjvvv.exec:\jjvvv.exe119⤵PID:3268
-
\??\c:\9vjpp.exec:\9vjpp.exe120⤵PID:4800
-
\??\c:\fffrfxl.exec:\fffrfxl.exe121⤵PID:4728
-
\??\c:\htbnhn.exec:\htbnhn.exe122⤵PID:4844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-