Analysis
- max time kernel
150s - max time network
122s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
18/05/2024, 08:08
Behavioral task
behavioral1
Sample
b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
6 signatures
150 seconds
General
- Target b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe
- Size 463KB
- Sample240518-j11dtsba49
- SHA256 f1e80c720eb0d4df1eccc752ce0f69d672453a2a73de9b5ca06e88e8b82d8d3f
- MD5 b29899458e09404ba9fe3e41e124e480
- SHA1 7daa3a81b34f25bee6082eed46c9bf2cb85d498a
- SHA512 0c3341437b0650b6d96821d5545cbff342d3d655ee2247220a0e2b3e287a8abde823077d02486319a82c9d955016716168ecdae18d6dd3f33d6132fd53b08c0e
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V1:VeR0oykayRFp3lztP+OKaf1V1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1968-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2100-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3028-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2720-36-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2616-48-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2876-45-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2616-55-0x00000000003C0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2456-73-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2016-89-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1260-99-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2828-116-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/468-118-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1116-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2832-151-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2932-169-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2304-187-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2892-197-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/948-205-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3036-228-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1432-226-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2348-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2072-249-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1680-289-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1900-298-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/868-312-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2912-313-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2912-315-0x0000000077760000-0x000000007787F000-memory.dmp family_blackmoon behavioral1/memory/1736-317-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2140-324-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3000-390-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2576-397-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1312-430-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2384-443-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2152-474-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/380-488-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1056-496-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1076-510-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2224-517-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3008-623-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1784-728-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2396-767-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2184-781-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2864-900-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/1968-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000700000001211e-10.dat family_berbew behavioral1/memory/1968-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2100-9-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2100-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3028-19-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x003100000001313a-17.dat family_berbew behavioral1/memory/3028-28-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000900000001344f-26.dat family_berbew behavioral1/memory/2720-36-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00090000000134f5-37.dat family_berbew behavioral1/files/0x0008000000013a15-46.dat family_berbew behavioral1/memory/2616-48-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2876-45-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0008000000013a65-56.dat family_berbew behavioral1/memory/2616-55-0x00000000003C0000-0x00000000003FA000-memory.dmp family_berbew behavioral1/files/0x0008000000013a85-63.dat family_berbew behavioral1/memory/2456-73-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000800000001451d-71.dat family_berbew behavioral1/files/0x0006000000014525-80.dat family_berbew behavioral1/files/0x00060000000145c9-90.dat family_berbew behavioral1/memory/2016-89-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000145d4-97.dat family_berbew behavioral1/memory/1260-99-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000146a7-106.dat family_berbew behavioral1/files/0x0006000000014730-114.dat family_berbew behavioral1/memory/2828-116-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/468-118-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000600000001474b-125.dat family_berbew behavioral1/memory/2416-129-0x00000000005D0000-0x000000000060A000-memory.dmp family_berbew behavioral1/files/0x000600000001475f-134.dat family_berbew behavioral1/memory/1116-136-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x002d00000001325f-143.dat family_berbew behavioral1/memory/2832-151-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000148af-152.dat family_berbew behavioral1/memory/2932-161-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000014a29-160.dat family_berbew behavioral1/memory/2932-169-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000014c0b-171.dat family_berbew behavioral1/files/0x0006000000014d0f-179.dat family_berbew behavioral1/memory/2304-187-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000014fac-188.dat family_berbew behavioral1/files/0x0006000000015077-195.dat family_berbew behavioral1/memory/2892-197-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000150aa-206.dat family_berbew behavioral1/memory/948-205-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000600000001523e-216.dat family_berbew behavioral1/files/0x000600000001543a-224.dat family_berbew behavioral1/memory/3036-228-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1432-226-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00060000000155e8-235.dat family_berbew behavioral1/files/0x0006000000015a15-244.dat family_berbew behavioral1/memory/2348-243-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2072-249-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/files/0x0006000000015b37-254.dat family_berbew behavioral1/files/0x0006000000015b72-262.dat family_berbew behavioral1/files/0x0006000000015bb5-272.dat family_berbew behavioral1/files/0x0006000000015c91-279.dat family_berbew behavioral1/memory/1680-281-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1680-289-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0006000000015c9b-290.dat family_berbew behavioral1/memory/1900-298-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/868-305-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/868-312-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 2100 dvvdp.exe 3028 vdvdp.exe 2720 1xrrxrx.exe 2876 pvdjv.exe 2616 lffxlrf.exe 2780 nnnbnn.exe 2456 rrrrrfl.exe 2576 ppjpd.exe 2016 7fllxff.exe 1260 bbtbnh.exe 2640 5dpdp.exe 2828 hbnntt.exe 468 1dvvv.exe 2416 7rlfrxr.exe 1116 3jddp.exe 2832 llrfrxl.exe 2092 llxlrrx.exe 2932 hbthnt.exe 2284 5fxfxfx.exe 2304 lllfxxr.exe 2892 pvpdj.exe 948 ttnbnt.exe 1720 lllffxf.exe 1432 lxrrfxf.exe 3036 3xxlxfr.exe 2348 nttntn.exe 2072 flrlrlr.exe 748 9xlrrff.exe 684 lxllxfx.exe 3020 bnhtht.exe 1680 lfrxxfl.exe 1924 jjddv.exe 1900 5fxfrrf.exe 868 nhnbnh.exe 2912 9jvjp.exe 2140 dvjjv.exe 1928 vjdjv.exe 2660 xxlrxfr.exe 2580 ttbbbh.exe 2572 pjddj.exe 2480 ffxxffx.exe 2496 rlxxlrx.exe 2440 hbtbhn.exe 2484 dpvvd.exe 3000 7djpd.exe 2576 rlffrxl.exe 2016 5hbhhn.exe 2704 vpppd.exe 2764 1djdj.exe 1704 lffxflx.exe 1584 bttbnn.exe 1312 dpdjv.exe 2384 vpjpd.exe 2380 9rlrxfl.exe 1236 xrlrffx.exe 2964 bhtbnn.exe 2856 pvpdp.exe 2152 jvjdd.exe 1864 9rlfrrf.exe 380 hbtbhn.exe 804 tnnntb.exe 1056 vjvvd.exe 1808 lfrrffr.exe 1076 nnbbhn.exe -
resource yara_rule behavioral1/memory/1968-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000700000001211e-10.dat upx behavioral1/memory/1968-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2100-9-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2100-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3028-19-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x003100000001313a-17.dat upx behavioral1/memory/3028-28-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000900000001344f-26.dat upx behavioral1/memory/2720-36-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00090000000134f5-37.dat upx behavioral1/files/0x0008000000013a15-46.dat upx behavioral1/memory/2616-48-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2876-45-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0008000000013a65-56.dat upx behavioral1/files/0x0008000000013a85-63.dat upx behavioral1/memory/2456-73-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000800000001451d-71.dat upx behavioral1/files/0x0006000000014525-80.dat upx behavioral1/files/0x00060000000145c9-90.dat upx behavioral1/memory/2016-89-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000145d4-97.dat upx behavioral1/memory/1260-99-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000146a7-106.dat upx behavioral1/files/0x0006000000014730-114.dat upx behavioral1/memory/2828-116-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/468-118-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000600000001474b-125.dat upx behavioral1/files/0x000600000001475f-134.dat upx behavioral1/memory/1116-136-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x002d00000001325f-143.dat upx behavioral1/memory/2832-151-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000148af-152.dat upx behavioral1/memory/2932-161-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000014a29-160.dat upx behavioral1/memory/2932-169-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000014c0b-171.dat upx behavioral1/files/0x0006000000014d0f-179.dat upx behavioral1/memory/2304-187-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000014fac-188.dat upx behavioral1/files/0x0006000000015077-195.dat upx behavioral1/memory/2892-197-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000150aa-206.dat upx behavioral1/memory/948-205-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000600000001523e-216.dat upx behavioral1/files/0x000600000001543a-224.dat upx behavioral1/memory/3036-228-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1432-226-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00060000000155e8-235.dat upx behavioral1/files/0x0006000000015a15-244.dat upx behavioral1/memory/2348-243-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2072-249-0x0000000000220000-0x000000000025A000-memory.dmp upx behavioral1/files/0x0006000000015b37-254.dat upx behavioral1/files/0x0006000000015b72-262.dat upx behavioral1/files/0x0006000000015bb5-272.dat upx behavioral1/files/0x0006000000015c91-279.dat upx behavioral1/memory/1680-281-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1680-289-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0006000000015c9b-290.dat upx behavioral1/memory/1900-298-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/868-305-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/868-312-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2912-313-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1736-317-0x0000000000400000-0x000000000043A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2100 1968 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2100 1968 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2100 1968 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 28 PID 1968 wrote to memory of 2100 1968 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 28 PID 2100 wrote to memory of 3028 2100 dvvdp.exe 29 PID 2100 wrote to memory of 3028 2100 dvvdp.exe 29 PID 2100 wrote to memory of 3028 2100 dvvdp.exe 29 PID 2100 wrote to memory of 3028 2100 dvvdp.exe 29 PID 3028 wrote to memory of 2720 3028 vdvdp.exe 30 PID 3028 wrote to memory of 2720 3028 vdvdp.exe 30 PID 3028 wrote to memory of 2720 3028 vdvdp.exe 30 PID 3028 wrote to memory of 2720 3028 vdvdp.exe 30 PID 2720 wrote to memory of 2876 2720 1xrrxrx.exe 31 PID 2720 wrote to memory of 2876 2720 1xrrxrx.exe 31 PID 2720 wrote to memory of 2876 2720 1xrrxrx.exe 31 PID 2720 wrote to memory of 2876 2720 1xrrxrx.exe 31 PID 2876 wrote to memory of 2616 2876 pvdjv.exe 32 PID 2876 wrote to memory of 2616 2876 pvdjv.exe 32 PID 2876 wrote to memory of 2616 2876 pvdjv.exe 32 PID 2876 wrote to memory of 2616 2876 pvdjv.exe 32 PID 2616 wrote to memory of 2780 2616 lffxlrf.exe 33 PID 2616 wrote to memory of 2780 2616 lffxlrf.exe 33 PID 2616 wrote to memory of 2780 2616 lffxlrf.exe 33 PID 2616 wrote to memory of 2780 2616 lffxlrf.exe 33 PID 2780 wrote to memory of 2456 2780 nnnbnn.exe 34 PID 2780 wrote to memory of 2456 2780 nnnbnn.exe 34 PID 2780 wrote to memory of 2456 2780 nnnbnn.exe 34 PID 2780 wrote to memory of 2456 2780 nnnbnn.exe 34 PID 2456 wrote to memory of 2576 2456 rrrrrfl.exe 35 PID 2456 wrote to memory of 2576 2456 rrrrrfl.exe 35 PID 2456 wrote to memory of 2576 2456 rrrrrfl.exe 35 PID 2456 wrote to memory of 2576 2456 rrrrrfl.exe 35 PID 2576 wrote to memory of 2016 2576 ppjpd.exe 36 PID 2576 wrote to memory of 2016 2576 ppjpd.exe 36 PID 2576 wrote to memory of 2016 2576 ppjpd.exe 36 PID 2576 wrote to memory of 2016 2576 ppjpd.exe 36 PID 2016 wrote to memory of 1260 2016 7fllxff.exe 37 PID 2016 wrote to memory of 1260 2016 7fllxff.exe 37 PID 2016 wrote to memory of 1260 2016 7fllxff.exe 37 PID 2016 wrote to memory of 1260 2016 7fllxff.exe 37 PID 1260 wrote to memory of 2640 1260 bbtbnh.exe 38 PID 1260 wrote to memory of 2640 1260 bbtbnh.exe 38 PID 1260 wrote to memory of 2640 1260 bbtbnh.exe 38 PID 1260 wrote to memory of 2640 1260 bbtbnh.exe 38 PID 2640 wrote to memory of 2828 2640 5dpdp.exe 39 PID 2640 wrote to memory of 2828 2640 5dpdp.exe 39 PID 2640 wrote to memory of 2828 2640 5dpdp.exe 39 PID 2640 wrote to memory of 2828 2640 5dpdp.exe 39 PID 2828 wrote to memory of 468 2828 hbnntt.exe 40 PID 2828 wrote to memory of 468 2828 hbnntt.exe 40 PID 2828 wrote to memory of 468 2828 hbnntt.exe 40 PID 2828 wrote to memory of 468 2828 hbnntt.exe 40 PID 468 wrote to memory of 2416 468 1dvvv.exe 41 PID 468 wrote to memory of 2416 468 1dvvv.exe 41 PID 468 wrote to memory of 2416 468 1dvvv.exe 41 PID 468 wrote to memory of 2416 468 1dvvv.exe 41 PID 2416 wrote to memory of 1116 2416 7rlfrxr.exe 42 PID 2416 wrote to memory of 1116 2416 7rlfrxr.exe 42 PID 2416 wrote to memory of 1116 2416 7rlfrxr.exe 42 PID 2416 wrote to memory of 1116 2416 7rlfrxr.exe 42 PID 1116 wrote to memory of 2832 1116 3jddp.exe 43 PID 1116 wrote to memory of 2832 1116 3jddp.exe 43 PID 1116 wrote to memory of 2832 1116 3jddp.exe 43 PID 1116 wrote to memory of 2832 1116 3jddp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\dvvdp.exec:\dvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\vdvdp.exec:\vdvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1xrrxrx.exec:\1xrrxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pvdjv.exec:\pvdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lffxlrf.exec:\lffxlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nnnbnn.exec:\nnnbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\rrrrrfl.exec:\rrrrrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ppjpd.exec:\ppjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\7fllxff.exec:\7fllxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bbtbnh.exec:\bbtbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\5dpdp.exec:\5dpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\hbnntt.exec:\hbnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1dvvv.exec:\1dvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\7rlfrxr.exec:\7rlfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3jddp.exec:\3jddp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\llrfrxl.exec:\llrfrxl.exe17⤵
- Executes dropped EXE
PID:2832 -
\??\c:\llxlrrx.exec:\llxlrrx.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hbthnt.exec:\hbthnt.exe19⤵
- Executes dropped EXE
PID:2932 -
\??\c:\5fxfxfx.exec:\5fxfxfx.exe20⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lllfxxr.exec:\lllfxxr.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pvpdj.exec:\pvpdj.exe22⤵
- Executes dropped EXE
PID:2892 -
\??\c:\ttnbnt.exec:\ttnbnt.exe23⤵
- Executes dropped EXE
PID:948 -
\??\c:\lllffxf.exec:\lllffxf.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lxrrfxf.exec:\lxrrfxf.exe25⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3xxlxfr.exec:\3xxlxfr.exe26⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nttntn.exec:\nttntn.exe27⤵
- Executes dropped EXE
PID:2348 -
\??\c:\flrlrlr.exec:\flrlrlr.exe28⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9xlrrff.exec:\9xlrrff.exe29⤵
- Executes dropped EXE
PID:748 -
\??\c:\lxllxfx.exec:\lxllxfx.exe30⤵
- Executes dropped EXE
PID:684 -
\??\c:\bnhtht.exec:\bnhtht.exe31⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jjddv.exec:\jjddv.exe33⤵
- Executes dropped EXE
PID:1924 -
\??\c:\5fxfrrf.exec:\5fxfrrf.exe34⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nhnbnh.exec:\nhnbnh.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\9jvjp.exec:\9jvjp.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\fxxfffl.exec:\fxxfffl.exe37⤵PID:1736
-
\??\c:\dvjjv.exec:\dvjjv.exe38⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vjdjv.exec:\vjdjv.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ttbbbh.exec:\ttbbbh.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pjddj.exec:\pjddj.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\ffxxffx.exec:\ffxxffx.exe43⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rlxxlrx.exec:\rlxxlrx.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hbtbhn.exec:\hbtbhn.exe45⤵
- Executes dropped EXE
PID:2440 -
\??\c:\dpvvd.exec:\dpvvd.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7djpd.exec:\7djpd.exe47⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rlffrxl.exec:\rlffrxl.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5hbhhn.exec:\5hbhhn.exe49⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vpppd.exec:\vpppd.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1djdj.exec:\1djdj.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lffxflx.exec:\lffxflx.exe52⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bttbnn.exec:\bttbnn.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dpdjv.exec:\dpdjv.exe54⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpjpd.exec:\vpjpd.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9rlrxfl.exec:\9rlrxfl.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xrlrffx.exec:\xrlrffx.exe57⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bhtbnn.exec:\bhtbnn.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pvpdp.exec:\pvpdp.exe59⤵
- Executes dropped EXE
PID:2856 -
\??\c:\jvjdd.exec:\jvjdd.exe60⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9rlfrrf.exec:\9rlfrrf.exe61⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbtbhn.exec:\hbtbhn.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\tnnntb.exec:\tnnntb.exe63⤵
- Executes dropped EXE
PID:804 -
\??\c:\vjvvd.exec:\vjvvd.exe64⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfrrffr.exec:\lfrrffr.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nnbbhn.exec:\nnbbhn.exe66⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5tntbh.exec:\5tntbh.exe67⤵PID:2224
-
\??\c:\jjdjp.exec:\jjdjp.exe68⤵PID:1916
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe69⤵PID:604
-
\??\c:\hbhttn.exec:\hbhttn.exe70⤵PID:3036
-
\??\c:\vpjdd.exec:\vpjdd.exe71⤵PID:2188
-
\??\c:\pdvvd.exec:\pdvvd.exe72⤵PID:284
-
\??\c:\xrlllfr.exec:\xrlllfr.exe73⤵PID:752
-
\??\c:\tnhhtb.exec:\tnhhtb.exe74⤵PID:748
-
\??\c:\bbttbt.exec:\bbttbt.exe75⤵PID:744
-
\??\c:\pppvd.exec:\pppvd.exe76⤵PID:2220
-
\??\c:\9fxrflx.exec:\9fxrflx.exe77⤵PID:1552
-
\??\c:\frfrflr.exec:\frfrflr.exe78⤵PID:1680
-
\??\c:\9hntbh.exec:\9hntbh.exe79⤵PID:1996
-
\??\c:\5dvdj.exec:\5dvdj.exe80⤵PID:2004
-
\??\c:\7jvvp.exec:\7jvvp.exe81⤵PID:2084
-
\??\c:\7xrxxfl.exec:\7xrxxfl.exe82⤵PID:1988
-
\??\c:\bbttbb.exec:\bbttbb.exe83⤵PID:1980
-
\??\c:\bnhnbb.exec:\bnhnbb.exe84⤵PID:3008
-
\??\c:\7pjjd.exec:\7pjjd.exe85⤵PID:2664
-
\??\c:\frlrxfl.exec:\frlrxfl.exe86⤵PID:3028
-
\??\c:\5nhntb.exec:\5nhntb.exe87⤵PID:3048
-
\??\c:\htnthn.exec:\htnthn.exe88⤵PID:2752
-
\??\c:\9djdp.exec:\9djdp.exe89⤵PID:2732
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe90⤵PID:2744
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe91⤵PID:2780
-
\??\c:\thbhhh.exec:\thbhhh.exe92⤵PID:2440
-
\??\c:\vpjpp.exec:\vpjpp.exe93⤵PID:2956
-
\??\c:\jvjjp.exec:\jvjjp.exe94⤵PID:904
-
\??\c:\fxxfrxl.exec:\fxxfrxl.exe95⤵PID:2524
-
\??\c:\htnntt.exec:\htnntt.exe96⤵PID:2632
-
\??\c:\9jppv.exec:\9jppv.exe97⤵PID:2676
-
\??\c:\pdvdp.exec:\pdvdp.exe98⤵PID:2800
-
\??\c:\rlllrrx.exec:\rlllrrx.exe99⤵PID:1784
-
\??\c:\hbntbb.exec:\hbntbb.exe100⤵PID:1604
-
\??\c:\7jvjp.exec:\7jvjp.exe101⤵PID:2240
-
\??\c:\jjdjp.exec:\jjdjp.exe102⤵PID:840
-
\??\c:\9xxrxxx.exec:\9xxrxxx.exe103⤵PID:2036
-
\??\c:\9nbbhb.exec:\9nbbhb.exe104⤵PID:1536
-
\??\c:\ntnhnt.exec:\ntnhnt.exe105⤵PID:2396
-
\??\c:\dpjjv.exec:\dpjjv.exe106⤵PID:1716
-
\??\c:\5rflrxf.exec:\5rflrxf.exe107⤵PID:2184
-
\??\c:\7fxxffl.exec:\7fxxffl.exe108⤵PID:320
-
\??\c:\bhthnh.exec:\bhthnh.exe109⤵PID:580
-
\??\c:\jvppd.exec:\jvppd.exe110⤵PID:2824
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe111⤵PID:1056
-
\??\c:\lfllxxf.exec:\lfllxxf.exe112⤵PID:396
-
\??\c:\tnbhtt.exec:\tnbhtt.exe113⤵PID:2172
-
\??\c:\3pjpd.exec:\3pjpd.exe114⤵PID:1720
-
\??\c:\dvjjv.exec:\dvjjv.exe115⤵PID:556
-
\??\c:\htnntt.exec:\htnntt.exe116⤵PID:604
-
\??\c:\hbbttb.exec:\hbbttb.exe117⤵PID:952
-
\??\c:\jddpj.exec:\jddpj.exe118⤵PID:2072
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe119⤵PID:784
-
\??\c:\fxflxxl.exec:\fxflxxl.exe120⤵PID:2896
-
\??\c:\htnhth.exec:\htnhth.exe121⤵PID:1564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-