Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 14:02
Behavioral task
behavioral1
Sample
d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe
- Size 204KB
- Sample240518-rcmrtseg91
- SHA256 b396a976a56deade48f7092c1798ba421c8c402bbb10b990c89bc5ee0077ba5f
- MD5 d32af098f3a9595a4520f26b5d451460
- SHA1 63f6ef0ac617bc01d0c8e9b02cf97577a3d1753f
- SHA512 29298c991aa1719644dab74323ec7fb987a773c8940b5916aeda2577647e060e8f7fe00ee646f7c6a4933d0a7098199a609d2978f9626d4641fe076fe44f1b8f
- SSDEEP 6144:rcm4FmowdHoStBuhW246lCXb7YpdnSj6Ksa1:x4wFHoSLjr0+Hsa1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/3528-4-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4160-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1384-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4200-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5056-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1640-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3016-38-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4560-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4700-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/892-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4704-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1704-81-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2912-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2424-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3920-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1088-120-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5020-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4832-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3196-143-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1944-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4696-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2980-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1320-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2224-195-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3132-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1416-207-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2288-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2184-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/772-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3592-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1936-252-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3520-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2732-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3752-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1212-280-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4772-282-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4780-291-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3680-301-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/632-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4920-324-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4836-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2360-333-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2932-344-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2472-363-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1388-367-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4288-386-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4424-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/664-398-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4492-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2324-445-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2036-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1268-475-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3048-505-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2288-524-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2724-555-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2228-563-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4568-690-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4576-705-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2324-712-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4580-776-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4660-803-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/files/0x00070000000233f2-9.dat family_berbew behavioral2/files/0x00070000000233f3-13.dat family_berbew behavioral2/files/0x00070000000233f4-23.dat family_berbew behavioral2/files/0x00070000000233f5-29.dat family_berbew behavioral2/files/0x00070000000233f6-34.dat family_berbew behavioral2/files/0x00070000000233f7-41.dat family_berbew behavioral2/files/0x00070000000233f8-47.dat family_berbew behavioral2/files/0x00070000000233f9-52.dat family_berbew behavioral2/files/0x00070000000233fa-58.dat family_berbew behavioral2/files/0x00070000000233fb-63.dat family_berbew behavioral2/files/0x00070000000233fd-69.dat family_berbew behavioral2/files/0x00070000000233fe-74.dat family_berbew behavioral2/files/0x00070000000233ff-79.dat family_berbew behavioral2/files/0x0007000000023400-85.dat family_berbew behavioral2/files/0x0007000000023401-90.dat family_berbew behavioral2/files/0x0007000000023402-99.dat family_berbew behavioral2/files/0x0007000000023403-102.dat family_berbew behavioral2/files/0x0007000000023404-109.dat family_berbew behavioral2/files/0x0007000000023405-113.dat family_berbew behavioral2/files/0x0007000000023406-119.dat family_berbew behavioral2/files/0x00080000000233ef-132.dat family_berbew behavioral2/files/0x0007000000023407-127.dat family_berbew behavioral2/files/0x0007000000023409-145.dat family_berbew behavioral2/files/0x0007000000023408-139.dat family_berbew behavioral2/files/0x000700000002340a-149.dat family_berbew behavioral2/files/0x000700000002340b-154.dat family_berbew behavioral2/files/0x000700000002340c-159.dat family_berbew behavioral2/files/0x000700000002340d-165.dat family_berbew behavioral2/files/0x000700000002340e-169.dat family_berbew behavioral2/files/0x000700000002340f-176.dat family_berbew behavioral2/files/0x0007000000023410-181.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 1384 xlfxrlx.exe 4160 vpjvj.exe 4200 vppdp.exe 5056 5tnbnh.exe 1640 djdvj.exe 3016 xfxrlfx.exe 4700 3nbhtt.exe 4560 jjjpp.exe 892 jpdpj.exe 2068 nbthth.exe 4704 dvvpd.exe 2800 pjdvj.exe 1704 nnnhbt.exe 1776 9ppdp.exe 2912 rflfxlf.exe 2424 nhnhnn.exe 3920 jdppj.exe 3680 rxlfrlf.exe 224 frfrffr.exe 1088 tnnhbh.exe 5020 jvvvp.exe 4832 rxrrlrl.exe 1944 hbbtbt.exe 3196 vdddd.exe 2812 5ffxxxx.exe 1248 3hbtnh.exe 4696 hhnnhh.exe 424 3xfxrxf.exe 3200 xllfrrl.exe 2980 vpvpp.exe 3548 rlrlfrr.exe 3280 lxxrllf.exe 1320 jjjvp.exe 2224 vvdvd.exe 2928 fllllll.exe 3132 thttbb.exe 1416 btnhbb.exe 2288 dpjdv.exe 4876 xrllfff.exe 2772 3bbbbb.exe 3156 jppdv.exe 2184 1dvpp.exe 4368 rrfxrll.exe 772 bnnhhh.exe 3432 hhhbtt.exe 1240 pvppp.exe 3524 fllfxrl.exe 3592 rllffxx.exe 3152 thtnbt.exe 2120 rllfxrl.exe 1936 htnhtn.exe 3520 1hbtnn.exe 2732 vpppv.exe 2196 xlfxrlr.exe 3752 lffffff.exe 2804 hbhbhn.exe 2280 hnbttt.exe 1212 1dppp.exe 4772 xflllff.exe 2204 rlllrll.exe 4780 nnnbtt.exe 2052 jvddv.exe 4724 dpdpj.exe 3680 flrlflf.exe -
resource yara_rule behavioral2/memory/3528-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3528-4-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f2-9.dat upx behavioral2/memory/1384-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4160-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1384-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f3-13.dat upx behavioral2/memory/4200-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f4-23.dat upx behavioral2/memory/5056-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f5-29.dat upx behavioral2/memory/1640-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f6-34.dat upx behavioral2/memory/3016-38-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f7-41.dat upx behavioral2/files/0x00070000000233f8-47.dat upx behavioral2/memory/4560-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4700-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233f9-52.dat upx behavioral2/memory/892-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fa-58.dat upx behavioral2/files/0x00070000000233fb-63.dat upx behavioral2/files/0x00070000000233fd-69.dat upx behavioral2/memory/4704-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00070000000233fe-74.dat upx behavioral2/files/0x00070000000233ff-79.dat upx behavioral2/memory/1704-81-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023400-85.dat upx behavioral2/files/0x0007000000023401-90.dat upx behavioral2/memory/2912-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023402-99.dat upx behavioral2/memory/2424-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023403-102.dat upx behavioral2/files/0x0007000000023404-109.dat upx behavioral2/memory/3920-105-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023405-113.dat upx behavioral2/files/0x0007000000023406-119.dat upx behavioral2/memory/1088-120-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5020-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4832-129-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x00080000000233ef-132.dat upx behavioral2/files/0x0007000000023407-127.dat upx behavioral2/files/0x0007000000023409-145.dat upx behavioral2/memory/3196-143-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-139.dat upx behavioral2/memory/1944-137-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340a-149.dat upx behavioral2/files/0x000700000002340b-154.dat upx behavioral2/files/0x000700000002340c-159.dat upx behavioral2/memory/4696-161-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340d-165.dat upx behavioral2/files/0x000700000002340e-169.dat upx behavioral2/memory/2980-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340f-176.dat upx behavioral2/memory/3548-179-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023410-181.dat upx behavioral2/memory/3280-187-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1320-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2224-195-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3132-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1416-207-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2288-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2184-221-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 1384 3528 d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe 83 PID 3528 wrote to memory of 1384 3528 d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe 83 PID 3528 wrote to memory of 1384 3528 d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe 83 PID 1384 wrote to memory of 4160 1384 xlfxrlx.exe 84 PID 1384 wrote to memory of 4160 1384 xlfxrlx.exe 84 PID 1384 wrote to memory of 4160 1384 xlfxrlx.exe 84 PID 4160 wrote to memory of 4200 4160 vpjvj.exe 85 PID 4160 wrote to memory of 4200 4160 vpjvj.exe 85 PID 4160 wrote to memory of 4200 4160 vpjvj.exe 85 PID 4200 wrote to memory of 5056 4200 vppdp.exe 86 PID 4200 wrote to memory of 5056 4200 vppdp.exe 86 PID 4200 wrote to memory of 5056 4200 vppdp.exe 86 PID 5056 wrote to memory of 1640 5056 5tnbnh.exe 87 PID 5056 wrote to memory of 1640 5056 5tnbnh.exe 87 PID 5056 wrote to memory of 1640 5056 5tnbnh.exe 87 PID 1640 wrote to memory of 3016 1640 djdvj.exe 88 PID 1640 wrote to memory of 3016 1640 djdvj.exe 88 PID 1640 wrote to memory of 3016 1640 djdvj.exe 88 PID 3016 wrote to memory of 4700 3016 xfxrlfx.exe 89 PID 3016 wrote to memory of 4700 3016 xfxrlfx.exe 89 PID 3016 wrote to memory of 4700 3016 xfxrlfx.exe 89 PID 4700 wrote to memory of 4560 4700 3nbhtt.exe 90 PID 4700 wrote to memory of 4560 4700 3nbhtt.exe 90 PID 4700 wrote to memory of 4560 4700 3nbhtt.exe 90 PID 4560 wrote to memory of 892 4560 jjjpp.exe 91 PID 4560 wrote to memory of 892 4560 jjjpp.exe 91 PID 4560 wrote to memory of 892 4560 jjjpp.exe 91 PID 892 wrote to memory of 2068 892 jpdpj.exe 92 PID 892 wrote to memory of 2068 892 jpdpj.exe 92 PID 892 wrote to memory of 2068 892 jpdpj.exe 92 PID 2068 wrote to memory of 4704 2068 nbthth.exe 93 PID 2068 wrote to memory of 4704 2068 nbthth.exe 93 PID 2068 wrote to memory of 4704 2068 nbthth.exe 93 PID 4704 wrote to memory of 2800 4704 dvvpd.exe 94 PID 4704 wrote to memory of 2800 4704 dvvpd.exe 94 PID 4704 wrote to memory of 2800 4704 dvvpd.exe 94 PID 2800 wrote to memory of 1704 2800 pjdvj.exe 95 PID 2800 wrote to memory of 1704 2800 pjdvj.exe 95 PID 2800 wrote to memory of 1704 2800 pjdvj.exe 95 PID 1704 wrote to memory of 1776 1704 nnnhbt.exe 96 PID 1704 wrote to memory of 1776 1704 nnnhbt.exe 96 PID 1704 wrote to memory of 1776 1704 nnnhbt.exe 96 PID 1776 wrote to memory of 2912 1776 9ppdp.exe 97 PID 1776 wrote to memory of 2912 1776 9ppdp.exe 97 PID 1776 wrote to memory of 2912 1776 9ppdp.exe 97 PID 2912 wrote to memory of 2424 2912 rflfxlf.exe 98 PID 2912 wrote to memory of 2424 2912 rflfxlf.exe 98 PID 2912 wrote to memory of 2424 2912 rflfxlf.exe 98 PID 2424 wrote to memory of 3920 2424 nhnhnn.exe 99 PID 2424 wrote to memory of 3920 2424 nhnhnn.exe 99 PID 2424 wrote to memory of 3920 2424 nhnhnn.exe 99 PID 3920 wrote to memory of 3680 3920 jdppj.exe 100 PID 3920 wrote to memory of 3680 3920 jdppj.exe 100 PID 3920 wrote to memory of 3680 3920 jdppj.exe 100 PID 3680 wrote to memory of 224 3680 rxlfrlf.exe 101 PID 3680 wrote to memory of 224 3680 rxlfrlf.exe 101 PID 3680 wrote to memory of 224 3680 rxlfrlf.exe 101 PID 224 wrote to memory of 1088 224 frfrffr.exe 102 PID 224 wrote to memory of 1088 224 frfrffr.exe 102 PID 224 wrote to memory of 1088 224 frfrffr.exe 102 PID 1088 wrote to memory of 5020 1088 tnnhbh.exe 103 PID 1088 wrote to memory of 5020 1088 tnnhbh.exe 103 PID 1088 wrote to memory of 5020 1088 tnnhbh.exe 103 PID 5020 wrote to memory of 4832 5020 jvvvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d32af098f3a9595a4520f26b5d451460_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\xlfxrlx.exec:\xlfxrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\vpjvj.exec:\vpjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\vppdp.exec:\vppdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\5tnbnh.exec:\5tnbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\djdvj.exec:\djdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3nbhtt.exec:\3nbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\jjjpp.exec:\jjjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\jpdpj.exec:\jpdpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nbthth.exec:\nbthth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\dvvpd.exec:\dvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\pjdvj.exec:\pjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nnnhbt.exec:\nnnhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\9ppdp.exec:\9ppdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\rflfxlf.exec:\rflfxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nhnhnn.exec:\nhnhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jdppj.exec:\jdppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\rxlfrlf.exec:\rxlfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\frfrffr.exec:\frfrffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\tnnhbh.exec:\tnnhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\jvvvp.exec:\jvvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe23⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hbbtbt.exec:\hbbtbt.exe24⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vdddd.exec:\vdddd.exe25⤵
- Executes dropped EXE
PID:3196 -
\??\c:\5ffxxxx.exec:\5ffxxxx.exe26⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3hbtnh.exec:\3hbtnh.exe27⤵
- Executes dropped EXE
PID:1248 -
\??\c:\hhnnhh.exec:\hhnnhh.exe28⤵
- Executes dropped EXE
PID:4696 -
\??\c:\3xfxrxf.exec:\3xfxrxf.exe29⤵
- Executes dropped EXE
PID:424 -
\??\c:\xllfrrl.exec:\xllfrrl.exe30⤵
- Executes dropped EXE
PID:3200 -
\??\c:\vpvpp.exec:\vpvpp.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rlrlfrr.exec:\rlrlfrr.exe32⤵
- Executes dropped EXE
PID:3548 -
\??\c:\lxxrllf.exec:\lxxrllf.exe33⤵
- Executes dropped EXE
PID:3280 -
\??\c:\jjjvp.exec:\jjjvp.exe34⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vvdvd.exec:\vvdvd.exe35⤵
- Executes dropped EXE
PID:2224 -
\??\c:\fllllll.exec:\fllllll.exe36⤵
- Executes dropped EXE
PID:2928 -
\??\c:\thttbb.exec:\thttbb.exe37⤵
- Executes dropped EXE
PID:3132 -
\??\c:\btnhbb.exec:\btnhbb.exe38⤵
- Executes dropped EXE
PID:1416 -
\??\c:\dpjdv.exec:\dpjdv.exe39⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrllfff.exec:\xrllfff.exe40⤵
- Executes dropped EXE
PID:4876 -
\??\c:\3bbbbb.exec:\3bbbbb.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jppdv.exec:\jppdv.exe42⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1dvpp.exec:\1dvpp.exe43⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrfxrll.exec:\rrfxrll.exe44⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bnnhhh.exec:\bnnhhh.exe45⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhhbtt.exec:\hhhbtt.exe46⤵
- Executes dropped EXE
PID:3432 -
\??\c:\pvppp.exec:\pvppp.exe47⤵
- Executes dropped EXE
PID:1240 -
\??\c:\fllfxrl.exec:\fllfxrl.exe48⤵
- Executes dropped EXE
PID:3524 -
\??\c:\rllffxx.exec:\rllffxx.exe49⤵
- Executes dropped EXE
PID:3592 -
\??\c:\thtnbt.exec:\thtnbt.exe50⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rllfxrl.exec:\rllfxrl.exe51⤵
- Executes dropped EXE
PID:2120 -
\??\c:\htnhtn.exec:\htnhtn.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1hbtnn.exec:\1hbtnn.exe53⤵
- Executes dropped EXE
PID:3520 -
\??\c:\vpppv.exec:\vpppv.exe54⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xlfxrlr.exec:\xlfxrlr.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lffffff.exec:\lffffff.exe56⤵
- Executes dropped EXE
PID:3752 -
\??\c:\hbhbhn.exec:\hbhbhn.exe57⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hnbttt.exec:\hnbttt.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1dppp.exec:\1dppp.exe59⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xflllff.exec:\xflllff.exe60⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rlllrll.exec:\rlllrll.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nnnbtt.exec:\nnnbtt.exe62⤵
- Executes dropped EXE
PID:4780 -
\??\c:\jvddv.exec:\jvddv.exe63⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dpdpj.exec:\dpdpj.exe64⤵
- Executes dropped EXE
PID:4724 -
\??\c:\flrlflf.exec:\flrlflf.exe65⤵
- Executes dropped EXE
PID:3680 -
\??\c:\tnntnn.exec:\tnntnn.exe66⤵PID:4760
-
\??\c:\5vpjp.exec:\5vpjp.exe67⤵PID:2672
-
\??\c:\vpjjd.exec:\vpjjd.exe68⤵PID:1804
-
\??\c:\dvjvd.exec:\dvjvd.exe69⤵PID:632
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe70⤵PID:1244
-
\??\c:\tnnhbb.exec:\tnnhbb.exe71⤵PID:4992
-
\??\c:\nhtnhn.exec:\nhtnhn.exe72⤵PID:4920
-
\??\c:\jdjdv.exec:\jdjdv.exe73⤵PID:4712
-
\??\c:\3jdvj.exec:\3jdvj.exe74⤵PID:4836
-
\??\c:\xrrrrlf.exec:\xrrrrlf.exe75⤵PID:2360
-
\??\c:\tnnttb.exec:\tnnttb.exe76⤵PID:3172
-
\??\c:\3ntbnn.exec:\3ntbnn.exe77⤵PID:2932
-
\??\c:\pvjjd.exec:\pvjjd.exe78⤵PID:2096
-
\??\c:\vddvj.exec:\vddvj.exe79⤵PID:4592
-
\??\c:\3bbhtt.exec:\3bbhtt.exe80⤵PID:1660
-
\??\c:\5bhhbb.exec:\5bhhbb.exe81⤵PID:1584
-
\??\c:\dvddv.exec:\dvddv.exe82⤵PID:1592
-
\??\c:\lllfrlf.exec:\lllfrlf.exe83⤵PID:2472
-
\??\c:\thhbbb.exec:\thhbbb.exe84⤵PID:1388
-
\??\c:\jdddp.exec:\jdddp.exe85⤵PID:4840
-
\??\c:\jdjvp.exec:\jdjvp.exe86⤵PID:4664
-
\??\c:\lxffxxx.exec:\lxffxxx.exe87⤵PID:1768
-
\??\c:\bnhbth.exec:\bnhbth.exe88⤵PID:4020
-
\??\c:\vpvpp.exec:\vpvpp.exe89⤵PID:4880
-
\??\c:\ddppp.exec:\ddppp.exe90⤵PID:4288
-
\??\c:\frrrllr.exec:\frrrllr.exe91⤵PID:4424
-
\??\c:\3hhnhn.exec:\3hhnhn.exe92⤵PID:3156
-
\??\c:\hbhbhh.exec:\hbhbhh.exe93⤵PID:4220
-
\??\c:\dvppp.exec:\dvppp.exe94⤵PID:664
-
\??\c:\jdvpj.exec:\jdvpj.exe95⤵PID:4492
-
\??\c:\lxrffxx.exec:\lxrffxx.exe96⤵PID:2820
-
\??\c:\nthbbt.exec:\nthbbt.exe97⤵PID:3592
-
\??\c:\tnnhhh.exec:\tnnhhh.exe98⤵PID:3152
-
\??\c:\djvpv.exec:\djvpv.exe99⤵PID:1936
-
\??\c:\rlrfrlf.exec:\rlrfrlf.exe100⤵PID:2044
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe101⤵PID:2228
-
\??\c:\3ttnhh.exec:\3ttnhh.exe102⤵PID:1140
-
\??\c:\3bbtnh.exec:\3bbtnh.exe103⤵PID:4060
-
\??\c:\vdddv.exec:\vdddv.exe104⤵PID:2760
-
\??\c:\flflrrx.exec:\flflrrx.exe105⤵PID:4856
-
\??\c:\7nhhtn.exec:\7nhhtn.exe106⤵PID:3284
-
\??\c:\pjjdv.exec:\pjjdv.exe107⤵PID:5100
-
\??\c:\lflxxrf.exec:\lflxxrf.exe108⤵PID:2324
-
\??\c:\xflfxrr.exec:\xflfxrr.exe109⤵PID:208
-
\??\c:\5tnbtn.exec:\5tnbtn.exe110⤵PID:220
-
\??\c:\vpjvj.exec:\vpjvj.exe111⤵PID:3124
-
\??\c:\5xllfll.exec:\5xllfll.exe112⤵PID:2036
-
\??\c:\9llxrlx.exec:\9llxrlx.exe113⤵PID:3992
-
\??\c:\tttnbb.exec:\tttnbb.exe114⤵PID:4224
-
\??\c:\vdvpd.exec:\vdvpd.exe115⤵PID:3344
-
\??\c:\ddvpd.exec:\ddvpd.exe116⤵PID:5004
-
\??\c:\frrfrrf.exec:\frrfrrf.exe117⤵PID:4920
-
\??\c:\frrxlrl.exec:\frrxlrl.exe118⤵PID:1268
-
\??\c:\nbthtb.exec:\nbthtb.exe119⤵PID:3140
-
\??\c:\nbbnhb.exec:\nbbnhb.exe120⤵PID:1632
-
\??\c:\djjpj.exec:\djjpj.exe121⤵PID:3136
-
\??\c:\xrllxrl.exec:\xrllxrl.exe122⤵PID:3776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-