Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:26
Behavioral task
behavioral1
Sample
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe
-
Size
214KB
-
MD5
2a3e913357b13787491af6f585e14730
-
SHA1
47561dfce54b352e8fbbcecdf3d58f6ad33a9e73
-
SHA256
cf0b860b7f26e20a2c66174002e7e76ec5610817abfac351f5169cc1c70e1857
-
SHA512
f360573afcfe5c02776d78deda4af793cf2c8144bd078056913c3cccb7195be3635d79f3b303c36b1a576532f10b97bdc11a368c7adad046a2d335994c502ed9
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePe:Zcm7ImGddXEu0ucju6/4kf724f
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-13-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3068-10-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2616-27-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2292-37-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2284-47-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2796-49-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2796-57-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2824-66-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2696-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3064-101-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2968-118-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1496-135-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/288-156-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1612-153-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1320-173-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2480-191-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2480-193-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1332-256-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1032-265-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/956-274-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2380-292-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2200-298-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2124-305-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2844-312-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2844-320-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2788-353-0x00000000002C0000-0x00000000002ED000-memory.dmp family_blackmoon behavioral1/memory/2816-361-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2556-375-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1360-427-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1496-439-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2744-464-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/824-465-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1528-535-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2684-645-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2276-667-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2340-687-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1820-841-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1836-889-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2728-926-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1392-1051-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2428-1150-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\pjdjv.exe family_berbew C:\llxrxxl.exe family_berbew \??\c:\jjvjv.exe family_berbew C:\jdpdp.exe family_berbew C:\hbnhnh.exe family_berbew C:\7httnh.exe family_berbew C:\9lfrxxr.exe family_berbew C:\btnhhn.exe family_berbew C:\jdppj.exe family_berbew C:\xrlrxfl.exe family_berbew C:\bbtbnb.exe family_berbew C:\jdppv.exe family_berbew C:\rlfflrf.exe family_berbew C:\tnhtbt.exe family_berbew C:\1vjpj.exe family_berbew C:\lfflrrx.exe family_berbew C:\hhhhhh.exe family_berbew C:\pppvp.exe family_berbew C:\5htbbh.exe family_berbew C:\nhhntt.exe family_berbew C:\vvvjv.exe family_berbew C:\xrxlrrf.exe family_berbew C:\9tthbb.exe family_berbew C:\jjvjv.exe family_berbew C:\1rflfrx.exe family_berbew C:\nnthbn.exe family_berbew C:\vpdjp.exe family_berbew C:\vvjvd.exe family_berbew C:\nhnhnb.exe family_berbew C:\9djpv.exe family_berbew C:\7xlxxff.exe family_berbew C:\nbttbb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
pjdjv.exejjvjv.exellxrxxl.exejdpdp.exehbnhnh.exe7httnh.exe9lfrxxr.exebtnhhn.exejdppj.exexrlrxfl.exebbtbnb.exejdppv.exerlfflrf.exetnhtbt.exe1vjpj.exelfflrrx.exehhhhhh.exepppvp.exe5htbbh.exenhhntt.exevvvjv.exexrxlrrf.exe9tthbb.exejjvjv.exe1rflfrx.exennthbn.exevpdjp.exevvjvd.exenhnhnb.exe9djpv.exe7xlxxff.exenbttbb.exevvjpv.exevvvjv.exerrfxxrf.exe7bhnnb.exevpjpv.exe9vvdp.exerfllfff.exehnnbbt.exe5jdjd.exe1jjpj.exerlffrfl.exetnhhtt.exehhhbnb.exe3dpvj.exexrlfxxr.exennhthn.exejdvdd.exejjvvp.exe9xxrfrf.exefxllrxf.exebthnbt.exepddpv.exe5fflxfr.exerxrfxlx.exebthttb.exejjddv.exedddpv.exexfxlxlf.exe3hbhbb.exebtthth.exe5jjjd.exe5vpdd.exepid process 1836 pjdjv.exe 2616 jjvjv.exe 2292 llxrxxl.exe 2284 jdpdp.exe 2796 hbnhnh.exe 2824 7httnh.exe 2564 9lfrxxr.exe 2696 btnhhn.exe 2548 jdppj.exe 3064 xrlrxfl.exe 1928 bbtbnb.exe 2968 jdppv.exe 2988 rlfflrf.exe 1496 tnhtbt.exe 1736 1vjpj.exe 1612 lfflrrx.exe 288 hhhhhh.exe 2772 pppvp.exe 1320 5htbbh.exe 852 nhhntt.exe 2480 vvvjv.exe 1668 xrxlrrf.exe 1084 9tthbb.exe 1808 jjvjv.exe 448 1rflfrx.exe 2388 nnthbn.exe 1348 vpdjp.exe 1332 vvjvd.exe 1032 nhnhnb.exe 956 9djpv.exe 2428 7xlxxff.exe 2436 nbttbb.exe 2380 vvjpv.exe 2200 vvvjv.exe 2124 rrfxxrf.exe 2844 7bhnnb.exe 1544 vpjpv.exe 1276 9vvdp.exe 2848 rfllfff.exe 2672 hnnbbt.exe 2788 5jdjd.exe 2800 1jjpj.exe 2816 rlffrfl.exe 2704 tnhhtt.exe 2556 hhhbnb.exe 2544 3dpvj.exe 1660 xrlfxxr.exe 2064 nnhthn.exe 3064 jdvdd.exe 3016 jjvvp.exe 3004 9xxrfrf.exe 1012 fxllrxf.exe 1360 bthnbt.exe 1496 pddpv.exe 1588 5fflxfr.exe 1108 rxrfxlx.exe 2760 bthttb.exe 2744 jjddv.exe 824 dddpv.exe 1300 xfxlxlf.exe 672 3hbhbb.exe 2508 btthth.exe 2912 5jjjd.exe 1620 5vpdd.exe -
Processes:
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1836-13-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3068-10-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2616-27-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2292-29-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2292-37-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2284-47-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2796-49-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2796-57-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2824-66-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2696-75-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2696-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3064-101-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2968-118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1496-135-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/288-156-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1612-153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1320-173-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2480-191-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1332-256-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1032-265-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/956-274-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2380-292-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2200-298-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2124-305-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2844-312-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2848-333-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2816-361-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2556-375-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2544-382-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1360-427-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1496-439-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2744-464-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/824-465-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1620-497-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/448-522-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1528-535-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2636-631-0x00000000001B0000-0x00000000001DD000-memory.dmp upx behavioral1/memory/1580-649-0x00000000001B0000-0x00000000001DD000-memory.dmp upx behavioral1/memory/2276-660-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2276-667-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2528-668-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2340-687-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2972-700-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1328-834-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1820-841-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1836-889-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/1696-907-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2728-926-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2684-933-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3028-991-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2988-998-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/900-1005-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2744-1038-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1392-1051-0x0000000000220000-0x000000000024D000-memory.dmp upx behavioral1/memory/2496-1118-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2408-1137-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2428-1150-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1540-1184-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2660-1197-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2a3e913357b13787491af6f585e14730_NeikiAnalytics.exepjdjv.exejjvjv.exellxrxxl.exejdpdp.exehbnhnh.exe7httnh.exe9lfrxxr.exebtnhhn.exejdppj.exexrlrxfl.exebbtbnb.exejdppv.exerlfflrf.exetnhtbt.exe1vjpj.exedescription pid process target process PID 3068 wrote to memory of 1836 3068 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe pjdjv.exe PID 3068 wrote to memory of 1836 3068 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe pjdjv.exe PID 3068 wrote to memory of 1836 3068 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe pjdjv.exe PID 3068 wrote to memory of 1836 3068 2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe pjdjv.exe PID 1836 wrote to memory of 2616 1836 pjdjv.exe jjvjv.exe PID 1836 wrote to memory of 2616 1836 pjdjv.exe jjvjv.exe PID 1836 wrote to memory of 2616 1836 pjdjv.exe jjvjv.exe PID 1836 wrote to memory of 2616 1836 pjdjv.exe jjvjv.exe PID 2616 wrote to memory of 2292 2616 jjvjv.exe llxrxxl.exe PID 2616 wrote to memory of 2292 2616 jjvjv.exe llxrxxl.exe PID 2616 wrote to memory of 2292 2616 jjvjv.exe llxrxxl.exe PID 2616 wrote to memory of 2292 2616 jjvjv.exe llxrxxl.exe PID 2292 wrote to memory of 2284 2292 llxrxxl.exe jdpdp.exe PID 2292 wrote to memory of 2284 2292 llxrxxl.exe jdpdp.exe PID 2292 wrote to memory of 2284 2292 llxrxxl.exe jdpdp.exe PID 2292 wrote to memory of 2284 2292 llxrxxl.exe jdpdp.exe PID 2284 wrote to memory of 2796 2284 jdpdp.exe hbnhnh.exe PID 2284 wrote to memory of 2796 2284 jdpdp.exe hbnhnh.exe PID 2284 wrote to memory of 2796 2284 jdpdp.exe hbnhnh.exe PID 2284 wrote to memory of 2796 2284 jdpdp.exe hbnhnh.exe PID 2796 wrote to memory of 2824 2796 hbnhnh.exe 7httnh.exe PID 2796 wrote to memory of 2824 2796 hbnhnh.exe 7httnh.exe PID 2796 wrote to memory of 2824 2796 hbnhnh.exe 7httnh.exe PID 2796 wrote to memory of 2824 2796 hbnhnh.exe 7httnh.exe PID 2824 wrote to memory of 2564 2824 7httnh.exe 9lfrxxr.exe PID 2824 wrote to memory of 2564 2824 7httnh.exe 9lfrxxr.exe PID 2824 wrote to memory of 2564 2824 7httnh.exe 9lfrxxr.exe PID 2824 wrote to memory of 2564 2824 7httnh.exe 9lfrxxr.exe PID 2564 wrote to memory of 2696 2564 9lfrxxr.exe btnhhn.exe PID 2564 wrote to memory of 2696 2564 9lfrxxr.exe btnhhn.exe PID 2564 wrote to memory of 2696 2564 9lfrxxr.exe btnhhn.exe PID 2564 wrote to memory of 2696 2564 9lfrxxr.exe btnhhn.exe PID 2696 wrote to memory of 2548 2696 btnhhn.exe jdppj.exe PID 2696 wrote to memory of 2548 2696 btnhhn.exe jdppj.exe PID 2696 wrote to memory of 2548 2696 btnhhn.exe jdppj.exe PID 2696 wrote to memory of 2548 2696 btnhhn.exe jdppj.exe PID 2548 wrote to memory of 3064 2548 jdppj.exe xrlrxfl.exe PID 2548 wrote to memory of 3064 2548 jdppj.exe xrlrxfl.exe PID 2548 wrote to memory of 3064 2548 jdppj.exe xrlrxfl.exe PID 2548 wrote to memory of 3064 2548 jdppj.exe xrlrxfl.exe PID 3064 wrote to memory of 1928 3064 xrlrxfl.exe bbtbnb.exe PID 3064 wrote to memory of 1928 3064 xrlrxfl.exe bbtbnb.exe PID 3064 wrote to memory of 1928 3064 xrlrxfl.exe bbtbnb.exe PID 3064 wrote to memory of 1928 3064 xrlrxfl.exe bbtbnb.exe PID 1928 wrote to memory of 2968 1928 bbtbnb.exe jdppv.exe PID 1928 wrote to memory of 2968 1928 bbtbnb.exe jdppv.exe PID 1928 wrote to memory of 2968 1928 bbtbnb.exe jdppv.exe PID 1928 wrote to memory of 2968 1928 bbtbnb.exe jdppv.exe PID 2968 wrote to memory of 2988 2968 jdppv.exe rlfflrf.exe PID 2968 wrote to memory of 2988 2968 jdppv.exe rlfflrf.exe PID 2968 wrote to memory of 2988 2968 jdppv.exe rlfflrf.exe PID 2968 wrote to memory of 2988 2968 jdppv.exe rlfflrf.exe PID 2988 wrote to memory of 1496 2988 rlfflrf.exe tnhtbt.exe PID 2988 wrote to memory of 1496 2988 rlfflrf.exe tnhtbt.exe PID 2988 wrote to memory of 1496 2988 rlfflrf.exe tnhtbt.exe PID 2988 wrote to memory of 1496 2988 rlfflrf.exe tnhtbt.exe PID 1496 wrote to memory of 1736 1496 tnhtbt.exe 1vjpj.exe PID 1496 wrote to memory of 1736 1496 tnhtbt.exe 1vjpj.exe PID 1496 wrote to memory of 1736 1496 tnhtbt.exe 1vjpj.exe PID 1496 wrote to memory of 1736 1496 tnhtbt.exe 1vjpj.exe PID 1736 wrote to memory of 1612 1736 1vjpj.exe lfflrrx.exe PID 1736 wrote to memory of 1612 1736 1vjpj.exe lfflrrx.exe PID 1736 wrote to memory of 1612 1736 1vjpj.exe lfflrrx.exe PID 1736 wrote to memory of 1612 1736 1vjpj.exe lfflrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2a3e913357b13787491af6f585e14730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pjdjv.exec:\pjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\jjvjv.exec:\jjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llxrxxl.exec:\llxrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jdpdp.exec:\jdpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hbnhnh.exec:\hbnhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\7httnh.exec:\7httnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9lfrxxr.exec:\9lfrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\btnhhn.exec:\btnhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jdppj.exec:\jdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\bbtbnb.exec:\bbtbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rlfflrf.exec:\rlfflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\tnhtbt.exec:\tnhtbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1vjpj.exec:\1vjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\lfflrrx.exec:\lfflrrx.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhhhhh.exec:\hhhhhh.exe18⤵
- Executes dropped EXE
PID:288 -
\??\c:\pppvp.exec:\pppvp.exe19⤵
- Executes dropped EXE
PID:2772 -
\??\c:\5htbbh.exec:\5htbbh.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nhhntt.exec:\nhhntt.exe21⤵
- Executes dropped EXE
PID:852 -
\??\c:\vvvjv.exec:\vvvjv.exe22⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xrxlrrf.exec:\xrxlrrf.exe23⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9tthbb.exec:\9tthbb.exe24⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jjvjv.exec:\jjvjv.exe25⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1rflfrx.exec:\1rflfrx.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\nnthbn.exec:\nnthbn.exe27⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpdjp.exec:\vpdjp.exe28⤵
- Executes dropped EXE
PID:1348 -
\??\c:\vvjvd.exec:\vvjvd.exe29⤵
- Executes dropped EXE
PID:1332 -
\??\c:\nhnhnb.exec:\nhnhnb.exe30⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9djpv.exec:\9djpv.exe31⤵
- Executes dropped EXE
PID:956 -
\??\c:\7xlxxff.exec:\7xlxxff.exe32⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nbttbb.exec:\nbttbb.exe33⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vvjpv.exec:\vvjpv.exe34⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vvvjv.exec:\vvvjv.exe35⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rrfxxrf.exec:\rrfxxrf.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7bhnnb.exec:\7bhnnb.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vpjpv.exec:\vpjpv.exe38⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9vvdp.exec:\9vvdp.exe39⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rfllfff.exec:\rfllfff.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hnnbbt.exec:\hnnbbt.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5jdjd.exec:\5jdjd.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1jjpj.exec:\1jjpj.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rlffrfl.exec:\rlffrfl.exe44⤵
- Executes dropped EXE
PID:2816 -
\??\c:\tnhhtt.exec:\tnhhtt.exe45⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhhbnb.exec:\hhhbnb.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3dpvj.exec:\3dpvj.exe47⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe48⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnhthn.exec:\nnhthn.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdvdd.exec:\jdvdd.exe50⤵
- Executes dropped EXE
PID:3064 -
\??\c:\jjvvp.exec:\jjvvp.exe51⤵
- Executes dropped EXE
PID:3016 -
\??\c:\9xxrfrf.exec:\9xxrfrf.exe52⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fxllrxf.exec:\fxllrxf.exe53⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bthnbt.exec:\bthnbt.exe54⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pddpv.exec:\pddpv.exe55⤵
- Executes dropped EXE
PID:1496 -
\??\c:\5fflxfr.exec:\5fflxfr.exe56⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe57⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bthttb.exec:\bthttb.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jjddv.exec:\jjddv.exe59⤵
- Executes dropped EXE
PID:2744 -
\??\c:\dddpv.exec:\dddpv.exe60⤵
- Executes dropped EXE
PID:824 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3hbhbb.exec:\3hbhbb.exe62⤵
- Executes dropped EXE
PID:672 -
\??\c:\btthth.exec:\btthth.exe63⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5jjjd.exec:\5jjjd.exe64⤵
- Executes dropped EXE
PID:2912 -
\??\c:\5vpdd.exec:\5vpdd.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ffxlllx.exec:\ffxlllx.exe66⤵PID:1844
-
\??\c:\bhbnbb.exec:\bhbnbb.exe67⤵PID:1608
-
\??\c:\7btntb.exec:\7btntb.exe68⤵PID:1848
-
\??\c:\vvpvp.exec:\vvpvp.exe69⤵PID:448
-
\??\c:\flfffxf.exec:\flfffxf.exe70⤵PID:1528
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe71⤵PID:692
-
\??\c:\tnbtbb.exec:\tnbtbb.exe72⤵PID:1856
-
\??\c:\jjddp.exec:\jjddp.exe73⤵PID:1332
-
\??\c:\1pvvj.exec:\1pvvj.exe74⤵PID:604
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe75⤵PID:1644
-
\??\c:\bbttht.exec:\bbttht.exe76⤵PID:2400
-
\??\c:\pjdjd.exec:\pjdjd.exe77⤵PID:2096
-
\??\c:\pdvvv.exec:\pdvvv.exe78⤵PID:876
-
\??\c:\xrxfllr.exec:\xrxfllr.exe79⤵PID:1688
-
\??\c:\3fffxfx.exec:\3fffxfx.exe80⤵PID:2184
-
\??\c:\nhhntt.exec:\nhhntt.exe81⤵PID:812
-
\??\c:\jdvdj.exec:\jdvdj.exe82⤵PID:2884
-
\??\c:\1dpvj.exec:\1dpvj.exe83⤵PID:2008
-
\??\c:\frllrfl.exec:\frllrfl.exe84⤵PID:1272
-
\??\c:\btbhtt.exec:\btbhtt.exe85⤵PID:2636
-
\??\c:\bbtttb.exec:\bbtttb.exe86⤵PID:2732
-
\??\c:\dvpvj.exec:\dvpvj.exe87⤵PID:2684
-
\??\c:\5lxxrlx.exec:\5lxxrlx.exe88⤵PID:1580
-
\??\c:\7nbbtb.exec:\7nbbtb.exe89⤵PID:2088
-
\??\c:\3nbhbb.exec:\3nbhbb.exe90⤵PID:2276
-
\??\c:\vjvdd.exec:\vjvdd.exe91⤵PID:2528
-
\??\c:\9frrxxf.exec:\9frrxxf.exe92⤵PID:2652
-
\??\c:\nhthnn.exec:\nhthnn.exe93⤵PID:2340
-
\??\c:\3tthnt.exec:\3tthnt.exe94⤵PID:1592
-
\??\c:\jdvpd.exec:\jdvpd.exe95⤵PID:2984
-
\??\c:\rlxfxxr.exec:\rlxfxxr.exe96⤵PID:2972
-
\??\c:\lxxxlfl.exec:\lxxxlfl.exe97⤵PID:2492
-
\??\c:\bbttnh.exec:\bbttnh.exe98⤵PID:2820
-
\??\c:\tnbbnn.exec:\tnbbnn.exe99⤵PID:800
-
\??\c:\jjdpd.exec:\jjdpd.exe100⤵PID:2164
-
\??\c:\rflrrxf.exec:\rflrrxf.exe101⤵PID:2232
-
\??\c:\thtnbh.exec:\thtnbh.exe102⤵PID:1628
-
\??\c:\hhhtbh.exec:\hhhtbh.exe103⤵PID:340
-
\??\c:\ppjvp.exec:\ppjvp.exe104⤵PID:1916
-
\??\c:\vjppv.exec:\vjppv.exe105⤵PID:1428
-
\??\c:\fxxlxfx.exec:\fxxlxfx.exe106⤵PID:1320
-
\??\c:\bthttt.exec:\bthttt.exe107⤵PID:1184
-
\??\c:\nnhtbb.exec:\nnhtbb.exe108⤵PID:2928
-
\??\c:\vpjvd.exec:\vpjvd.exe109⤵PID:2020
-
\??\c:\lfflrxl.exec:\lfflrxl.exe110⤵PID:2472
-
\??\c:\xrxlrrr.exec:\xrxlrrr.exe111⤵PID:1620
-
\??\c:\bbthbb.exec:\bbthbb.exe112⤵PID:1912
-
\??\c:\vjvpp.exec:\vjvpp.exe113⤵PID:1608
-
\??\c:\jvjdp.exec:\jvjdp.exe114⤵PID:832
-
\??\c:\xrxflfr.exec:\xrxflfr.exe115⤵PID:2212
-
\??\c:\ttbhhh.exec:\ttbhhh.exe116⤵PID:1968
-
\??\c:\tbtnth.exec:\tbtnth.exe117⤵PID:2128
-
\??\c:\vdjdp.exec:\vdjdp.exe118⤵PID:1328
-
\??\c:\llxxrlx.exec:\llxxrlx.exe119⤵PID:1820
-
\??\c:\xxrfxfr.exec:\xxrfxfr.exe120⤵PID:1784
-
\??\c:\tnbhhh.exec:\tnbhhh.exe121⤵PID:2932
-
\??\c:\jdjdd.exec:\jdjdd.exe122⤵PID:2316
-
\??\c:\vppjp.exec:\vppjp.exe123⤵PID:2948
-
\??\c:\lffflrr.exec:\lffflrr.exe124⤵PID:1672
-
\??\c:\7frxrrf.exec:\7frxrrf.exe125⤵PID:2456
-
\??\c:\5bnttb.exec:\5bnttb.exe126⤵PID:1836
-
\??\c:\vjvvj.exec:\vjvvj.exe127⤵PID:1568
-
\??\c:\vpjjj.exec:\vpjjj.exe128⤵PID:2168
-
\??\c:\xlxfxfl.exec:\xlxfxfl.exe129⤵PID:1696
-
\??\c:\hhthnn.exec:\hhthnn.exe130⤵PID:2688
-
\??\c:\nhbbhh.exec:\nhbbhh.exe131⤵PID:2636
-
\??\c:\jdpvd.exec:\jdpvd.exe132⤵PID:2728
-
\??\c:\5pjjv.exec:\5pjjv.exe133⤵PID:2684
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe134⤵PID:1580
-
\??\c:\bbntnt.exec:\bbntnt.exe135⤵PID:2088
-
\??\c:\vpdjj.exec:\vpdjj.exe136⤵PID:2276
-
\??\c:\ddjjv.exec:\ddjjv.exe137⤵PID:2608
-
\??\c:\5frrllr.exec:\5frrllr.exe138⤵PID:2560
-
\??\c:\rlflrxx.exec:\rlflrxx.exe139⤵PID:2236
-
\??\c:\9nnhth.exec:\9nnhth.exe140⤵PID:2064
-
\??\c:\hhnnbh.exec:\hhnnbh.exe141⤵PID:3032
-
\??\c:\ppvdj.exec:\ppvdj.exe142⤵PID:3028
-
\??\c:\fxxflxf.exec:\fxxflxf.exe143⤵PID:2988
-
\??\c:\3bttbb.exec:\3bttbb.exe144⤵PID:900
-
\??\c:\nnbhbh.exec:\nnbhbh.exe145⤵PID:1548
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe146⤵PID:2164
-
\??\c:\xrxrxfr.exec:\xrxrxfr.exe147⤵PID:2752
-
\??\c:\hhhnhh.exec:\hhhnhh.exe148⤵PID:2632
-
\??\c:\hbnbhn.exec:\hbnbhn.exe149⤵PID:2744
-
\??\c:\9jvdp.exec:\9jvdp.exe150⤵PID:1392
-
\??\c:\rxfffrf.exec:\rxfffrf.exe151⤵PID:1676
-
\??\c:\nhbhtt.exec:\nhbhtt.exe152⤵PID:672
-
\??\c:\3nnthn.exec:\3nnthn.exe153⤵PID:2112
-
\??\c:\dvppv.exec:\dvppv.exe154⤵PID:2912
-
\??\c:\llflrxl.exec:\llflrxl.exe155⤵PID:2036
-
\??\c:\hnhhnh.exec:\hnhhnh.exe156⤵PID:2488
-
\??\c:\bbttnt.exec:\bbttnt.exe157⤵PID:1844
-
\??\c:\1pvpj.exec:\1pvpj.exe158⤵PID:1132
-
\??\c:\fxlxxxl.exec:\fxlxxxl.exe159⤵PID:1964
-
\??\c:\7xlrffr.exec:\7xlrffr.exe160⤵PID:2000
-
\??\c:\1nbbnn.exec:\1nbbnn.exe161⤵PID:2444
-
\??\c:\pvvvj.exec:\pvvvj.exe162⤵PID:2496
-
\??\c:\vvjpd.exec:\vvjpd.exe163⤵PID:1856
-
\??\c:\frlxxxf.exec:\frlxxxf.exe164⤵PID:2392
-
\??\c:\rlxrffx.exec:\rlxrffx.exe165⤵PID:2408
-
\??\c:\bhnbth.exec:\bhnbth.exe166⤵PID:2428
-
\??\c:\pjdjp.exec:\pjdjp.exe167⤵PID:2932
-
\??\c:\7vjvv.exec:\7vjvv.exe168⤵PID:1940
-
\??\c:\rlxrffl.exec:\rlxrffl.exe169⤵PID:2936
-
\??\c:\nhbnnn.exec:\nhbnnn.exe170⤵PID:1952
-
\??\c:\tbhthb.exec:\tbhthb.exe171⤵PID:2200
-
\??\c:\pvjdv.exec:\pvjdv.exe172⤵PID:1836
-
\??\c:\jjddp.exec:\jjddp.exe173⤵PID:1540
-
\??\c:\rfxfrrx.exec:\rfxfrrx.exe174⤵PID:2168
-
\??\c:\hhbhbh.exec:\hhbhbh.exe175⤵PID:2660
-
\??\c:\nnhnhn.exec:\nnhnhn.exe176⤵PID:2716
-
\??\c:\vppvj.exec:\vppvj.exe177⤵PID:2788
-
\??\c:\llxxflx.exec:\llxxflx.exe178⤵PID:2828
-
\??\c:\7xlrfll.exec:\7xlrfll.exe179⤵PID:2692
-
\??\c:\hhthht.exec:\hhthht.exe180⤵PID:2552
-
\??\c:\hhtbnh.exec:\hhtbnh.exe181⤵PID:2576
-
\??\c:\jjdvd.exec:\jjdvd.exe182⤵PID:888
-
\??\c:\pjvvp.exec:\pjvvp.exe183⤵PID:2548
-
\??\c:\lrlrflx.exec:\lrlrflx.exe184⤵PID:2440
-
\??\c:\ffxfxxf.exec:\ffxfxxf.exe185⤵PID:2340
-
\??\c:\tbhhnn.exec:\tbhhnn.exe186⤵PID:1592
-
\??\c:\vdddp.exec:\vdddp.exe187⤵PID:2880
-
\??\c:\ppvvp.exec:\ppvvp.exe188⤵PID:3012
-
\??\c:\7rfflll.exec:\7rfflll.exe189⤵PID:1684
-
\??\c:\9nttbb.exec:\9nttbb.exe190⤵PID:2988
-
\??\c:\hbtbhh.exec:\hbtbhh.exe191⤵PID:1360
-
\??\c:\jjjdj.exec:\jjjdj.exe192⤵PID:1548
-
\??\c:\jvjjp.exec:\jvjjp.exe193⤵PID:2232
-
\??\c:\3lxrrrx.exec:\3lxrrrx.exe194⤵PID:1900
-
\??\c:\hbtthn.exec:\hbtthn.exe195⤵PID:2104
-
\??\c:\bnhntn.exec:\bnhntn.exe196⤵PID:1920
-
\??\c:\jdvvj.exec:\jdvvj.exe197⤵PID:1632
-
\??\c:\vdddj.exec:\vdddj.exe198⤵PID:320
-
\??\c:\3fxfrrx.exec:\3fxfrrx.exe199⤵PID:1304
-
\??\c:\9lffffl.exec:\9lffffl.exe200⤵PID:1996
-
\??\c:\hhbhtb.exec:\hhbhtb.exe201⤵PID:1044
-
\??\c:\dvpdp.exec:\dvpdp.exe202⤵PID:2372
-
\??\c:\jvddp.exec:\jvddp.exe203⤵PID:2628
-
\??\c:\lfxxxff.exec:\lfxxxff.exe204⤵PID:628
-
\??\c:\fxrxlxf.exec:\fxrxlxf.exe205⤵PID:1912
-
\??\c:\7thbnh.exec:\7thbnh.exe206⤵PID:1704
-
\??\c:\1vjpd.exec:\1vjpd.exe207⤵PID:832
-
\??\c:\7pdjd.exec:\7pdjd.exe208⤵PID:1348
-
\??\c:\xrfffrf.exec:\xrfffrf.exe209⤵PID:1968
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe210⤵PID:2444
-
\??\c:\nhtbhn.exec:\nhtbhn.exe211⤵PID:556
-
\??\c:\vvjvd.exec:\vvjvd.exe212⤵PID:2708
-
\??\c:\vpjpp.exec:\vpjpp.exe213⤵PID:1644
-
\??\c:\llfxrff.exec:\llfxrff.exe214⤵PID:2408
-
\??\c:\5lxfrrl.exec:\5lxfrrl.exe215⤵PID:1740
-
\??\c:\hbnttt.exec:\hbnttt.exe216⤵PID:2096
-
\??\c:\pjvdp.exec:\pjvdp.exe217⤵PID:1744
-
\??\c:\vjjvd.exec:\vjjvd.exe218⤵PID:2188
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe219⤵PID:2360
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe220⤵PID:2200
-
\??\c:\3thbnt.exec:\3thbnt.exe221⤵PID:2148
-
\??\c:\ppjpp.exec:\ppjpp.exe222⤵PID:2332
-
\??\c:\lfrxflx.exec:\lfrxflx.exe223⤵PID:2008
-
\??\c:\3xrxrxr.exec:\3xrxrxr.exe224⤵PID:2724
-
\??\c:\hbthhn.exec:\hbthhn.exe225⤵PID:2688
-
\??\c:\btntht.exec:\btntht.exe226⤵PID:2784
-
\??\c:\vvpdj.exec:\vvpdj.exe227⤵PID:2828
-
\??\c:\pjdjj.exec:\pjdjj.exe228⤵PID:1580
-
\??\c:\xxxrxrf.exec:\xxxrxrf.exe229⤵PID:2668
-
\??\c:\5lflrxr.exec:\5lflrxr.exe230⤵PID:2576
-
\??\c:\bnnntn.exec:\bnnntn.exe231⤵PID:2572
-
\??\c:\vppdp.exec:\vppdp.exe232⤵PID:2548
-
\??\c:\ddvvp.exec:\ddvvp.exe233⤵PID:2580
-
\??\c:\fxffxxl.exec:\fxffxxl.exe234⤵PID:2340
-
\??\c:\3xflrrx.exec:\3xflrrx.exe235⤵PID:2140
-
\??\c:\nnnbbt.exec:\nnnbbt.exe236⤵PID:3016
-
\??\c:\nnnhbt.exec:\nnnhbt.exe237⤵PID:1012
-
\??\c:\3pdjd.exec:\3pdjd.exe238⤵PID:1684
-
\??\c:\xxrxffx.exec:\xxrxffx.exe239⤵PID:2988
-
\??\c:\rrfxlfr.exec:\rrfxlfr.exe240⤵PID:1360
-
\??\c:\5tntbn.exec:\5tntbn.exe241⤵PID:1548
-
\??\c:\tnhttb.exec:\tnhttb.exe242⤵PID:2232