Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 17:51
Behavioral task
behavioral1
Sample
21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe
- Size 338KB
- Sample240518-we7bgafh35
- SHA256 d49149d599777b22ccec073e1bc1ecf6da0998267915d247da5000f2324a9de3
- MD5 21a6af3e0b390f5f081eb0aa813afad0
- SHA1 1d4efdbcd21a705a6b9d4acf70f8c9d645f9624f
- SHA512 fadb133ecbe773279f5db416d0071bfb8c692df3950059460c66514f3c68a5836227cd9efb964141b20d80e9ac2fa73531c9de84a8fe4324240acadf3da7b263
- SSDEEP 6144:Kcm4FmowdHoSKAszBd+aQz0192lTk1ycUkpCnAUo0Leu2tZGnOiQ3jiDQIZbdVnU:U4wFHoSK1zBjA892lY196AUo0LX2tZqi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4136-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1412-5-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2416-19-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3540-32-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3932-26-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1052-13-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4112-43-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1748-49-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2544-55-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1896-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3132-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4276-76-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2740-84-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2412-89-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2028-97-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4000-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1060-129-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4032-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3832-143-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3452-148-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4148-155-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3700-162-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2052-172-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3404-183-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3308-192-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2120-198-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4816-200-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1244-204-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4332-211-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1412-217-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5088-221-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2436-225-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1708-232-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3540-239-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/824-243-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2544-254-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/880-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3936-266-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2812-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4472-277-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1704-279-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/384-285-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2716-326-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4572-338-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4392-342-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3232-359-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/772-396-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4524-424-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/692-431-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4344-435-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2500-482-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2156-499-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3540-527-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3576-543-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4844-572-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5032-585-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3832-619-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/100-646-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2904-726-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1060-748-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3228-828-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4688-923-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2184-983-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4852-1040-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000a000000023400-3.dat family_berbew behavioral2/files/0x000b00000002340e-11.dat family_berbew behavioral2/files/0x000700000002341b-12.dat family_berbew behavioral2/files/0x000700000002341d-28.dat family_berbew behavioral2/files/0x000700000002341c-23.dat family_berbew behavioral2/files/0x000700000002341e-35.dat family_berbew behavioral2/files/0x000700000002341f-40.dat family_berbew behavioral2/files/0x0007000000023420-47.dat family_berbew behavioral2/files/0x0007000000023421-53.dat family_berbew behavioral2/files/0x0007000000023422-58.dat family_berbew behavioral2/files/0x0007000000023424-64.dat family_berbew behavioral2/files/0x0007000000023425-70.dat family_berbew behavioral2/files/0x0007000000023426-78.dat family_berbew behavioral2/files/0x0007000000023427-82.dat family_berbew behavioral2/files/0x0007000000023428-88.dat family_berbew behavioral2/files/0x0007000000023429-93.dat family_berbew behavioral2/files/0x000700000002342a-99.dat family_berbew behavioral2/files/0x0008000000023418-104.dat family_berbew behavioral2/files/0x000700000002342b-111.dat family_berbew behavioral2/files/0x000700000002342d-121.dat family_berbew behavioral2/files/0x000700000002342e-126.dat family_berbew behavioral2/files/0x000700000002342f-132.dat family_berbew behavioral2/files/0x000700000002342c-116.dat family_berbew behavioral2/files/0x0007000000023430-137.dat family_berbew behavioral2/files/0x0007000000023431-142.dat family_berbew behavioral2/files/0x0007000000023432-149.dat family_berbew behavioral2/files/0x0007000000023433-153.dat family_berbew behavioral2/files/0x0007000000023434-161.dat family_berbew behavioral2/files/0x0007000000023435-167.dat family_berbew behavioral2/files/0x0007000000023436-171.dat family_berbew behavioral2/files/0x0007000000023437-176.dat family_berbew behavioral2/files/0x0007000000023439-181.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 4136 3bhbbt.exe 1052 vvppv.exe 2416 lrrxrrf.exe 3932 tnhnnn.exe 3540 7ntnnn.exe 1896 vvpjj.exe 4112 rlrrlll.exe 1748 bbhbbn.exe 2544 dpddd.exe 3132 frfxrrl.exe 3228 lfrlffx.exe 4276 bhbnnh.exe 2740 3jjdv.exe 2412 hhbnbb.exe 2368 rxrfrfr.exe 2028 hthhbt.exe 2904 jjppj.exe 4000 hnnnnn.exe 4032 xllfxxr.exe 1248 tthbht.exe 864 nnbtnb.exe 1060 ppppp.exe 3236 rrxxxxr.exe 3832 pdjjd.exe 3452 tttnhh.exe 4148 vpdvd.exe 2480 hbnhhh.exe 3700 vjjdd.exe 4340 rlffxxr.exe 2052 hbhhhh.exe 3404 pvddv.exe 2156 bhnnbh.exe 2980 vjvpj.exe 3308 7hhbbb.exe 4816 dpppj.exe 2120 rrfrlll.exe 1244 xlxrrll.exe 4044 3tnntb.exe 4332 vvpjj.exe 1412 rlxxxxf.exe 5088 fxllrrf.exe 2436 vvvjd.exe 1012 lxlrllr.exe 1708 nhhbnn.exe 4356 ppppv.exe 3540 lrffxxx.exe 824 dvdvp.exe 1364 rlllrfx.exe 1672 tnttnn.exe 3576 lxrllll.exe 2544 lfxxrrr.exe 4540 ttbbbb.exe 880 jpvvv.exe 3936 dpvvv.exe 2812 xfrlfrl.exe 2348 tnhbhh.exe 4472 vdpjd.exe 1704 pjjvp.exe 384 xfrllff.exe 3012 hhnhbb.exe 2028 vjddp.exe 2904 ppvpj.exe 3280 rrfxxxl.exe 1132 hthbhb.exe -
resource yara_rule behavioral2/memory/1412-0-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000a000000023400-3.dat upx behavioral2/memory/4136-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1412-5-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000b00000002340e-11.dat upx behavioral2/files/0x000700000002341b-12.dat upx behavioral2/memory/2416-19-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002341d-28.dat upx behavioral2/memory/3540-32-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3932-26-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002341c-23.dat upx behavioral2/memory/1052-13-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002341e-35.dat upx behavioral2/files/0x000700000002341f-40.dat upx behavioral2/memory/4112-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023420-47.dat upx behavioral2/memory/1748-49-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023421-53.dat upx behavioral2/files/0x0007000000023422-58.dat upx behavioral2/memory/3132-60-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2544-55-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1896-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023424-64.dat upx behavioral2/memory/3132-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023425-70.dat upx behavioral2/memory/4276-76-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023426-78.dat upx behavioral2/memory/2740-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2740-84-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023427-82.dat upx behavioral2/files/0x0007000000023428-88.dat upx behavioral2/memory/2412-89-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023429-93.dat upx behavioral2/memory/2028-97-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002342a-99.dat upx behavioral2/files/0x0008000000023418-104.dat upx behavioral2/files/0x000700000002342b-111.dat upx behavioral2/memory/4000-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002342d-121.dat upx behavioral2/files/0x000700000002342e-126.dat upx behavioral2/memory/1060-129-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002342f-132.dat upx behavioral2/memory/4032-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002342c-116.dat upx behavioral2/files/0x0007000000023430-137.dat upx behavioral2/files/0x0007000000023431-142.dat upx behavioral2/memory/3832-143-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023432-149.dat upx behavioral2/memory/3452-148-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4148-155-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023433-153.dat upx behavioral2/files/0x0007000000023434-161.dat upx behavioral2/memory/3700-162-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023435-167.dat upx behavioral2/files/0x0007000000023436-171.dat upx behavioral2/memory/2052-172-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023437-176.dat upx behavioral2/files/0x0007000000023439-181.dat upx behavioral2/memory/3404-183-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3308-192-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2120-198-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4816-200-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1244-204-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4332-211-0x0000000000400000-0x0000000000428000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4136 1412 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 85 PID 1412 wrote to memory of 4136 1412 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 85 PID 1412 wrote to memory of 4136 1412 21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe 85 PID 4136 wrote to memory of 1052 4136 3bhbbt.exe 86 PID 4136 wrote to memory of 1052 4136 3bhbbt.exe 86 PID 4136 wrote to memory of 1052 4136 3bhbbt.exe 86 PID 1052 wrote to memory of 2416 1052 vvppv.exe 87 PID 1052 wrote to memory of 2416 1052 vvppv.exe 87 PID 1052 wrote to memory of 2416 1052 vvppv.exe 87 PID 2416 wrote to memory of 3932 2416 lrrxrrf.exe 88 PID 2416 wrote to memory of 3932 2416 lrrxrrf.exe 88 PID 2416 wrote to memory of 3932 2416 lrrxrrf.exe 88 PID 3932 wrote to memory of 3540 3932 tnhnnn.exe 89 PID 3932 wrote to memory of 3540 3932 tnhnnn.exe 89 PID 3932 wrote to memory of 3540 3932 tnhnnn.exe 89 PID 3540 wrote to memory of 1896 3540 7ntnnn.exe 90 PID 3540 wrote to memory of 1896 3540 7ntnnn.exe 90 PID 3540 wrote to memory of 1896 3540 7ntnnn.exe 90 PID 1896 wrote to memory of 4112 1896 vvpjj.exe 91 PID 1896 wrote to memory of 4112 1896 vvpjj.exe 91 PID 1896 wrote to memory of 4112 1896 vvpjj.exe 91 PID 4112 wrote to memory of 1748 4112 rlrrlll.exe 92 PID 4112 wrote to memory of 1748 4112 rlrrlll.exe 92 PID 4112 wrote to memory of 1748 4112 rlrrlll.exe 92 PID 1748 wrote to memory of 2544 1748 bbhbbn.exe 93 PID 1748 wrote to memory of 2544 1748 bbhbbn.exe 93 PID 1748 wrote to memory of 2544 1748 bbhbbn.exe 93 PID 2544 wrote to memory of 3132 2544 dpddd.exe 94 PID 2544 wrote to memory of 3132 2544 dpddd.exe 94 PID 2544 wrote to memory of 3132 2544 dpddd.exe 94 PID 3132 wrote to memory of 3228 3132 frfxrrl.exe 95 PID 3132 wrote to memory of 3228 3132 frfxrrl.exe 95 PID 3132 wrote to memory of 3228 3132 frfxrrl.exe 95 PID 3228 wrote to memory of 4276 3228 lfrlffx.exe 96 PID 3228 wrote to memory of 4276 3228 lfrlffx.exe 96 PID 3228 wrote to memory of 4276 3228 lfrlffx.exe 96 PID 4276 wrote to memory of 2740 4276 bhbnnh.exe 98 PID 4276 wrote to memory of 2740 4276 bhbnnh.exe 98 PID 4276 wrote to memory of 2740 4276 bhbnnh.exe 98 PID 2740 wrote to memory of 2412 2740 3jjdv.exe 99 PID 2740 wrote to memory of 2412 2740 3jjdv.exe 99 PID 2740 wrote to memory of 2412 2740 3jjdv.exe 99 PID 2412 wrote to memory of 2368 2412 hhbnbb.exe 101 PID 2412 wrote to memory of 2368 2412 hhbnbb.exe 101 PID 2412 wrote to memory of 2368 2412 hhbnbb.exe 101 PID 2368 wrote to memory of 2028 2368 rxrfrfr.exe 103 PID 2368 wrote to memory of 2028 2368 rxrfrfr.exe 103 PID 2368 wrote to memory of 2028 2368 rxrfrfr.exe 103 PID 2028 wrote to memory of 2904 2028 hthhbt.exe 104 PID 2028 wrote to memory of 2904 2028 hthhbt.exe 104 PID 2028 wrote to memory of 2904 2028 hthhbt.exe 104 PID 2904 wrote to memory of 4000 2904 jjppj.exe 105 PID 2904 wrote to memory of 4000 2904 jjppj.exe 105 PID 2904 wrote to memory of 4000 2904 jjppj.exe 105 PID 4000 wrote to memory of 4032 4000 hnnnnn.exe 106 PID 4000 wrote to memory of 4032 4000 hnnnnn.exe 106 PID 4000 wrote to memory of 4032 4000 hnnnnn.exe 106 PID 4032 wrote to memory of 1248 4032 xllfxxr.exe 107 PID 4032 wrote to memory of 1248 4032 xllfxxr.exe 107 PID 4032 wrote to memory of 1248 4032 xllfxxr.exe 107 PID 1248 wrote to memory of 864 1248 tthbht.exe 108 PID 1248 wrote to memory of 864 1248 tthbht.exe 108 PID 1248 wrote to memory of 864 1248 tthbht.exe 108 PID 864 wrote to memory of 1060 864 nnbtnb.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\21a6af3e0b390f5f081eb0aa813afad0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\3bhbbt.exec:\3bhbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\vvppv.exec:\vvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\lrrxrrf.exec:\lrrxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\tnhnnn.exec:\tnhnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\7ntnnn.exec:\7ntnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\vvpjj.exec:\vvpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\rlrrlll.exec:\rlrrlll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\bbhbbn.exec:\bbhbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\dpddd.exec:\dpddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\frfxrrl.exec:\frfxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\lfrlffx.exec:\lfrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\bhbnnh.exec:\bhbnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\3jjdv.exec:\3jjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hhbnbb.exec:\hhbnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rxrfrfr.exec:\rxrfrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hthhbt.exec:\hthhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\jjppj.exec:\jjppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hnnnnn.exec:\hnnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\xllfxxr.exec:\xllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\tthbht.exec:\tthbht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nnbtnb.exec:\nnbtnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\ppppp.exec:\ppppp.exe23⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe24⤵
- Executes dropped EXE
PID:3236 -
\??\c:\pdjjd.exec:\pdjjd.exe25⤵
- Executes dropped EXE
PID:3832 -
\??\c:\tttnhh.exec:\tttnhh.exe26⤵
- Executes dropped EXE
PID:3452 -
\??\c:\vpdvd.exec:\vpdvd.exe27⤵
- Executes dropped EXE
PID:4148 -
\??\c:\hbnhhh.exec:\hbnhhh.exe28⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjjdd.exec:\vjjdd.exe29⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rlffxxr.exec:\rlffxxr.exe30⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hbhhhh.exec:\hbhhhh.exe31⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pvddv.exec:\pvddv.exe32⤵
- Executes dropped EXE
PID:3404 -
\??\c:\bhnnbh.exec:\bhnnbh.exe33⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vjvpj.exec:\vjvpj.exe34⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7hhbbb.exec:\7hhbbb.exe35⤵
- Executes dropped EXE
PID:3308 -
\??\c:\dpppj.exec:\dpppj.exe36⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rrfrlll.exec:\rrfrlll.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xlxrrll.exec:\xlxrrll.exe38⤵
- Executes dropped EXE
PID:1244 -
\??\c:\3tnntb.exec:\3tnntb.exe39⤵
- Executes dropped EXE
PID:4044 -
\??\c:\vvpjj.exec:\vvpjj.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe41⤵
- Executes dropped EXE
PID:1412 -
\??\c:\fxllrrf.exec:\fxllrrf.exe42⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vvvjd.exec:\vvvjd.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lxlrllr.exec:\lxlrllr.exe44⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nhhbnn.exec:\nhhbnn.exe45⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppppv.exec:\ppppv.exe46⤵
- Executes dropped EXE
PID:4356 -
\??\c:\lrffxxx.exec:\lrffxxx.exe47⤵
- Executes dropped EXE
PID:3540 -
\??\c:\dvdvp.exec:\dvdvp.exe48⤵
- Executes dropped EXE
PID:824 -
\??\c:\rlllrfx.exec:\rlllrfx.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\tnttnn.exec:\tnttnn.exe50⤵
- Executes dropped EXE
PID:1672 -
\??\c:\lxrllll.exec:\lxrllll.exe51⤵
- Executes dropped EXE
PID:3576 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe52⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttbbbb.exec:\ttbbbb.exe53⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jpvvv.exec:\jpvvv.exe54⤵
- Executes dropped EXE
PID:880 -
\??\c:\dpvvv.exec:\dpvvv.exe55⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xfrlfrl.exec:\xfrlfrl.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnhbhh.exec:\tnhbhh.exe57⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vdpjd.exec:\vdpjd.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pjjvp.exec:\pjjvp.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xfrllff.exec:\xfrllff.exe60⤵
- Executes dropped EXE
PID:384 -
\??\c:\hhnhbb.exec:\hhnhbb.exe61⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vjddp.exec:\vjddp.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ppvpj.exec:\ppvpj.exe63⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe64⤵
- Executes dropped EXE
PID:3280 -
\??\c:\hthbhb.exec:\hthbhb.exe65⤵
- Executes dropped EXE
PID:1132 -
\??\c:\hbbnbb.exec:\hbbnbb.exe66⤵PID:4440
-
\??\c:\dpjjj.exec:\dpjjj.exe67⤵PID:3196
-
\??\c:\xlrrlrl.exec:\xlrrlrl.exe68⤵PID:1528
-
\??\c:\rrffxlr.exec:\rrffxlr.exe69⤵PID:1060
-
\??\c:\nhhnnh.exec:\nhhnnh.exe70⤵PID:1300
-
\??\c:\btbtnn.exec:\btbtnn.exe71⤵PID:1516
-
\??\c:\dvdvp.exec:\dvdvp.exe72⤵PID:1636
-
\??\c:\xfxrrxr.exec:\xfxrrxr.exe73⤵PID:3216
-
\??\c:\xxrrxfx.exec:\xxrrxfx.exe74⤵PID:2716
-
\??\c:\bnttnn.exec:\bnttnn.exe75⤵PID:3652
-
\??\c:\7pvpp.exec:\7pvpp.exe76⤵PID:404
-
\??\c:\djdvv.exec:\djdvv.exe77⤵PID:4572
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe78⤵PID:4392
-
\??\c:\hhnhnn.exec:\hhnhnn.exe79⤵PID:3964
-
\??\c:\dvvvv.exec:\dvvvv.exe80⤵PID:4224
-
\??\c:\rlllllf.exec:\rlllllf.exe81⤵PID:2096
-
\??\c:\pvddd.exec:\pvddd.exe82⤵PID:3056
-
\??\c:\1rxrfll.exec:\1rxrfll.exe83⤵PID:3232
-
\??\c:\bhtttt.exec:\bhtttt.exe84⤵PID:4900
-
\??\c:\dddjv.exec:\dddjv.exe85⤵PID:4980
-
\??\c:\llfrlfr.exec:\llfrlfr.exe86⤵PID:100
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe87⤵PID:1408
-
\??\c:\hbtntt.exec:\hbtntt.exe88⤵PID:640
-
\??\c:\pdjvv.exec:\pdjvv.exe89⤵PID:2060
-
\??\c:\llrrfll.exec:\llrrfll.exe90⤵PID:4264
-
\??\c:\frffxxx.exec:\frffxxx.exe91⤵PID:620
-
\??\c:\hthnnn.exec:\hthnnn.exe92⤵PID:1012
-
\??\c:\jvddv.exec:\jvddv.exe93⤵PID:4012
-
\??\c:\lxrlrll.exec:\lxrlrll.exe94⤵PID:412
-
\??\c:\bhtnnh.exec:\bhtnnh.exe95⤵PID:772
-
\??\c:\hhbnbn.exec:\hhbnbn.exe96⤵PID:2636
-
\??\c:\djvpd.exec:\djvpd.exe97⤵PID:1828
-
\??\c:\rxlxrxr.exec:\rxlxrxr.exe98⤵PID:4704
-
\??\c:\1hhhbb.exec:\1hhhbb.exe99⤵PID:1304
-
\??\c:\htbttn.exec:\htbttn.exe100⤵PID:4984
-
\??\c:\lffxxxx.exec:\lffxxxx.exe101⤵PID:4408
-
\??\c:\frxxxxx.exec:\frxxxxx.exe102⤵PID:2488
-
\??\c:\bttnnt.exec:\bttnnt.exe103⤵PID:432
-
\??\c:\pvjdp.exec:\pvjdp.exe104⤵PID:4524
-
\??\c:\xlxrlll.exec:\xlxrlll.exe105⤵PID:2448
-
\??\c:\bbnhnn.exec:\bbnhnn.exe106⤵PID:692
-
\??\c:\dvvpp.exec:\dvvpp.exe107⤵PID:4344
-
\??\c:\jdvpv.exec:\jdvpv.exe108⤵PID:1704
-
\??\c:\ffrxrrr.exec:\ffrxrrr.exe109⤵PID:384
-
\??\c:\9nttnn.exec:\9nttnn.exe110⤵PID:4716
-
\??\c:\5pppj.exec:\5pppj.exe111⤵PID:3844
-
\??\c:\jjvvp.exec:\jjvvp.exe112⤵PID:5048
-
\??\c:\lfllxxf.exec:\lfllxxf.exe113⤵PID:4448
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe114⤵PID:4416
-
\??\c:\ntttnn.exec:\ntttnn.exe115⤵PID:1960
-
\??\c:\1ddpj.exec:\1ddpj.exe116⤵PID:1372
-
\??\c:\rrffxfx.exec:\rrffxfx.exe117⤵PID:3292
-
\??\c:\rxlfllf.exec:\rxlfllf.exe118⤵PID:4188
-
\??\c:\bbhhnn.exec:\bbhhnn.exe119⤵PID:4628
-
\??\c:\tnbbhn.exec:\tnbbhn.exe120⤵PID:1300
-
\??\c:\pjvvj.exec:\pjvvj.exe121⤵PID:1516
-
\??\c:\9jjdv.exec:\9jjdv.exe122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-