Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 17:58
Behavioral task
behavioral1
Sample
238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe
- Size 320KB
- Sample240518-wknfjsgc35
- SHA256 f405d50c7703ddf5150123627602fa10807030a5644cc5462bf4f9c2c6c54b1b
- MD5 238a6975ad318c2bb3d1be374e609f60
- SHA1 c32de216e6cfc30873c8520c929541f074dfa7d7
- SHA512 08b04252fd2368880ad7cdfd1a058e251de2af241c024bb316e62ac3e9b350c5d7070ef95cba9762b81e6ffdddf037acc2089c98a5509486db6226ee5af0d456
- SSDEEP 6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3xN:/4wFHoSB969P9mJRMsfqV2j
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1144-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/64-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4568-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3304-42-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4428-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3180-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2140-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4252-108-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2660-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2804-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/744-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/400-240-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2276-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3544-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1444-405-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4816-510-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2320-527-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4396-544-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3040-660-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4828-851-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/540-824-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1512-814-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3780-750-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/740-640-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/864-557-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/552-495-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2236-481-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/772-465-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2096-448-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4572-432-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4636-425-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3128-401-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4192-381-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4344-325-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-318-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1040-317-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1200-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3932-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3580-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2972-250-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3196-245-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3012-217-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4256-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3516-199-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3204-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2180-182-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/860-180-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1948-169-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4320-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1268-150-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4676-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2164-137-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3944-133-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/60-128-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3416-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2140-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4612-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5008-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2080-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/400-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3288-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1072-33-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023298-2.dat family_berbew behavioral2/files/0x0008000000023413-11.dat family_berbew behavioral2/files/0x0007000000023418-16.dat family_berbew behavioral2/files/0x000700000002341d-47.dat family_berbew behavioral2/files/0x000700000002341e-52.dat family_berbew behavioral2/files/0x0007000000023420-64.dat family_berbew behavioral2/files/0x0007000000023422-76.dat family_berbew behavioral2/files/0x0007000000023425-93.dat family_berbew behavioral2/files/0x0007000000023429-117.dat family_berbew behavioral2/files/0x000700000002342a-123.dat family_berbew behavioral2/files/0x000700000002342c-129.dat family_berbew behavioral2/files/0x0007000000023431-158.dat family_berbew behavioral2/files/0x0007000000023433-175.dat family_berbew behavioral2/files/0x0007000000023435-187.dat family_berbew behavioral2/files/0x0007000000023434-181.dat family_berbew behavioral2/files/0x0007000000023432-170.dat family_berbew behavioral2/files/0x0008000000023414-164.dat family_berbew behavioral2/files/0x0007000000023430-153.dat family_berbew behavioral2/files/0x000700000002342f-146.dat family_berbew behavioral2/files/0x000700000002342e-140.dat family_berbew behavioral2/files/0x000700000002342d-135.dat family_berbew behavioral2/files/0x0007000000023428-111.dat family_berbew behavioral2/files/0x0007000000023427-106.dat family_berbew behavioral2/files/0x0007000000023426-99.dat family_berbew behavioral2/files/0x0007000000023424-86.dat family_berbew behavioral2/files/0x0007000000023423-81.dat family_berbew behavioral2/files/0x0007000000023421-69.dat family_berbew behavioral2/files/0x000700000002341f-58.dat family_berbew behavioral2/files/0x000700000002341c-41.dat family_berbew behavioral2/files/0x000700000002341b-34.dat family_berbew behavioral2/files/0x000700000002341a-25.dat family_berbew behavioral2/files/0x0007000000023419-21.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 64 fxlfxrl.exe 4568 hbhbht.exe 4880 dvpjv.exe 396 7rlfxxr.exe 1072 1xrllll.exe 3288 9hbnbt.exe 3304 vvdpv.exe 400 jddvp.exe 2080 rrrfrlr.exe 5008 lrlxrfx.exe 4064 httnbb.exe 1132 xrlfxrl.exe 4428 tnhbtn.exe 3160 jjvpv.exe 3180 pjpvj.exe 4612 nhtnhh.exe 2140 1pdvv.exe 4252 frxxrrr.exe 4400 tbnhnt.exe 3416 bbbttt.exe 60 5pvpp.exe 3944 rxfxffl.exe 2164 9bbtth.exe 4676 ppjvp.exe 1268 fffxxxl.exe 1940 lfrrrrx.exe 4320 1hhtnn.exe 1948 vpddj.exe 5076 7lffxff.exe 860 nbhhhb.exe 2180 hhhnbb.exe 3204 ddpjd.exe 2660 9pdvp.exe 3104 llfxxxr.exe 3516 tnbnhh.exe 2804 hbttbh.exe 3592 rfxfxrl.exe 4256 nntnhn.exe 744 tntnnn.exe 3012 ddddd.exe 2800 xffxrlr.exe 2952 llxrrrl.exe 2320 bntnnn.exe 692 nhnnnn.exe 3304 9ppjj.exe 400 ffxrlrl.exe 3196 rlxxxxf.exe 1444 nhnnht.exe 2972 jjpjd.exe 3580 pjvvd.exe 3476 xlrlffx.exe 2472 lflfrrl.exe 4032 bnbnbn.exe 1252 ttbbhh.exe 3932 3dvpp.exe 4612 rrlfrrf.exe 4456 hnnhnn.exe 2680 nhnnnh.exe 2040 3dddd.exe 4268 xxxxrxx.exe 4912 nnnhhh.exe 1200 pjjdv.exe 2032 jddvd.exe 4996 lffrxlr.exe -
resource yara_rule behavioral2/memory/1144-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023298-2.dat upx behavioral2/memory/1144-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023413-11.dat upx behavioral2/memory/64-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023418-16.dat upx behavioral2/memory/4568-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4880-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1072-28-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3304-42-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-47.dat upx behavioral2/memory/2080-53-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-52.dat upx behavioral2/memory/4064-65-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023420-64.dat upx behavioral2/files/0x0007000000023422-76.dat upx behavioral2/memory/4428-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3180-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-93.dat upx behavioral2/memory/2140-100-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4252-108-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023429-117.dat upx behavioral2/files/0x000700000002342a-123.dat upx behavioral2/files/0x000700000002342c-129.dat upx behavioral2/files/0x0007000000023431-158.dat upx behavioral2/files/0x0007000000023433-175.dat upx behavioral2/files/0x0007000000023435-187.dat upx behavioral2/memory/2660-192-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2804-205-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/744-213-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/400-240-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4032-263-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2276-305-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5032-309-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3544-334-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3440-388-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1444-405-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3180-418-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4468-496-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4816-510-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2320-527-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4396-544-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3040-660-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2236-777-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2328-825-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/828-844-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4828-851-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3284-861-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4732-936-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2332-884-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3184-868-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/540-824-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1512-814-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3108-761-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4196-754-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3780-750-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/60-746-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3932-718-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3580-702-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3760-689-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2664-673-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3040-656-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/740-640-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3564-612-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1144 wrote to memory of 64 1144 238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe 83 PID 1144 wrote to memory of 64 1144 238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe 83 PID 1144 wrote to memory of 64 1144 238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe 83 PID 64 wrote to memory of 4568 64 fxlfxrl.exe 84 PID 64 wrote to memory of 4568 64 fxlfxrl.exe 84 PID 64 wrote to memory of 4568 64 fxlfxrl.exe 84 PID 4568 wrote to memory of 4880 4568 hbhbht.exe 85 PID 4568 wrote to memory of 4880 4568 hbhbht.exe 85 PID 4568 wrote to memory of 4880 4568 hbhbht.exe 85 PID 4880 wrote to memory of 396 4880 dvpjv.exe 86 PID 4880 wrote to memory of 396 4880 dvpjv.exe 86 PID 4880 wrote to memory of 396 4880 dvpjv.exe 86 PID 396 wrote to memory of 1072 396 7rlfxxr.exe 87 PID 396 wrote to memory of 1072 396 7rlfxxr.exe 87 PID 396 wrote to memory of 1072 396 7rlfxxr.exe 87 PID 1072 wrote to memory of 3288 1072 1xrllll.exe 88 PID 1072 wrote to memory of 3288 1072 1xrllll.exe 88 PID 1072 wrote to memory of 3288 1072 1xrllll.exe 88 PID 3288 wrote to memory of 3304 3288 9hbnbt.exe 89 PID 3288 wrote to memory of 3304 3288 9hbnbt.exe 89 PID 3288 wrote to memory of 3304 3288 9hbnbt.exe 89 PID 3304 wrote to memory of 400 3304 vvdpv.exe 131 PID 3304 wrote to memory of 400 3304 vvdpv.exe 131 PID 3304 wrote to memory of 400 3304 vvdpv.exe 131 PID 400 wrote to memory of 2080 400 jddvp.exe 91 PID 400 wrote to memory of 2080 400 jddvp.exe 91 PID 400 wrote to memory of 2080 400 jddvp.exe 91 PID 2080 wrote to memory of 5008 2080 rrrfrlr.exe 92 PID 2080 wrote to memory of 5008 2080 rrrfrlr.exe 92 PID 2080 wrote to memory of 5008 2080 rrrfrlr.exe 92 PID 5008 wrote to memory of 4064 5008 lrlxrfx.exe 93 PID 5008 wrote to memory of 4064 5008 lrlxrfx.exe 93 PID 5008 wrote to memory of 4064 5008 lrlxrfx.exe 93 PID 4064 wrote to memory of 1132 4064 httnbb.exe 94 PID 4064 wrote to memory of 1132 4064 httnbb.exe 94 PID 4064 wrote to memory of 1132 4064 httnbb.exe 94 PID 1132 wrote to memory of 4428 1132 xrlfxrl.exe 95 PID 1132 wrote to memory of 4428 1132 xrlfxrl.exe 95 PID 1132 wrote to memory of 4428 1132 xrlfxrl.exe 95 PID 4428 wrote to memory of 3160 4428 tnhbtn.exe 97 PID 4428 wrote to memory of 3160 4428 tnhbtn.exe 97 PID 4428 wrote to memory of 3160 4428 tnhbtn.exe 97 PID 3160 wrote to memory of 3180 3160 jjvpv.exe 98 PID 3160 wrote to memory of 3180 3160 jjvpv.exe 98 PID 3160 wrote to memory of 3180 3160 jjvpv.exe 98 PID 3180 wrote to memory of 4612 3180 pjpvj.exe 99 PID 3180 wrote to memory of 4612 3180 pjpvj.exe 99 PID 3180 wrote to memory of 4612 3180 pjpvj.exe 99 PID 4612 wrote to memory of 2140 4612 nhtnhh.exe 101 PID 4612 wrote to memory of 2140 4612 nhtnhh.exe 101 PID 4612 wrote to memory of 2140 4612 nhtnhh.exe 101 PID 2140 wrote to memory of 4252 2140 1pdvv.exe 102 PID 2140 wrote to memory of 4252 2140 1pdvv.exe 102 PID 2140 wrote to memory of 4252 2140 1pdvv.exe 102 PID 4252 wrote to memory of 4400 4252 frxxrrr.exe 104 PID 4252 wrote to memory of 4400 4252 frxxrrr.exe 104 PID 4252 wrote to memory of 4400 4252 frxxrrr.exe 104 PID 4400 wrote to memory of 3416 4400 tbnhnt.exe 105 PID 4400 wrote to memory of 3416 4400 tbnhnt.exe 105 PID 4400 wrote to memory of 3416 4400 tbnhnt.exe 105 PID 3416 wrote to memory of 60 3416 bbbttt.exe 106 PID 3416 wrote to memory of 60 3416 bbbttt.exe 106 PID 3416 wrote to memory of 60 3416 bbbttt.exe 106 PID 60 wrote to memory of 3944 60 5pvpp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\238a6975ad318c2bb3d1be374e609f60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\hbhbht.exec:\hbhbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\dvpjv.exec:\dvpjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\7rlfxxr.exec:\7rlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\1xrllll.exec:\1xrllll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\9hbnbt.exec:\9hbnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\vvdpv.exec:\vvdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\jddvp.exec:\jddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\rrrfrlr.exec:\rrrfrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\lrlxrfx.exec:\lrlxrfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\httnbb.exec:\httnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\tnhbtn.exec:\tnhbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jjvpv.exec:\jjvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\pjpvj.exec:\pjpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\nhtnhh.exec:\nhtnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\1pdvv.exec:\1pdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\frxxrrr.exec:\frxxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\tbnhnt.exec:\tbnhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\bbbttt.exec:\bbbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\5pvpp.exec:\5pvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\rxfxffl.exec:\rxfxffl.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9bbtth.exec:\9bbtth.exe24⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppjvp.exec:\ppjvp.exe25⤵
- Executes dropped EXE
PID:4676 -
\??\c:\fffxxxl.exec:\fffxxxl.exe26⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1hhtnn.exec:\1hhtnn.exe28⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vpddj.exec:\vpddj.exe29⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7lffxff.exec:\7lffxff.exe30⤵
- Executes dropped EXE
PID:5076 -
\??\c:\nbhhhb.exec:\nbhhhb.exe31⤵
- Executes dropped EXE
PID:860 -
\??\c:\hhhnbb.exec:\hhhnbb.exe32⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ddpjd.exec:\ddpjd.exe33⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9pdvp.exec:\9pdvp.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\llfxxxr.exec:\llfxxxr.exe35⤵
- Executes dropped EXE
PID:3104 -
\??\c:\tnbnhh.exec:\tnbnhh.exe36⤵
- Executes dropped EXE
PID:3516 -
\??\c:\hbttbh.exec:\hbttbh.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rfxfxrl.exec:\rfxfxrl.exe38⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nntnhn.exec:\nntnhn.exe39⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tntnnn.exec:\tntnnn.exe40⤵
- Executes dropped EXE
PID:744 -
\??\c:\ddddd.exec:\ddddd.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xffxrlr.exec:\xffxrlr.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\llxrrrl.exec:\llxrrrl.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bntnnn.exec:\bntnnn.exe44⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhnnnn.exec:\nhnnnn.exe45⤵
- Executes dropped EXE
PID:692 -
\??\c:\9ppjj.exec:\9ppjj.exe46⤵
- Executes dropped EXE
PID:3304 -
\??\c:\ffxrlrl.exec:\ffxrlrl.exe47⤵
- Executes dropped EXE
PID:400 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe48⤵
- Executes dropped EXE
PID:3196 -
\??\c:\nhnnht.exec:\nhnnht.exe49⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jjpjd.exec:\jjpjd.exe50⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pjvvd.exec:\pjvvd.exe51⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xlrlffx.exec:\xlrlffx.exe52⤵
- Executes dropped EXE
PID:3476 -
\??\c:\lflfrrl.exec:\lflfrrl.exe53⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bnbnbn.exec:\bnbnbn.exe54⤵
- Executes dropped EXE
PID:4032 -
\??\c:\ttbbhh.exec:\ttbbhh.exe55⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3dvpp.exec:\3dvpp.exe56⤵
- Executes dropped EXE
PID:3932 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe57⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hnnhnn.exec:\hnnhnn.exe58⤵
- Executes dropped EXE
PID:4456 -
\??\c:\nhnnnh.exec:\nhnnnh.exe59⤵
- Executes dropped EXE
PID:2680 -
\??\c:\3dddd.exec:\3dddd.exe60⤵
- Executes dropped EXE
PID:2040 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe61⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nnnhhh.exec:\nnnhhh.exe62⤵
- Executes dropped EXE
PID:4912 -
\??\c:\pjjdv.exec:\pjjdv.exe63⤵
- Executes dropped EXE
PID:1200 -
\??\c:\jddvd.exec:\jddvd.exe64⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lffrxlr.exec:\lffrxlr.exe65⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xxxxflr.exec:\xxxxflr.exe66⤵PID:2276
-
\??\c:\thnhhh.exec:\thnhhh.exe67⤵PID:3000
-
\??\c:\tttttt.exec:\tttttt.exe68⤵PID:5032
-
\??\c:\djvvp.exec:\djvvp.exe69⤵PID:1040
-
\??\c:\pppjj.exec:\pppjj.exe70⤵PID:4444
-
\??\c:\lflllrl.exec:\lflllrl.exe71⤵PID:2144
-
\??\c:\nnhbnn.exec:\nnhbnn.exe72⤵PID:4344
-
\??\c:\hhtnhh.exec:\hhtnhh.exe73⤵PID:1948
-
\??\c:\vdvpd.exec:\vdvpd.exe74⤵PID:3544
-
\??\c:\rxxfllr.exec:\rxxfllr.exe75⤵PID:3768
-
\??\c:\thhhbb.exec:\thhhbb.exe76⤵PID:3016
-
\??\c:\djjjd.exec:\djjjd.exe77⤵PID:2492
-
\??\c:\7rfxrxr.exec:\7rfxrxr.exe78⤵PID:4872
-
\??\c:\1rffffr.exec:\1rffffr.exe79⤵PID:4380
-
\??\c:\htbtnn.exec:\htbtnn.exe80⤵PID:640
-
\??\c:\btnnhh.exec:\btnnhh.exe81⤵PID:2348
-
\??\c:\djddd.exec:\djddd.exe82⤵PID:4732
-
\??\c:\pdjjj.exec:\pdjjj.exe83⤵PID:2420
-
\??\c:\lllfxrl.exec:\lllfxrl.exe84⤵PID:64
-
\??\c:\xlffflf.exec:\xlffflf.exe85⤵PID:744
-
\??\c:\1hbhhh.exec:\1hbhhh.exe86⤵PID:4028
-
\??\c:\9ddvp.exec:\9ddvp.exe87⤵PID:5044
-
\??\c:\dvddd.exec:\dvddd.exe88⤵PID:3664
-
\??\c:\xxxlrrf.exec:\xxxlrrf.exe89⤵PID:2292
-
\??\c:\xrxrrll.exec:\xrxrrll.exe90⤵PID:4192
-
\??\c:\ttnnnn.exec:\ttnnnn.exe91⤵PID:2464
-
\??\c:\bhtbbn.exec:\bhtbbn.exe92⤵PID:3440
-
\??\c:\djvpj.exec:\djvpj.exe93⤵PID:4396
-
\??\c:\llrxrrf.exec:\llrxrrf.exe94⤵PID:3148
-
\??\c:\xrxfxlx.exec:\xrxfxlx.exe95⤵PID:3128
-
\??\c:\btnhbt.exec:\btnhbt.exe96⤵PID:1444
-
\??\c:\vjppj.exec:\vjppj.exe97⤵PID:1428
-
\??\c:\jjjdv.exec:\jjjdv.exe98⤵PID:3580
-
\??\c:\9lrlfxr.exec:\9lrlfxr.exe99⤵PID:3476
-
\??\c:\9rxxffx.exec:\9rxxffx.exe100⤵PID:4460
-
\??\c:\thhttn.exec:\thhttn.exe101⤵PID:3180
-
\??\c:\3nhttt.exec:\3nhttt.exe102⤵PID:3184
-
\??\c:\dpvpp.exec:\dpvpp.exe103⤵PID:4636
-
\??\c:\ddppv.exec:\ddppv.exe104⤵PID:3712
-
\??\c:\lfxrrxr.exec:\lfxrrxr.exe105⤵PID:4572
-
\??\c:\ffrllll.exec:\ffrllll.exe106⤵PID:2308
-
\??\c:\btbbbb.exec:\btbbbb.exe107⤵PID:3224
-
\??\c:\hhbbnn.exec:\hhbbnn.exe108⤵PID:2332
-
\??\c:\1djjd.exec:\1djjd.exe109⤵PID:2096
-
\??\c:\tnbbtn.exec:\tnbbtn.exe110⤵PID:2316
-
\??\c:\tnhbbb.exec:\tnhbbb.exe111⤵PID:736
-
\??\c:\9vdvp.exec:\9vdvp.exe112⤵PID:4796
-
\??\c:\dvjjj.exec:\dvjjj.exe113⤵PID:3536
-
\??\c:\xlrllll.exec:\xlrllll.exe114⤵PID:5064
-
\??\c:\lfrlfxl.exec:\lfrlfxl.exe115⤵PID:772
-
\??\c:\hhhbbb.exec:\hhhbbb.exe116⤵PID:1040
-
\??\c:\jdjdd.exec:\jdjdd.exe117⤵PID:1940
-
\??\c:\vvvpp.exec:\vvvpp.exe118⤵PID:3572
-
\??\c:\lfrrflr.exec:\lfrrflr.exe119⤵PID:3596
-
\??\c:\thttbt.exec:\thttbt.exe120⤵PID:2236
-
\??\c:\nbhttn.exec:\nbhttn.exe121⤵PID:3220
-
\??\c:\jppjp.exec:\jppjp.exe122⤵PID:1536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-