Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:18
Behavioral task
behavioral1
Sample
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe
-
Size
464KB
-
MD5
288763a376e5d2ee4c22b599fb670a50
-
SHA1
58d40d48aa364bde7c9d8859564bda4aedaad785
-
SHA256
88099c8a7df5af0c47312285577d5c694413e8430b0aeaa54c8f50046a095dd1
-
SHA512
8d0f492d049e8c2b9349c2ba5057800fd1e05499165c5a775c58b9f365a6c1bad35f0c35e8ab19cea605540d16abf7066f9fe16eb2c7c75b9f1213f404e7fdb8
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VP:VeR0oykayRFp3lztP+OKaf1VP
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2700-10-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2976-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2632-35-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2560-45-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2536-48-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2480-83-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2336-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1800-101-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2392-117-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2344-121-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2176-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/876-144-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1032-154-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2404-163-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2664-174-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1852-196-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/596-205-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1412-221-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1156-230-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/932-256-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1588-273-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1952-281-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2672-329-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1364-396-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1912-410-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1596-417-0x00000000003C0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2908-452-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2360-472-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1416-492-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/648-500-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/544-519-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/972-532-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2848-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vpdpv.exe family_berbew behavioral1/memory/2700-10-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2976-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bthbht.exe family_berbew behavioral1/memory/2976-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1jjdp.exe family_berbew behavioral1/memory/2632-35-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lffrfxf.exe family_berbew C:\vpdjv.exe family_berbew behavioral1/memory/2560-45-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2536-48-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2556-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7fxfxlx.exe family_berbew C:\thtbnh.exe family_berbew C:\ppdvv.exe family_berbew behavioral1/memory/2480-74-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxlxffr.exe family_berbew behavioral1/memory/2480-83-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pdddp.exe family_berbew behavioral1/memory/2336-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1800-101-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrlfrxl.exe family_berbew C:\jdjpj.exe family_berbew behavioral1/memory/2392-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxlrrfx.exe family_berbew behavioral1/memory/2344-121-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tbhbnn.exe family_berbew behavioral1/memory/2176-136-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7rfrxfr.exe family_berbew behavioral1/memory/876-144-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\3frrlll.exe family_berbew C:\9dpvv.exe family_berbew behavioral1/memory/1032-154-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lffrffx.exe family_berbew behavioral1/memory/2404-163-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\9djvj.exe family_berbew behavioral1/memory/2664-174-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvpvv.exe family_berbew C:\httnnt.exe family_berbew behavioral1/memory/1852-196-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\djpjv.exe family_berbew C:\5xfrxrx.exe family_berbew behavioral1/memory/596-205-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nbttnn.exe family_berbew behavioral1/memory/1412-221-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrllfrx.exe family_berbew C:\7frxfll.exe family_berbew behavioral1/memory/1156-230-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvpjv.exe family_berbew C:\bhhbbh.exe family_berbew behavioral1/memory/932-248-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/932-256-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vvddd.exe family_berbew C:\xlllrll.exe family_berbew C:\bnbbhh.exe family_berbew behavioral1/memory/1588-273-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1952-281-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pjdjj.exe family_berbew behavioral1/memory/896-283-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1936-291-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2576-310-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2672-329-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vpdpv.exebthbht.exe1jjdp.exelffrfxf.exevpdjv.exe7fxfxlx.exethtbnh.exeppdvv.exefxlxffr.exepdddp.exexrlfrxl.exejdjpj.exefxlrrfx.exetbhbnn.exe7rfrxfr.exe3frrlll.exe9dpvv.exelffrffx.exe9djvj.exevvpvv.exehttnnt.exedjpjv.exe5xfrxrx.exenbttnn.exexrllfrx.exe7frxfll.exedvpjv.exebhhbbh.exevvddd.exexlllrll.exebnbbhh.exepjdjj.exenbthtb.exevjvdv.exe9rfffxf.exeflrrrxf.exe1ntnnn.exevjdpv.exe7lrrrrx.exethtntt.exe1jjpd.exelrlrflx.exebnbbbt.exeppjpj.exerfrlxrx.exe3rfffxf.exenbnnth.exejvjjd.exe1lrlxrr.exe1tbtnn.exedpdjp.exe9flxxxx.exehbtthh.exe1ddpp.exelfrfllx.exehthnnh.exe9jvdj.exerfxrxxf.exehbtthh.exe1jvvd.exejvjjp.exe1fllllr.exetntthh.exellrxxrr.exepid process 2700 vpdpv.exe 2976 bthbht.exe 2632 1jjdp.exe 2560 lffrfxf.exe 2536 vpdjv.exe 2556 7fxfxlx.exe 2412 thtbnh.exe 2480 ppdvv.exe 2336 fxlxffr.exe 1800 pdddp.exe 1180 xrlfrxl.exe 2392 jdjpj.exe 2344 fxlrrfx.exe 2176 tbhbnn.exe 876 7rfrxfr.exe 1032 3frrlll.exe 2404 9dpvv.exe 2032 lffrffx.exe 2664 9djvj.exe 2152 vvpvv.exe 1852 httnnt.exe 596 djpjv.exe 2396 5xfrxrx.exe 1412 nbttnn.exe 1156 xrllfrx.exe 496 7frxfll.exe 3020 dvpjv.exe 932 bhhbbh.exe 1980 vvddd.exe 1588 xlllrll.exe 1952 bnbbhh.exe 896 pjdjj.exe 1936 nbthtb.exe 1544 vjvdv.exe 1908 9rfffxf.exe 2576 flrrrxf.exe 2644 1ntnnn.exe 2656 vjdpv.exe 2672 7lrrrrx.exe 2544 thtntt.exe 2536 1jjpd.exe 2432 lrlrflx.exe 2416 bnbbbt.exe 2836 ppjpj.exe 2196 rfrlxrx.exe 1596 3rfffxf.exe 2144 nbnnth.exe 1364 jvjjd.exe 1180 1lrlxrr.exe 1912 1tbtnn.exe 2184 dpdjp.exe 1692 9flxxxx.exe 1052 hbtthh.exe 2200 1ddpp.exe 2164 lfrfllx.exe 2028 hthnnh.exe 2908 9jvdj.exe 2704 rfxrxxf.exe 2360 hbtthh.exe 2116 1jvvd.exe 796 jvjjp.exe 1416 1fllllr.exe 648 tntthh.exe 852 llrxxrr.exe -
Processes:
resource yara_rule behavioral1/memory/2848-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vpdpv.exe upx behavioral1/memory/2700-10-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2976-18-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bthbht.exe upx behavioral1/memory/2976-27-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1jjdp.exe upx behavioral1/memory/2632-35-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lffrfxf.exe upx C:\vpdjv.exe upx behavioral1/memory/2560-45-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2536-48-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2556-55-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7fxfxlx.exe upx C:\thtbnh.exe upx C:\ppdvv.exe upx behavioral1/memory/2480-74-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fxlxffr.exe upx behavioral1/memory/2480-83-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pdddp.exe upx behavioral1/memory/2336-91-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1800-101-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrlfrxl.exe upx C:\jdjpj.exe upx behavioral1/memory/2392-117-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fxlrrfx.exe upx behavioral1/memory/2344-121-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tbhbnn.exe upx behavioral1/memory/2176-136-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7rfrxfr.exe upx behavioral1/memory/876-144-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\3frrlll.exe upx C:\9dpvv.exe upx behavioral1/memory/1032-154-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lffrffx.exe upx behavioral1/memory/2404-163-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\9djvj.exe upx behavioral1/memory/2664-174-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvpvv.exe upx C:\httnnt.exe upx behavioral1/memory/1852-196-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\djpjv.exe upx C:\5xfrxrx.exe upx behavioral1/memory/596-205-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nbttnn.exe upx behavioral1/memory/1412-221-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrllfrx.exe upx C:\7frxfll.exe upx behavioral1/memory/1156-230-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvpjv.exe upx C:\bhhbbh.exe upx behavioral1/memory/932-248-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/932-256-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vvddd.exe upx C:\xlllrll.exe upx C:\bnbbhh.exe upx behavioral1/memory/1588-273-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1952-281-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pjdjj.exe upx behavioral1/memory/896-283-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1936-291-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2576-310-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2672-329-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exevpdpv.exebthbht.exe1jjdp.exelffrfxf.exevpdjv.exe7fxfxlx.exethtbnh.exeppdvv.exefxlxffr.exepdddp.exexrlfrxl.exejdjpj.exefxlrrfx.exetbhbnn.exe7rfrxfr.exedescription pid process target process PID 2848 wrote to memory of 2700 2848 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe vpdpv.exe PID 2848 wrote to memory of 2700 2848 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe vpdpv.exe PID 2848 wrote to memory of 2700 2848 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe vpdpv.exe PID 2848 wrote to memory of 2700 2848 288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe vpdpv.exe PID 2700 wrote to memory of 2976 2700 vpdpv.exe bthbht.exe PID 2700 wrote to memory of 2976 2700 vpdpv.exe bthbht.exe PID 2700 wrote to memory of 2976 2700 vpdpv.exe bthbht.exe PID 2700 wrote to memory of 2976 2700 vpdpv.exe bthbht.exe PID 2976 wrote to memory of 2632 2976 bthbht.exe 1jjdp.exe PID 2976 wrote to memory of 2632 2976 bthbht.exe 1jjdp.exe PID 2976 wrote to memory of 2632 2976 bthbht.exe 1jjdp.exe PID 2976 wrote to memory of 2632 2976 bthbht.exe 1jjdp.exe PID 2632 wrote to memory of 2560 2632 1jjdp.exe lffrfxf.exe PID 2632 wrote to memory of 2560 2632 1jjdp.exe lffrfxf.exe PID 2632 wrote to memory of 2560 2632 1jjdp.exe lffrfxf.exe PID 2632 wrote to memory of 2560 2632 1jjdp.exe lffrfxf.exe PID 2560 wrote to memory of 2536 2560 lffrfxf.exe vpdjv.exe PID 2560 wrote to memory of 2536 2560 lffrfxf.exe vpdjv.exe PID 2560 wrote to memory of 2536 2560 lffrfxf.exe vpdjv.exe PID 2560 wrote to memory of 2536 2560 lffrfxf.exe vpdjv.exe PID 2536 wrote to memory of 2556 2536 vpdjv.exe 7fxfxlx.exe PID 2536 wrote to memory of 2556 2536 vpdjv.exe 7fxfxlx.exe PID 2536 wrote to memory of 2556 2536 vpdjv.exe 7fxfxlx.exe PID 2536 wrote to memory of 2556 2536 vpdjv.exe 7fxfxlx.exe PID 2556 wrote to memory of 2412 2556 7fxfxlx.exe thtbnh.exe PID 2556 wrote to memory of 2412 2556 7fxfxlx.exe thtbnh.exe PID 2556 wrote to memory of 2412 2556 7fxfxlx.exe thtbnh.exe PID 2556 wrote to memory of 2412 2556 7fxfxlx.exe thtbnh.exe PID 2412 wrote to memory of 2480 2412 thtbnh.exe ppdvv.exe PID 2412 wrote to memory of 2480 2412 thtbnh.exe ppdvv.exe PID 2412 wrote to memory of 2480 2412 thtbnh.exe ppdvv.exe PID 2412 wrote to memory of 2480 2412 thtbnh.exe ppdvv.exe PID 2480 wrote to memory of 2336 2480 ppdvv.exe fxlxffr.exe PID 2480 wrote to memory of 2336 2480 ppdvv.exe fxlxffr.exe PID 2480 wrote to memory of 2336 2480 ppdvv.exe fxlxffr.exe PID 2480 wrote to memory of 2336 2480 ppdvv.exe fxlxffr.exe PID 2336 wrote to memory of 1800 2336 fxlxffr.exe pdddp.exe PID 2336 wrote to memory of 1800 2336 fxlxffr.exe pdddp.exe PID 2336 wrote to memory of 1800 2336 fxlxffr.exe pdddp.exe PID 2336 wrote to memory of 1800 2336 fxlxffr.exe pdddp.exe PID 1800 wrote to memory of 1180 1800 pdddp.exe xrlfrxl.exe PID 1800 wrote to memory of 1180 1800 pdddp.exe xrlfrxl.exe PID 1800 wrote to memory of 1180 1800 pdddp.exe xrlfrxl.exe PID 1800 wrote to memory of 1180 1800 pdddp.exe xrlfrxl.exe PID 1180 wrote to memory of 2392 1180 xrlfrxl.exe jdjpj.exe PID 1180 wrote to memory of 2392 1180 xrlfrxl.exe jdjpj.exe PID 1180 wrote to memory of 2392 1180 xrlfrxl.exe jdjpj.exe PID 1180 wrote to memory of 2392 1180 xrlfrxl.exe jdjpj.exe PID 2392 wrote to memory of 2344 2392 jdjpj.exe fxlrrfx.exe PID 2392 wrote to memory of 2344 2392 jdjpj.exe fxlrrfx.exe PID 2392 wrote to memory of 2344 2392 jdjpj.exe fxlrrfx.exe PID 2392 wrote to memory of 2344 2392 jdjpj.exe fxlrrfx.exe PID 2344 wrote to memory of 2176 2344 fxlrrfx.exe tbhbnn.exe PID 2344 wrote to memory of 2176 2344 fxlrrfx.exe tbhbnn.exe PID 2344 wrote to memory of 2176 2344 fxlrrfx.exe tbhbnn.exe PID 2344 wrote to memory of 2176 2344 fxlrrfx.exe tbhbnn.exe PID 2176 wrote to memory of 876 2176 tbhbnn.exe 7rfrxfr.exe PID 2176 wrote to memory of 876 2176 tbhbnn.exe 7rfrxfr.exe PID 2176 wrote to memory of 876 2176 tbhbnn.exe 7rfrxfr.exe PID 2176 wrote to memory of 876 2176 tbhbnn.exe 7rfrxfr.exe PID 876 wrote to memory of 1032 876 7rfrxfr.exe 3frrlll.exe PID 876 wrote to memory of 1032 876 7rfrxfr.exe 3frrlll.exe PID 876 wrote to memory of 1032 876 7rfrxfr.exe 3frrlll.exe PID 876 wrote to memory of 1032 876 7rfrxfr.exe 3frrlll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\288763a376e5d2ee4c22b599fb670a50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpdpv.exec:\vpdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bthbht.exec:\bthbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1jjdp.exec:\1jjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lffrfxf.exec:\lffrfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\vpdjv.exec:\vpdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7fxfxlx.exec:\7fxfxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\thtbnh.exec:\thtbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\ppdvv.exec:\ppdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fxlxffr.exec:\fxlxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\pdddp.exec:\pdddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\xrlfrxl.exec:\xrlfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\jdjpj.exec:\jdjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\fxlrrfx.exec:\fxlrrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\tbhbnn.exec:\tbhbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\7rfrxfr.exec:\7rfrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\3frrlll.exec:\3frrlll.exe17⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9dpvv.exec:\9dpvv.exe18⤵
- Executes dropped EXE
PID:2404 -
\??\c:\lffrffx.exec:\lffrffx.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9djvj.exec:\9djvj.exe20⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvpvv.exec:\vvpvv.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\httnnt.exec:\httnnt.exe22⤵
- Executes dropped EXE
PID:1852 -
\??\c:\djpjv.exec:\djpjv.exe23⤵
- Executes dropped EXE
PID:596 -
\??\c:\5xfrxrx.exec:\5xfrxrx.exe24⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nbttnn.exec:\nbttnn.exe25⤵
- Executes dropped EXE
PID:1412 -
\??\c:\xrllfrx.exec:\xrllfrx.exe26⤵
- Executes dropped EXE
PID:1156 -
\??\c:\7frxfll.exec:\7frxfll.exe27⤵
- Executes dropped EXE
PID:496 -
\??\c:\dvpjv.exec:\dvpjv.exe28⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bhhbbh.exec:\bhhbbh.exe29⤵
- Executes dropped EXE
PID:932 -
\??\c:\vvddd.exec:\vvddd.exe30⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xlllrll.exec:\xlllrll.exe31⤵
- Executes dropped EXE
PID:1588 -
\??\c:\bnbbhh.exec:\bnbbhh.exe32⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjdjj.exec:\pjdjj.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\nbthtb.exec:\nbthtb.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vjvdv.exec:\vjvdv.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9rfffxf.exec:\9rfffxf.exe36⤵
- Executes dropped EXE
PID:1908 -
\??\c:\flrrrxf.exec:\flrrrxf.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1ntnnn.exec:\1ntnnn.exe38⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjdpv.exec:\vjdpv.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7lrrrrx.exec:\7lrrrrx.exe40⤵
- Executes dropped EXE
PID:2672 -
\??\c:\thtntt.exec:\thtntt.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1jjpd.exec:\1jjpd.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lrlrflx.exec:\lrlrflx.exe43⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bnbbbt.exec:\bnbbbt.exe44⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppjpj.exec:\ppjpj.exe45⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rfrlxrx.exec:\rfrlxrx.exe46⤵
- Executes dropped EXE
PID:2196 -
\??\c:\3rfffxf.exec:\3rfffxf.exe47⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbnnth.exec:\nbnnth.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jvjjd.exec:\jvjjd.exe49⤵
- Executes dropped EXE
PID:1364 -
\??\c:\1lrlxrr.exec:\1lrlxrr.exe50⤵
- Executes dropped EXE
PID:1180 -
\??\c:\1tbtnn.exec:\1tbtnn.exe51⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dpdjp.exec:\dpdjp.exe52⤵
- Executes dropped EXE
PID:2184 -
\??\c:\9flxxxx.exec:\9flxxxx.exe53⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbtthh.exec:\hbtthh.exe54⤵
- Executes dropped EXE
PID:1052 -
\??\c:\1ddpp.exec:\1ddpp.exe55⤵
- Executes dropped EXE
PID:2200 -
\??\c:\lfrfllx.exec:\lfrfllx.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hthnnh.exec:\hthnnh.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\9jvdj.exec:\9jvdj.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe59⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hbtthh.exec:\hbtthh.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1jvvd.exec:\1jvvd.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jvjjp.exec:\jvjjp.exe62⤵
- Executes dropped EXE
PID:796 -
\??\c:\1fllllr.exec:\1fllllr.exe63⤵
- Executes dropped EXE
PID:1416 -
\??\c:\tntthh.exec:\tntthh.exe64⤵
- Executes dropped EXE
PID:648 -
\??\c:\llrxxrr.exec:\llrxxrr.exe65⤵
- Executes dropped EXE
PID:852 -
\??\c:\7thhhh.exec:\7thhhh.exe66⤵PID:1488
-
\??\c:\bbnhnt.exec:\bbnhnt.exe67⤵PID:108
-
\??\c:\jjddj.exec:\jjddj.exe68⤵PID:544
-
\??\c:\fxllffr.exec:\fxllffr.exe69⤵PID:972
-
\??\c:\tnnnhh.exec:\tnnnhh.exe70⤵PID:2968
-
\??\c:\7vjpd.exec:\7vjpd.exe71⤵PID:1680
-
\??\c:\frfllrx.exec:\frfllrx.exe72⤵PID:2292
-
\??\c:\ffxflrf.exec:\ffxflrf.exe73⤵PID:788
-
\??\c:\5tnthn.exec:\5tnthn.exe74⤵PID:1952
-
\??\c:\9dpvv.exec:\9dpvv.exe75⤵PID:2696
-
\??\c:\dvjjp.exec:\dvjjp.exe76⤵PID:2728
-
\??\c:\rrfxlrf.exec:\rrfxlrf.exe77⤵PID:1936
-
\??\c:\5hbhtb.exec:\5hbhtb.exe78⤵PID:1548
-
\??\c:\btthth.exec:\btthth.exe79⤵PID:1908
-
\??\c:\1pjjv.exec:\1pjjv.exe80⤵PID:2576
-
\??\c:\pjpdp.exec:\pjpdp.exe81⤵PID:2632
-
\??\c:\5lffxxl.exec:\5lffxxl.exe82⤵PID:2656
-
\??\c:\7bhnhn.exec:\7bhnhn.exe83⤵PID:2584
-
\??\c:\jjdpp.exec:\jjdpp.exe84⤵PID:2544
-
\??\c:\7jjpv.exec:\7jjpv.exe85⤵PID:2832
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe86⤵PID:1724
-
\??\c:\bhhntb.exec:\bhhntb.exe87⤵PID:2824
-
\??\c:\ppjpv.exec:\ppjpv.exe88⤵PID:2492
-
\??\c:\vdjpv.exec:\vdjpv.exe89⤵PID:1552
-
\??\c:\llllxfr.exec:\llllxfr.exe90⤵PID:1620
-
\??\c:\1nnhnt.exec:\1nnhnt.exe91⤵PID:1800
-
\??\c:\djjjj.exec:\djjjj.exe92⤵PID:328
-
\??\c:\9xlrrxr.exec:\9xlrrxr.exe93⤵PID:2392
-
\??\c:\1lfrrlx.exec:\1lfrrlx.exe94⤵PID:2160
-
\??\c:\hhntnt.exec:\hhntnt.exe95⤵PID:1056
-
\??\c:\dpjjv.exec:\dpjjv.exe96⤵PID:2176
-
\??\c:\vpdjp.exec:\vpdjp.exe97⤵PID:1692
-
\??\c:\rllrxff.exec:\rllrxff.exe98⤵PID:340
-
\??\c:\hhnhtn.exec:\hhnhtn.exe99⤵PID:1228
-
\??\c:\3jjpv.exec:\3jjpv.exe100⤵PID:2404
-
\??\c:\pjjpj.exec:\pjjpj.exe101⤵PID:2488
-
\??\c:\1rlxflf.exec:\1rlxflf.exe102⤵PID:2708
-
\??\c:\nhthtt.exec:\nhthtt.exe103⤵PID:1244
-
\??\c:\thbhbb.exec:\thbhbb.exe104⤵PID:1856
-
\??\c:\9pddd.exec:\9pddd.exe105⤵PID:1640
-
\??\c:\3llrffl.exec:\3llrffl.exe106⤵PID:800
-
\??\c:\hbtttt.exec:\hbtttt.exe107⤵PID:604
-
\??\c:\nnhthn.exec:\nnhthn.exe108⤵PID:1796
-
\??\c:\pdpjj.exec:\pdpjj.exe109⤵PID:2384
-
\??\c:\1xrlrxl.exec:\1xrlrxl.exe110⤵PID:1284
-
\??\c:\nhthnt.exec:\nhthnt.exe111⤵PID:1556
-
\??\c:\vvppd.exec:\vvppd.exe112⤵PID:772
-
\??\c:\dpjjv.exec:\dpjjv.exe113⤵PID:3020
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe114⤵PID:972
-
\??\c:\bbnthh.exec:\bbnthh.exe115⤵PID:916
-
\??\c:\5hnhhn.exec:\5hnhhn.exe116⤵PID:2104
-
\??\c:\1dvpj.exec:\1dvpj.exe117⤵PID:2292
-
\??\c:\ddvjj.exec:\ddvjj.exe118⤵PID:788
-
\??\c:\nnbhtb.exec:\nnbhtb.exe119⤵PID:1952
-
\??\c:\vpvvj.exec:\vpvvj.exe120⤵PID:2224
-
\??\c:\3fxflrr.exec:\3fxflrr.exe121⤵PID:1540
-
\??\c:\xxxrfff.exec:\xxxrfff.exe122⤵PID:1936
-
\??\c:\5bthtn.exec:\5bthtn.exe123⤵PID:1548
-
\??\c:\3hbnnt.exec:\3hbnnt.exe124⤵PID:2936
-
\??\c:\vvpdp.exec:\vvpdp.exe125⤵PID:2644
-
\??\c:\rlxfxfx.exec:\rlxfxfx.exe126⤵PID:2688
-
\??\c:\bnbhtt.exec:\bnbhtt.exe127⤵PID:2672
-
\??\c:\7bhhnt.exec:\7bhhnt.exe128⤵PID:3052
-
\??\c:\5jvpd.exec:\5jvpd.exe129⤵PID:2520
-
\??\c:\frfllfr.exec:\frfllfr.exe130⤵PID:2432
-
\??\c:\lflrxxl.exec:\lflrxxl.exe131⤵PID:2816
-
\??\c:\hnbnnb.exec:\hnbnnb.exe132⤵PID:2496
-
\??\c:\dvjjv.exec:\dvjjv.exe133⤵PID:2808
-
\??\c:\fllrrff.exec:\fllrrff.exe134⤵PID:2308
-
\??\c:\9xxxrxf.exec:\9xxxrxf.exe135⤵PID:1788
-
\??\c:\hhbhnn.exec:\hhbhnn.exe136⤵PID:1448
-
\??\c:\5pjjp.exec:\5pjjp.exe137⤵PID:2148
-
\??\c:\ddvvv.exec:\ddvvv.exe138⤵PID:1572
-
\??\c:\9frllll.exec:\9frllll.exe139⤵PID:2188
-
\??\c:\3hnnth.exec:\3hnnth.exe140⤵PID:1516
-
\??\c:\bhbbnn.exec:\bhbbnn.exe141⤵PID:332
-
\??\c:\7jddd.exec:\7jddd.exe142⤵PID:2040
-
\??\c:\xlxfrlf.exec:\xlxfrlf.exe143⤵PID:2476
-
\??\c:\rflllll.exec:\rflllll.exe144⤵PID:1064
-
\??\c:\bhtnnn.exec:\bhtnnn.exe145⤵PID:2456
-
\??\c:\7vjvv.exec:\7vjvv.exe146⤵PID:2908
-
\??\c:\vpjdp.exec:\vpjdp.exe147⤵PID:2516
-
\??\c:\frllxxl.exec:\frllxxl.exe148⤵PID:2120
-
\??\c:\hbntbt.exec:\hbntbt.exe149⤵PID:1852
-
\??\c:\5htbnh.exec:\5htbnh.exe150⤵PID:808
-
\??\c:\ddjvd.exec:\ddjvd.exe151⤵PID:1428
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe152⤵PID:1008
-
\??\c:\7xrrfxx.exec:\7xrrfxx.exe153⤵PID:2388
-
\??\c:\3nhhtn.exec:\3nhhtn.exe154⤵PID:1252
-
\??\c:\5ppvj.exec:\5ppvj.exe155⤵PID:1048
-
\??\c:\vjpjd.exec:\vjpjd.exe156⤵PID:444
-
\??\c:\7rfxxxx.exec:\7rfxxxx.exe157⤵PID:2724
-
\??\c:\9htnth.exec:\9htnth.exe158⤵PID:948
-
\??\c:\3bnnbn.exec:\3bnnbn.exe159⤵PID:2084
-
\??\c:\ddjvj.exec:\ddjvj.exe160⤵PID:2052
-
\??\c:\7fxflrr.exec:\7fxflrr.exe161⤵PID:2228
-
\??\c:\xlflrxl.exec:\xlflrxl.exe162⤵PID:1588
-
\??\c:\thtthb.exec:\thtthb.exe163⤵PID:2112
-
\??\c:\7jdvd.exec:\7jdvd.exe164⤵PID:2856
-
\??\c:\pdvpv.exec:\pdvpv.exe165⤵PID:2340
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe166⤵PID:1664
-
\??\c:\hbnttb.exec:\hbnttb.exe167⤵PID:3040
-
\??\c:\3tnbnh.exec:\3tnbnh.exe168⤵PID:2512
-
\??\c:\3dvdv.exec:\3dvdv.exe169⤵PID:2740
-
\??\c:\5frxxll.exec:\5frxxll.exe170⤵PID:2620
-
\??\c:\5lrxffl.exec:\5lrxffl.exe171⤵PID:2136
-
\??\c:\5btnhh.exec:\5btnhh.exe172⤵PID:1972
-
\??\c:\dvddd.exec:\dvddd.exe173⤵PID:2736
-
\??\c:\9rrxrxx.exec:\9rrxrxx.exe174⤵PID:2472
-
\??\c:\3flfrrx.exec:\3flfrrx.exe175⤵PID:2532
-
\??\c:\nnttth.exec:\nnttth.exe176⤵PID:2540
-
\??\c:\jjjjp.exec:\jjjjp.exe177⤵PID:2432
-
\??\c:\jpddj.exec:\jpddj.exe178⤵PID:2812
-
\??\c:\ffxrlrr.exec:\ffxrlrr.exe179⤵PID:2196
-
\??\c:\5rxxxrl.exec:\5rxxxrl.exe180⤵PID:1596
-
\??\c:\bhtntn.exec:\bhtntn.exe181⤵PID:2144
-
\??\c:\pvjjj.exec:\pvjjj.exe182⤵PID:1512
-
\??\c:\jvddj.exec:\jvddj.exe183⤵PID:1180
-
\??\c:\xlxxfll.exec:\xlxxfll.exe184⤵PID:2148
-
\??\c:\tnhbbb.exec:\tnhbbb.exe185⤵PID:2160
-
\??\c:\ppvjd.exec:\ppvjd.exe186⤵PID:2188
-
\??\c:\5dddv.exec:\5dddv.exe187⤵PID:1808
-
\??\c:\9thhbb.exec:\9thhbb.exe188⤵PID:2176
-
\??\c:\tnbhtn.exec:\tnbhtn.exe189⤵PID:1224
-
\??\c:\1vjjj.exec:\1vjjj.exe190⤵PID:1176
-
\??\c:\vdpjj.exec:\vdpjj.exe191⤵PID:1064
-
\??\c:\rffflrl.exec:\rffflrl.exe192⤵PID:2796
-
\??\c:\thbbhh.exec:\thbbhh.exe193⤵PID:1124
-
\??\c:\3ntttn.exec:\3ntttn.exe194⤵PID:2032
-
\??\c:\vpvvv.exec:\vpvvv.exe195⤵PID:2360
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe196⤵PID:268
-
\??\c:\rlxxffr.exec:\rlxxffr.exe197⤵PID:296
-
\??\c:\9tnbbn.exec:\9tnbbn.exe198⤵PID:1756
-
\??\c:\jdpvj.exec:\jdpvj.exe199⤵PID:604
-
\??\c:\vpdjp.exec:\vpdjp.exe200⤵PID:2384
-
\??\c:\frrxxxr.exec:\frrxxxr.exe201⤵PID:1004
-
\??\c:\thtttt.exec:\thtttt.exe202⤵PID:872
-
\??\c:\5ttbhn.exec:\5ttbhn.exe203⤵PID:1556
-
\??\c:\dpjpv.exec:\dpjpv.exe204⤵PID:3020
-
\??\c:\3dppv.exec:\3dppv.exe205⤵PID:972
-
\??\c:\xrlllfl.exec:\xrlllfl.exe206⤵PID:2968
-
\??\c:\tthhhb.exec:\tthhhb.exe207⤵PID:2500
-
\??\c:\pdppd.exec:\pdppd.exe208⤵PID:1636
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe209⤵PID:908
-
\??\c:\xlxfxxf.exec:\xlxfxxf.exe210⤵PID:1508
-
\??\c:\hhtbhh.exec:\hhtbhh.exe211⤵PID:1840
-
\??\c:\vvjpd.exec:\vvjpd.exe212⤵PID:2852
-
\??\c:\dpddv.exec:\dpddv.exe213⤵PID:2728
-
\??\c:\fxllrfl.exec:\fxllrfl.exe214⤵PID:2564
-
\??\c:\hbtntb.exec:\hbtntb.exe215⤵PID:2628
-
\??\c:\hthhtt.exec:\hthhtt.exe216⤵PID:2576
-
\??\c:\vjdpv.exec:\vjdpv.exe217⤵PID:2632
-
\??\c:\pjjpj.exec:\pjjpj.exe218⤵PID:2596
-
\??\c:\lxrfxxx.exec:\lxrfxxx.exe219⤵PID:2452
-
\??\c:\bnbttn.exec:\bnbttn.exe220⤵PID:2716
-
\??\c:\jdjdv.exec:\jdjdv.exe221⤵PID:2436
-
\??\c:\ddpjp.exec:\ddpjp.exe222⤵PID:2428
-
\??\c:\1xrrfxf.exec:\1xrrfxf.exe223⤵PID:3028
-
\??\c:\nbnntt.exec:\nbnntt.exe224⤵PID:1040
-
\??\c:\bnhhtb.exec:\bnhhtb.exe225⤵PID:2836
-
\??\c:\3dppd.exec:\3dppd.exe226⤵PID:1456
-
\??\c:\pdvdj.exec:\pdvdj.exe227⤵PID:1436
-
\??\c:\9xlrllf.exec:\9xlrllf.exe228⤵PID:1788
-
\??\c:\7hnnnh.exec:\7hnnnh.exe229⤵PID:1448
-
\??\c:\hthbtn.exec:\hthbtn.exe230⤵PID:2156
-
\??\c:\ddddj.exec:\ddddj.exe231⤵PID:1572
-
\??\c:\1xxfxrx.exec:\1xxfxrx.exe232⤵PID:2352
-
\??\c:\xrffllr.exec:\xrffllr.exe233⤵PID:1516
-
\??\c:\5hbttt.exec:\5hbttt.exe234⤵PID:1032
-
\??\c:\jdvpv.exec:\jdvpv.exe235⤵PID:2040
-
\??\c:\lxfffff.exec:\lxfffff.exe236⤵PID:1228
-
\??\c:\7lffffx.exec:\7lffffx.exe237⤵PID:2404
-
\??\c:\htbhhb.exec:\htbhhb.exe238⤵PID:2400
-
\??\c:\nhhtbh.exec:\nhhtbh.exe239⤵PID:2456
-
\??\c:\vpdjj.exec:\vpdjj.exe240⤵PID:2264
-
\??\c:\3xxrxxf.exec:\3xxrxxf.exe241⤵PID:3056
-
\??\c:\5flfffl.exec:\5flfffl.exe242⤵PID:1852