Analysis
- max time kernel
147s - max time network
119s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system - submitted
19/05/2024, 22:27
Behavioral task
behavioral1
Sample
4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
- Size 377KB
- Sample240519-2db2tsdh9t
- SHA256 3f296e1123ddf547e990523a12274705d7307fcbfa55887892e65e0320221717
- MD5 4be88a026ee47c31eff2af36841ac3e0
- SHA1 84e4e91c84329949ee391be72b031318b7884473
- SHA512 32cb35d6750f31dd2f85475eccb92843bfec10f5ea4f29f2638b5187446c09d9c887c80e17468edf65d7af9160a5bc995a42d5a311a73d293a85d11673758fc0
- SSDEEP 6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7N:/4wFHoSA4KofHfHTXQLzgvnzHPowYbv0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/2344-9-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2760-122-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2760-131-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/848-184-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2008-213-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2904-329-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2572-344-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2660-394-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1860-423-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1316-439-0x00000000003A0000-0x0000000000400000-memory.dmp family_blackmoon behavioral1/memory/748-487-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/928-502-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/564-529-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2036-562-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2888-585-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1152-574-0x0000000000250000-0x00000000002B0000-memory.dmp family_blackmoon behavioral1/memory/1676-570-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/572-555-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/768-548-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/332-509-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/924-494-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2052-479-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2100-472-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1984-465-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1316-432-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2732-431-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2484-416-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2268-401-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1856-387-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2476-366-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2444-365-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1672-336-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1028-322-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2344-315-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2188-307-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1136-297-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/572-288-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/340-278-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/952-269-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1404-260-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/544-250-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/808-239-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/644-229-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2100-203-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/3064-193-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1348-175-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/792-150-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1824-121-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2936-111-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2936-108-0x0000000000560000-0x00000000005C0000-memory.dmp family_blackmoon behavioral1/memory/2488-100-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2468-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2448-79-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2448-80-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2260-71-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-61-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2620-60-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2552-51-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/1812-40-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2836-29-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral1/memory/2276-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2276 xxrfrfr.exe 2836 9ffrrrr.exe 1812 rrlrflr.exe 2552 bthntb.exe 2620 pvvjp.exe 2260 ttbbnt.exe 2448 jdddj.exe 2468 fffxlfx.exe 2488 tnhtbh.exe 2936 pjdpv.exe 1824 lxfrfrl.exe 2760 hbtbhh.exe 1528 1pddd.exe 792 jvvvv.exe 1316 frrxlrl.exe 2756 bntntt.exe 1348 3jvdp.exe 848 7xxfrlf.exe 3064 rrlrffr.exe 2100 tntnhn.exe 2008 9dvdp.exe 748 dvpvj.exe 644 1fxflfx.exe 808 frffrrl.exe 352 ppdjp.exe 544 1pddd.exe 1404 lxlfrff.exe 952 vvjvd.exe 340 xlxflrr.exe 572 bbhhth.exe 1136 vpjvj.exe 2188 dvjpv.exe 2344 3htnnn.exe 1028 hhhhtb.exe 2904 jvvjv.exe 1672 rlxlrrf.exe 2572 rlflrrx.exe 2788 nhbhnt.exe 2784 pjdjv.exe 2444 frxflxf.exe 2476 frfffxf.exe 2544 hhbbhh.exe 1856 vpdjp.exe 2660 dvpvp.exe 2268 rlffllf.exe 948 hhtbnt.exe 2484 hntthh.exe 1860 vjdjp.exe 2732 lxrxflf.exe 1316 tttbhn.exe 1444 dvvdd.exe 1392 lfrrxfr.exe 2960 xxrrxxl.exe 1984 hbhnbh.exe 2100 9dvdj.exe 2052 dvpvd.exe 748 5frrxxf.exe 924 5fxlxrf.exe 928 bhbhhb.exe 332 1vvdp.exe 756 xlrrrrx.exe 1404 rxffrxr.exe 564 hhbbth.exe 2280 jjvdv.exe - Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral1/files/0x0009000000014390-5.dat molebox behavioral1/files/0x00070000000149f5-53.dat molebox behavioral1/files/0x0007000000014abe-63.dat molebox behavioral1/files/0x000a000000014af6-73.dat molebox behavioral1/files/0x0009000000014de9-82.dat molebox behavioral1/files/0x00070000000155ed-113.dat molebox behavioral1/files/0x0006000000015616-151.dat molebox behavioral1/files/0x0006000000015626-158.dat molebox behavioral1/files/0x0006000000015b6f-167.dat molebox behavioral1/files/0x0006000000015cb6-231.dat molebox behavioral1/files/0x00090000000146b8-240.dat molebox behavioral1/files/0x00060000000155f7-243.dat molebox behavioral1/files/0x0006000000015cce-252.dat molebox behavioral1/files/0x0006000000015cee-259.dat molebox behavioral1/files/0x0006000000015cfe-279.dat molebox behavioral1/files/0x0006000000015d0f-299.dat molebox behavioral1/files/0x0006000000015d1a-306.dat molebox behavioral1/files/0x0006000000015d07-289.dat molebox behavioral1/files/0x0006000000015cf6-271.dat molebox behavioral1/files/0x0006000000015c9f-222.dat molebox behavioral1/files/0x0006000000015c83-214.dat molebox behavioral1/files/0x0006000000015c78-205.dat molebox behavioral1/files/0x0006000000015c6b-194.dat molebox behavioral1/files/0x0006000000015c52-185.dat molebox behavioral1/files/0x0006000000015c3d-176.dat molebox behavioral1/files/0x0006000000015605-142.dat molebox behavioral1/files/0x00060000000155f3-123.dat molebox behavioral1/files/0x0007000000015018-101.dat molebox behavioral1/files/0x0007000000014ef8-92.dat molebox behavioral1/files/0x0007000000014825-43.dat molebox behavioral1/files/0x00080000000147ea-32.dat molebox behavioral1/files/0x00090000000146a2-22.dat molebox -
resource yara_rule behavioral1/memory/2344-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0009000000014390-5.dat upx behavioral1/memory/2344-9-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2276-11-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2344-8-0x0000000000460000-0x00000000004C0000-memory.dmp upx behavioral1/memory/2344-7-0x0000000000460000-0x00000000004C0000-memory.dmp upx behavioral1/files/0x00070000000149f5-53.dat upx behavioral1/memory/2260-62-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0007000000014abe-63.dat upx behavioral1/files/0x000a000000014af6-73.dat upx behavioral1/memory/2448-72-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0009000000014de9-82.dat upx behavioral1/memory/2936-102-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x00070000000155ed-113.dat upx behavioral1/memory/2760-122-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2760-131-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0006000000015616-151.dat upx behavioral1/files/0x0006000000015626-158.dat upx behavioral1/files/0x0006000000015b6f-167.dat upx behavioral1/memory/848-184-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2100-195-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2008-213-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/files/0x0006000000015cb6-231.dat upx behavioral1/files/0x00090000000146b8-240.dat upx behavioral1/files/0x00060000000155f7-243.dat upx behavioral1/files/0x0006000000015cce-252.dat upx behavioral1/files/0x0006000000015cee-259.dat upx behavioral1/files/0x0006000000015cfe-279.dat upx behavioral1/files/0x0006000000015d0f-299.dat upx behavioral1/memory/2904-329-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2572-344-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2788-347-0x0000000001CB0000-0x0000000001D10000-memory.dmp upx behavioral1/memory/2444-358-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2544-373-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1856-380-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2660-394-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/948-402-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1860-423-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1316-439-0x00000000003A0000-0x0000000000400000-memory.dmp upx behavioral1/memory/748-480-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/748-487-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-495-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-502-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1404-516-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/564-529-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2036-562-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2148-586-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2888-585-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1152-571-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1676-570-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1676-565-0x0000000000220000-0x0000000000280000-memory.dmp upx behavioral1/memory/572-555-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/768-548-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/332-509-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/928-501-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/924-494-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2052-479-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2100-472-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1984-465-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1984-458-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/1316-432-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2732-431-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2732-424-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral1/memory/2484-416-0x0000000000400000-0x0000000000460000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 28 PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 28 PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 28 PID 2344 wrote to memory of 2276 2344 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 28 PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 29 PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 29 PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 29 PID 2276 wrote to memory of 2836 2276 xxrfrfr.exe 29 PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe 30 PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe 30 PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe 30 PID 2836 wrote to memory of 1812 2836 9ffrrrr.exe 30 PID 1812 wrote to memory of 2552 1812 rrlrflr.exe 31 PID 1812 wrote to memory of 2552 1812 rrlrflr.exe 31 PID 1812 wrote to memory of 2552 1812 rrlrflr.exe 31 PID 1812 wrote to memory of 2552 1812 rrlrflr.exe 31 PID 2552 wrote to memory of 2620 2552 bthntb.exe 416 PID 2552 wrote to memory of 2620 2552 bthntb.exe 416 PID 2552 wrote to memory of 2620 2552 bthntb.exe 416 PID 2552 wrote to memory of 2620 2552 bthntb.exe 416 PID 2620 wrote to memory of 2260 2620 pvvjp.exe 33 PID 2620 wrote to memory of 2260 2620 pvvjp.exe 33 PID 2620 wrote to memory of 2260 2620 pvvjp.exe 33 PID 2620 wrote to memory of 2260 2620 pvvjp.exe 33 PID 2260 wrote to memory of 2448 2260 ttbbnt.exe 34 PID 2260 wrote to memory of 2448 2260 ttbbnt.exe 34 PID 2260 wrote to memory of 2448 2260 ttbbnt.exe 34 PID 2260 wrote to memory of 2448 2260 ttbbnt.exe 34 PID 2448 wrote to memory of 2468 2448 jdddj.exe 35 PID 2448 wrote to memory of 2468 2448 jdddj.exe 35 PID 2448 wrote to memory of 2468 2448 jdddj.exe 35 PID 2448 wrote to memory of 2468 2448 jdddj.exe 35 PID 2468 wrote to memory of 2488 2468 fffxlfx.exe 36 PID 2468 wrote to memory of 2488 2468 fffxlfx.exe 36 PID 2468 wrote to memory of 2488 2468 fffxlfx.exe 36 PID 2468 wrote to memory of 2488 2468 fffxlfx.exe 36 PID 2488 wrote to memory of 2936 2488 tnhtbh.exe 37 PID 2488 wrote to memory of 2936 2488 tnhtbh.exe 37 PID 2488 wrote to memory of 2936 2488 tnhtbh.exe 37 PID 2488 wrote to memory of 2936 2488 tnhtbh.exe 37 PID 2936 wrote to memory of 1824 2936 pjdpv.exe 38 PID 2936 wrote to memory of 1824 2936 pjdpv.exe 38 PID 2936 wrote to memory of 1824 2936 pjdpv.exe 38 PID 2936 wrote to memory of 1824 2936 pjdpv.exe 38 PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe 39 PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe 39 PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe 39 PID 1824 wrote to memory of 2760 1824 lxfrfrl.exe 39 PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 40 PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 40 PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 40 PID 2760 wrote to memory of 1528 2760 hbtbhh.exe 40 PID 1528 wrote to memory of 792 1528 1pddd.exe 41 PID 1528 wrote to memory of 792 1528 1pddd.exe 41 PID 1528 wrote to memory of 792 1528 1pddd.exe 41 PID 1528 wrote to memory of 792 1528 1pddd.exe 41 PID 792 wrote to memory of 1316 792 jvvvv.exe 77 PID 792 wrote to memory of 1316 792 jvvvv.exe 77 PID 792 wrote to memory of 1316 792 jvvvv.exe 77 PID 792 wrote to memory of 1316 792 jvvvv.exe 77 PID 1316 wrote to memory of 2756 1316 frrxlrl.exe 43 PID 1316 wrote to memory of 2756 1316 frrxlrl.exe 43 PID 1316 wrote to memory of 2756 1316 frrxlrl.exe 43 PID 1316 wrote to memory of 2756 1316 frrxlrl.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\9ffrrrr.exec:\9ffrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rrlrflr.exec:\rrlrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bthntb.exec:\bthntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\pvvjp.exec:\pvvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\ttbbnt.exec:\ttbbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jdddj.exec:\jdddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\fffxlfx.exec:\fffxlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tnhtbh.exec:\tnhtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pjdpv.exec:\pjdpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxfrfrl.exec:\lxfrfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hbtbhh.exec:\hbtbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1pddd.exec:\1pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jvvvv.exec:\jvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\frrxlrl.exec:\frrxlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\bntntt.exec:\bntntt.exe17⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3jvdp.exec:\3jvdp.exe18⤵
- Executes dropped EXE
PID:1348 -
\??\c:\7xxfrlf.exec:\7xxfrlf.exe19⤵
- Executes dropped EXE
PID:848 -
\??\c:\rrlrffr.exec:\rrlrffr.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\tntnhn.exec:\tntnhn.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9dvdp.exec:\9dvdp.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dvpvj.exec:\dvpvj.exe23⤵
- Executes dropped EXE
PID:748 -
\??\c:\1fxflfx.exec:\1fxflfx.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\frffrrl.exec:\frffrrl.exe25⤵
- Executes dropped EXE
PID:808 -
\??\c:\ppdjp.exec:\ppdjp.exe26⤵
- Executes dropped EXE
PID:352 -
\??\c:\1pddd.exec:\1pddd.exe27⤵
- Executes dropped EXE
PID:544 -
\??\c:\lxlfrff.exec:\lxlfrff.exe28⤵
- Executes dropped EXE
PID:1404 -
\??\c:\vvjvd.exec:\vvjvd.exe29⤵
- Executes dropped EXE
PID:952 -
\??\c:\xlxflrr.exec:\xlxflrr.exe30⤵
- Executes dropped EXE
PID:340 -
\??\c:\bbhhth.exec:\bbhhth.exe31⤵
- Executes dropped EXE
PID:572 -
\??\c:\vpjvj.exec:\vpjvj.exe32⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3htnnn.exec:\3htnnn.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhhhtb.exec:\hhhhtb.exe35⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jvvjv.exec:\jvvjv.exe36⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe37⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rlflrrx.exec:\rlflrrx.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nhbhnt.exec:\nhbhnt.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pjdjv.exec:\pjdjv.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\frxflxf.exec:\frxflxf.exe41⤵
- Executes dropped EXE
PID:2444 -
\??\c:\frfffxf.exec:\frfffxf.exe42⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hhbbhh.exec:\hhbbhh.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\vpdjp.exec:\vpdjp.exe44⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvpvp.exec:\dvpvp.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rlffllf.exec:\rlffllf.exe46⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhtbnt.exec:\hhtbnt.exe47⤵
- Executes dropped EXE
PID:948 -
\??\c:\hntthh.exec:\hntthh.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjdjp.exec:\vjdjp.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\lxrxflf.exec:\lxrxflf.exe50⤵
- Executes dropped EXE
PID:2732 -
\??\c:\tttbhn.exec:\tttbhn.exe51⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvvdd.exec:\dvvdd.exe52⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe53⤵
- Executes dropped EXE
PID:1392 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hbhnbh.exec:\hbhnbh.exe55⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9dvdj.exec:\9dvdj.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dvpvd.exec:\dvpvd.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5frrxxf.exec:\5frrxxf.exe58⤵
- Executes dropped EXE
PID:748 -
\??\c:\5fxlxrf.exec:\5fxlxrf.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\bhbhhb.exec:\bhbhhb.exe60⤵
- Executes dropped EXE
PID:928 -
\??\c:\1vvdp.exec:\1vvdp.exe61⤵
- Executes dropped EXE
PID:332 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe62⤵
- Executes dropped EXE
PID:756 -
\??\c:\rxffrxr.exec:\rxffrxr.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhbbth.exec:\hhbbth.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\jjvdv.exec:\jjvdv.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vpdjv.exec:\vpdjv.exe66⤵PID:1412
-
\??\c:\frlrrxl.exec:\frlrrxl.exe67⤵PID:768
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe68⤵PID:572
-
\??\c:\tbbntb.exec:\tbbntb.exe69⤵PID:2036
-
\??\c:\9pvvd.exec:\9pvvd.exe70⤵PID:1676
-
\??\c:\pvjjp.exec:\pvjjp.exe71⤵PID:1152
-
\??\c:\xlxxlff.exec:\xlxxlff.exe72⤵PID:2888
-
\??\c:\nnntbh.exec:\nnntbh.exe73⤵PID:2148
-
\??\c:\7hbnhb.exec:\7hbnhb.exe74⤵PID:2776
-
\??\c:\pdpvd.exec:\pdpvd.exe75⤵PID:1672
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe76⤵PID:2552
-
\??\c:\rflrffl.exec:\rflrffl.exe77⤵PID:2788
-
\??\c:\tnbhtt.exec:\tnbhtt.exe78⤵PID:2784
-
\??\c:\vpvdj.exec:\vpvdj.exe79⤵PID:2408
-
\??\c:\vpjjv.exec:\vpjjv.exe80⤵PID:2468
-
\??\c:\3frrxxf.exec:\3frrxxf.exe81⤵PID:2644
-
\??\c:\bntbhh.exec:\bntbhh.exe82⤵PID:2984
-
\??\c:\nhtbnb.exec:\nhtbnb.exe83⤵PID:2660
-
\??\c:\ppvdj.exec:\ppvdj.exe84⤵PID:2308
-
\??\c:\7pppv.exec:\7pppv.exe85⤵PID:2992
-
\??\c:\fxrlrxf.exec:\fxrlrxf.exe86⤵PID:2668
-
\??\c:\bhnbtb.exec:\bhnbtb.exe87⤵PID:2376
-
\??\c:\7thhnn.exec:\7thhnn.exe88⤵PID:1260
-
\??\c:\dvjpd.exec:\dvjpd.exe89⤵PID:2756
-
\??\c:\vpjjv.exec:\vpjjv.exe90⤵PID:2064
-
\??\c:\rlrxlrl.exec:\rlrxlrl.exe91⤵PID:848
-
\??\c:\flxrlxl.exec:\flxrlxl.exe92⤵PID:2860
-
\??\c:\btnhbb.exec:\btnhbb.exe93⤵PID:2108
-
\??\c:\5pdpp.exec:\5pdpp.exe94⤵PID:528
-
\??\c:\7frrrrf.exec:\7frrrrf.exe95⤵PID:1432
-
\??\c:\5fxrxxx.exec:\5fxrxxx.exe96⤵PID:584
-
\??\c:\5bbntb.exec:\5bbntb.exe97⤵PID:2300
-
\??\c:\hnhbhh.exec:\hnhbhh.exe98⤵PID:924
-
\??\c:\pvdvv.exec:\pvdvv.exe99⤵PID:1016
-
\??\c:\xxxrflf.exec:\xxxrflf.exe100⤵PID:1968
-
\??\c:\xxxrlxl.exec:\xxxrlxl.exe101⤵PID:1764
-
\??\c:\bthnth.exec:\bthnth.exe102⤵PID:1096
-
\??\c:\7hhhnt.exec:\7hhhnt.exe103⤵PID:2556
-
\??\c:\9dddp.exec:\9dddp.exe104⤵PID:2040
-
\??\c:\vppvv.exec:\vppvv.exe105⤵PID:340
-
\??\c:\fxxflxl.exec:\fxxflxl.exe106⤵PID:2248
-
\??\c:\ffllrxr.exec:\ffllrxr.exe107⤵PID:1136
-
\??\c:\bhbnbn.exec:\bhbnbn.exe108⤵PID:1876
-
\??\c:\htbtbb.exec:\htbtbb.exe109⤵PID:2188
-
\??\c:\dpvpd.exec:\dpvpd.exe110⤵PID:1112
-
\??\c:\5lrlxfx.exec:\5lrlxfx.exe111⤵PID:1664
-
\??\c:\fllllfx.exec:\fllllfx.exe112⤵PID:2356
-
\??\c:\ttbthb.exec:\ttbthb.exe113⤵PID:2396
-
\??\c:\9btbhh.exec:\9btbhh.exe114⤵PID:1612
-
\??\c:\3dvvj.exec:\3dvvj.exe115⤵PID:2632
-
\??\c:\5jjdj.exec:\5jjdj.exe116⤵PID:1240
-
\??\c:\rxxlfxx.exec:\rxxlfxx.exe117⤵PID:2932
-
\??\c:\llxlxfr.exec:\llxlxfr.exe118⤵PID:2692
-
\??\c:\bbtthn.exec:\bbtthn.exe119⤵PID:2944
-
\??\c:\nnnhtn.exec:\nnnhtn.exe120⤵PID:2448
-
\??\c:\3jvjv.exec:\3jvjv.exe121⤵PID:2784
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe122⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-