Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 22:27
Behavioral task
behavioral1
Sample
4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe
- Size 377KB
- Sample240519-2db2tsdh9t
- SHA256 3f296e1123ddf547e990523a12274705d7307fcbfa55887892e65e0320221717
- MD5 4be88a026ee47c31eff2af36841ac3e0
- SHA1 84e4e91c84329949ee391be72b031318b7884473
- SHA512 32cb35d6750f31dd2f85475eccb92843bfec10f5ea4f29f2638b5187446c09d9c887c80e17468edf65d7af9160a5bc995a42d5a311a73d293a85d11673758fc0
- SSDEEP 6144:9cm4FmowdHoSABIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7N:/4wFHoSA4KofHfHTXQLzgvnzHPowYbv0
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3576-5-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4808-12-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4748-21-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4772-20-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4748-26-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1692-34-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2132-41-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/5000-49-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/952-54-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/848-60-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1548-68-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4056-83-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1144-78-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4812-90-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3740-96-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4908-103-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2136-110-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3396-118-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2256-119-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1244-126-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2868-140-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2868-145-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2520-136-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2872-154-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3000-159-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1244-130-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2256-125-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3000-166-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1424-161-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4580-173-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1228-181-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1924-187-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3472-197-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3436-194-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3436-202-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1328-208-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2164-209-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2164-213-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2948-223-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2160-232-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3316-230-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2056-236-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3904-241-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2692-242-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2692-246-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3464-247-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3464-251-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3508-252-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3508-256-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2748-261-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4916-266-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/952-271-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3380-276-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/848-277-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/848-281-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4296-286-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/1428-291-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3128-296-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/884-301-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/2360-306-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/4080-447-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3588-983-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/3720-1550-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon behavioral2/memory/684-1724-0x0000000000400000-0x0000000000460000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4808 flfxlrx.exe 4772 rfrfxxr.exe 4748 fxfxffr.exe 1692 rrfllxx.exe 2132 7dvpp.exe 5000 frxffxl.exe 952 tttnbn.exe 848 jjdvp.exe 1548 thtttb.exe 1144 pvvpj.exe 4056 thnhbt.exe 4812 rfffrrl.exe 3740 ntbbhh.exe 4908 pppdd.exe 2136 xrrrlfx.exe 3396 fxfflfl.exe 2256 btnhtb.exe 1244 ddjdd.exe 2520 fxlfxxr.exe 2868 nhnnhn.exe 2872 vjvjp.exe 1424 htntbn.exe 3000 nhbbbb.exe 4580 pjdpd.exe 1228 llxrffl.exe 1924 nttnbt.exe 3472 jjpdj.exe 3436 lxfxllf.exe 1328 tnbtnh.exe 2164 thtnnt.exe 2948 bttbnh.exe 3316 nbhtnt.exe 2160 pvddp.exe 2056 jpjjp.exe 3904 1xrrlff.exe 2692 nnnhbb.exe 3464 xllfxxr.exe 3508 fllfxrl.exe 2748 djjdp.exe 4916 btnnht.exe 952 vdjvv.exe 3380 ttttnb.exe 848 lrrlfxr.exe 4296 hnnhnh.exe 1428 3fxrlxl.exe 3128 vdpjd.exe 884 fxfflrf.exe 2360 bbbhbh.exe 1492 lfflxfx.exe 3740 bbhhhh.exe 2552 vjjvp.exe 1132 xrrrrxx.exe 4868 5pjpd.exe 2836 frflxrf.exe 2792 ddjjd.exe 3708 tbbbnt.exe 396 lxlllll.exe 4860 xxlffxx.exe 3604 djddj.exe 2064 ffrllll.exe 4256 lrlxfrx.exe 4620 jpdjv.exe 2444 lfrrrrr.exe 3256 djdvd.exe - Molebox Virtualization software 32 IoCs
Detects file using Molebox Virtualization software.
resource yara_rule behavioral2/files/0x000700000002328e-6.dat molebox behavioral2/files/0x000700000002342c-10.dat molebox behavioral2/files/0x000700000002342d-15.dat molebox behavioral2/files/0x000700000002342e-24.dat molebox behavioral2/files/0x000700000002342f-35.dat molebox behavioral2/files/0x0007000000023430-38.dat molebox behavioral2/files/0x0007000000023431-45.dat molebox behavioral2/files/0x0007000000023432-52.dat molebox behavioral2/files/0x0007000000023433-61.dat molebox behavioral2/files/0x0009000000023425-69.dat molebox behavioral2/files/0x0007000000023435-81.dat molebox behavioral2/files/0x0007000000023434-74.dat molebox behavioral2/files/0x0007000000023437-89.dat molebox behavioral2/files/0x0008000000023436-94.dat molebox behavioral2/files/0x0008000000023439-101.dat molebox behavioral2/files/0x000700000002343a-108.dat molebox behavioral2/files/0x000700000002343b-116.dat molebox behavioral2/files/0x000700000002343e-131.dat molebox behavioral2/files/0x000700000002343f-138.dat molebox behavioral2/files/0x0007000000023440-142.dat molebox behavioral2/files/0x0007000000023441-150.dat molebox behavioral2/files/0x0009000000023396-157.dat molebox behavioral2/files/0x000700000002343d-124.dat molebox behavioral2/files/0x0007000000023442-163.dat molebox behavioral2/files/0x0007000000023443-170.dat molebox behavioral2/files/0x0007000000023444-177.dat molebox behavioral2/files/0x0007000000023445-185.dat molebox behavioral2/files/0x0007000000023446-191.dat molebox behavioral2/files/0x0007000000023447-199.dat molebox behavioral2/files/0x0007000000023448-205.dat molebox behavioral2/files/0x0007000000023449-214.dat molebox behavioral2/files/0x000700000002344a-219.dat molebox -
resource yara_rule behavioral2/memory/3576-0-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002328e-6.dat upx behavioral2/memory/4808-7-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3576-5-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4808-12-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002342c-10.dat upx behavioral2/memory/4772-14-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002342d-15.dat upx behavioral2/memory/4748-21-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4772-20-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002342e-24.dat upx behavioral2/memory/4748-26-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1692-28-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2132-33-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1692-34-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002342f-35.dat upx behavioral2/files/0x0007000000023430-38.dat upx behavioral2/memory/5000-40-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2132-41-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023431-45.dat upx behavioral2/memory/952-47-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/5000-49-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/952-54-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023432-52.dat upx behavioral2/memory/848-56-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/848-60-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023433-61.dat upx behavioral2/memory/1548-63-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1144-70-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0009000000023425-69.dat upx behavioral2/memory/1548-68-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4056-75-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023435-81.dat upx behavioral2/memory/4812-84-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4056-83-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1144-78-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023434-74.dat upx behavioral2/files/0x0007000000023437-89.dat upx behavioral2/memory/4812-90-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3740-91-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0008000000023436-94.dat upx behavioral2/memory/3740-96-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/4908-98-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0008000000023439-101.dat upx behavioral2/memory/4908-103-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2136-104-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002343a-108.dat upx behavioral2/memory/2136-110-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/3396-113-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002343b-116.dat upx behavioral2/memory/3396-118-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2256-119-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/1244-126-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x000700000002343e-131.dat upx behavioral2/files/0x000700000002343f-138.dat upx behavioral2/memory/2868-140-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023440-142.dat upx behavioral2/memory/2872-147-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2868-145-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/memory/2520-136-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0007000000023441-150.dat upx behavioral2/memory/2872-154-0x0000000000400000-0x0000000000460000-memory.dmp upx behavioral2/files/0x0009000000023396-157.dat upx behavioral2/memory/3000-159-0x0000000000400000-0x0000000000460000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 4808 3576 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 83 PID 3576 wrote to memory of 4808 3576 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 83 PID 3576 wrote to memory of 4808 3576 4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe 83 PID 4808 wrote to memory of 4772 4808 flfxlrx.exe 84 PID 4808 wrote to memory of 4772 4808 flfxlrx.exe 84 PID 4808 wrote to memory of 4772 4808 flfxlrx.exe 84 PID 4772 wrote to memory of 4748 4772 rfrfxxr.exe 85 PID 4772 wrote to memory of 4748 4772 rfrfxxr.exe 85 PID 4772 wrote to memory of 4748 4772 rfrfxxr.exe 85 PID 4748 wrote to memory of 1692 4748 fxfxffr.exe 87 PID 4748 wrote to memory of 1692 4748 fxfxffr.exe 87 PID 4748 wrote to memory of 1692 4748 fxfxffr.exe 87 PID 1692 wrote to memory of 2132 1692 rrfllxx.exe 88 PID 1692 wrote to memory of 2132 1692 rrfllxx.exe 88 PID 1692 wrote to memory of 2132 1692 rrfllxx.exe 88 PID 2132 wrote to memory of 5000 2132 7dvpp.exe 89 PID 2132 wrote to memory of 5000 2132 7dvpp.exe 89 PID 2132 wrote to memory of 5000 2132 7dvpp.exe 89 PID 5000 wrote to memory of 952 5000 frxffxl.exe 91 PID 5000 wrote to memory of 952 5000 frxffxl.exe 91 PID 5000 wrote to memory of 952 5000 frxffxl.exe 91 PID 952 wrote to memory of 848 952 tttnbn.exe 92 PID 952 wrote to memory of 848 952 tttnbn.exe 92 PID 952 wrote to memory of 848 952 tttnbn.exe 92 PID 848 wrote to memory of 1548 848 jjdvp.exe 94 PID 848 wrote to memory of 1548 848 jjdvp.exe 94 PID 848 wrote to memory of 1548 848 jjdvp.exe 94 PID 1548 wrote to memory of 1144 1548 thtttb.exe 95 PID 1548 wrote to memory of 1144 1548 thtttb.exe 95 PID 1548 wrote to memory of 1144 1548 thtttb.exe 95 PID 1144 wrote to memory of 4056 1144 pvvpj.exe 96 PID 1144 wrote to memory of 4056 1144 pvvpj.exe 96 PID 1144 wrote to memory of 4056 1144 pvvpj.exe 96 PID 4056 wrote to memory of 4812 4056 thnhbt.exe 97 PID 4056 wrote to memory of 4812 4056 thnhbt.exe 97 PID 4056 wrote to memory of 4812 4056 thnhbt.exe 97 PID 4812 wrote to memory of 3740 4812 rfffrrl.exe 98 PID 4812 wrote to memory of 3740 4812 rfffrrl.exe 98 PID 4812 wrote to memory of 3740 4812 rfffrrl.exe 98 PID 3740 wrote to memory of 4908 3740 ntbbhh.exe 99 PID 3740 wrote to memory of 4908 3740 ntbbhh.exe 99 PID 3740 wrote to memory of 4908 3740 ntbbhh.exe 99 PID 4908 wrote to memory of 2136 4908 pppdd.exe 100 PID 4908 wrote to memory of 2136 4908 pppdd.exe 100 PID 4908 wrote to memory of 2136 4908 pppdd.exe 100 PID 2136 wrote to memory of 3396 2136 xrrrlfx.exe 101 PID 2136 wrote to memory of 3396 2136 xrrrlfx.exe 101 PID 2136 wrote to memory of 3396 2136 xrrrlfx.exe 101 PID 3396 wrote to memory of 2256 3396 fxfflfl.exe 102 PID 3396 wrote to memory of 2256 3396 fxfflfl.exe 102 PID 3396 wrote to memory of 2256 3396 fxfflfl.exe 102 PID 2256 wrote to memory of 1244 2256 btnhtb.exe 103 PID 2256 wrote to memory of 1244 2256 btnhtb.exe 103 PID 2256 wrote to memory of 1244 2256 btnhtb.exe 103 PID 1244 wrote to memory of 2520 1244 ddjdd.exe 104 PID 1244 wrote to memory of 2520 1244 ddjdd.exe 104 PID 1244 wrote to memory of 2520 1244 ddjdd.exe 104 PID 2520 wrote to memory of 2868 2520 fxlfxxr.exe 105 PID 2520 wrote to memory of 2868 2520 fxlfxxr.exe 105 PID 2520 wrote to memory of 2868 2520 fxlfxxr.exe 105 PID 2868 wrote to memory of 2872 2868 nhnnhn.exe 106 PID 2868 wrote to memory of 2872 2868 nhnnhn.exe 106 PID 2868 wrote to memory of 2872 2868 nhnnhn.exe 106 PID 2872 wrote to memory of 1424 2872 vjvjp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4be88a026ee47c31eff2af36841ac3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\flfxlrx.exec:\flfxlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rfrfxxr.exec:\rfrfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\fxfxffr.exec:\fxfxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\rrfllxx.exec:\rrfllxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\7dvpp.exec:\7dvpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\frxffxl.exec:\frxffxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\tttnbn.exec:\tttnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\jjdvp.exec:\jjdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\thtttb.exec:\thtttb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\pvvpj.exec:\pvvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\thnhbt.exec:\thnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
\??\c:\rfffrrl.exec:\rfffrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\ntbbhh.exec:\ntbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\pppdd.exec:\pppdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\xrrrlfx.exec:\xrrrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\fxfflfl.exec:\fxfflfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\btnhtb.exec:\btnhtb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\ddjdd.exec:\ddjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\nhnnhn.exec:\nhnnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vjvjp.exec:\vjvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\htntbn.exec:\htntbn.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nhbbbb.exec:\nhbbbb.exe24⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pjdpd.exec:\pjdpd.exe25⤵
- Executes dropped EXE
PID:4580 -
\??\c:\llxrffl.exec:\llxrffl.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nttnbt.exec:\nttnbt.exe27⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jjpdj.exec:\jjpdj.exe28⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lxfxllf.exec:\lxfxllf.exe29⤵
- Executes dropped EXE
PID:3436 -
\??\c:\tnbtnh.exec:\tnbtnh.exe30⤵
- Executes dropped EXE
PID:1328 -
\??\c:\thtnnt.exec:\thtnnt.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bttbnh.exec:\bttbnh.exe32⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nbhtnt.exec:\nbhtnt.exe33⤵
- Executes dropped EXE
PID:3316 -
\??\c:\pvddp.exec:\pvddp.exe34⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jpjjp.exec:\jpjjp.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1xrrlff.exec:\1xrrlff.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nnnhbb.exec:\nnnhbb.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xllfxxr.exec:\xllfxxr.exe38⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fllfxrl.exec:\fllfxrl.exe39⤵
- Executes dropped EXE
PID:3508 -
\??\c:\djjdp.exec:\djjdp.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\btnnht.exec:\btnnht.exe41⤵
- Executes dropped EXE
PID:4916 -
\??\c:\vdjvv.exec:\vdjvv.exe42⤵
- Executes dropped EXE
PID:952 -
\??\c:\ttttnb.exec:\ttttnb.exe43⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe44⤵
- Executes dropped EXE
PID:848 -
\??\c:\hnnhnh.exec:\hnnhnh.exe45⤵
- Executes dropped EXE
PID:4296 -
\??\c:\3fxrlxl.exec:\3fxrlxl.exe46⤵
- Executes dropped EXE
PID:1428 -
\??\c:\vdpjd.exec:\vdpjd.exe47⤵
- Executes dropped EXE
PID:3128 -
\??\c:\fxfflrf.exec:\fxfflrf.exe48⤵
- Executes dropped EXE
PID:884 -
\??\c:\bbbhbh.exec:\bbbhbh.exe49⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lfflxfx.exec:\lfflxfx.exe50⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bbhhhh.exec:\bbhhhh.exe51⤵
- Executes dropped EXE
PID:3740 -
\??\c:\vjjvp.exec:\vjjvp.exe52⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe53⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5pjpd.exec:\5pjpd.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\frflxrf.exec:\frflxrf.exe55⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddjjd.exec:\ddjjd.exe56⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbbbnt.exec:\tbbbnt.exe57⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lxlllll.exec:\lxlllll.exe58⤵
- Executes dropped EXE
PID:396 -
\??\c:\xxlffxx.exec:\xxlffxx.exe59⤵
- Executes dropped EXE
PID:4860 -
\??\c:\djddj.exec:\djddj.exe60⤵
- Executes dropped EXE
PID:3604 -
\??\c:\ffrllll.exec:\ffrllll.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lrlxfrx.exec:\lrlxfrx.exe62⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jpdjv.exec:\jpdjv.exe63⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\djdvd.exec:\djdvd.exe65⤵
- Executes dropped EXE
PID:3256 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe66⤵PID:1924
-
\??\c:\nbtbnh.exec:\nbtbnh.exe67⤵PID:3472
-
\??\c:\thnnnt.exec:\thnnnt.exe68⤵PID:2328
-
\??\c:\jpppp.exec:\jpppp.exe69⤵PID:4712
-
\??\c:\flrlxrr.exec:\flrlxrr.exe70⤵PID:896
-
\??\c:\bnttnn.exec:\bnttnn.exe71⤵PID:4416
-
\??\c:\bbnhnn.exec:\bbnhnn.exe72⤵PID:1208
-
\??\c:\vjjjv.exec:\vjjjv.exe73⤵PID:1540
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe74⤵PID:1136
-
\??\c:\7llllrr.exec:\7llllrr.exe75⤵PID:4276
-
\??\c:\9nbbhh.exec:\9nbbhh.exe76⤵PID:4748
-
\??\c:\vjvvp.exec:\vjvvp.exe77⤵PID:4968
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe78⤵PID:4080
-
\??\c:\bbtbhb.exec:\bbtbhb.exe79⤵PID:1868
-
\??\c:\bhbnht.exec:\bhbnht.exe80⤵PID:3712
-
\??\c:\jpdjp.exec:\jpdjp.exe81⤵PID:2748
-
\??\c:\frrxfxl.exec:\frrxfxl.exe82⤵PID:4916
-
\??\c:\bnhbbn.exec:\bnhbbn.exe83⤵PID:752
-
\??\c:\nnnttt.exec:\nnnttt.exe84⤵PID:3560
-
\??\c:\jvddj.exec:\jvddj.exe85⤵PID:4296
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe86⤵PID:4736
-
\??\c:\1tnnnn.exec:\1tnnnn.exe87⤵PID:552
-
\??\c:\dpjvj.exec:\dpjvj.exe88⤵PID:2944
-
\??\c:\fxffxff.exec:\fxffxff.exe89⤵PID:4568
-
\??\c:\tbbnbt.exec:\tbbnbt.exe90⤵PID:1980
-
\??\c:\djdjv.exec:\djdjv.exe91⤵PID:2372
-
\??\c:\vjppj.exec:\vjppj.exe92⤵PID:3476
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe93⤵PID:1952
-
\??\c:\thtntn.exec:\thtntn.exe94⤵PID:3652
-
\??\c:\vdvvj.exec:\vdvvj.exe95⤵PID:2520
-
\??\c:\bhtnhh.exec:\bhtnhh.exe96⤵PID:2620
-
\??\c:\nttthb.exec:\nttthb.exe97⤵PID:3784
-
\??\c:\vvdjd.exec:\vvdjd.exe98⤵PID:2140
-
\??\c:\rxxrlxr.exec:\rxxrlxr.exe99⤵PID:2756
-
\??\c:\thbntb.exec:\thbntb.exe100⤵PID:2904
-
\??\c:\vdvpj.exec:\vdvpj.exe101⤵PID:2496
-
\??\c:\lxffxxx.exec:\lxffxxx.exe102⤵PID:4132
-
\??\c:\rrrllff.exec:\rrrllff.exe103⤵PID:1036
-
\??\c:\htnhhb.exec:\htnhhb.exe104⤵PID:1228
-
\??\c:\vvjjj.exec:\vvjjj.exe105⤵PID:3852
-
\??\c:\jvpvp.exec:\jvpvp.exe106⤵PID:3244
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe107⤵PID:2116
-
\??\c:\bhnhbh.exec:\bhnhbh.exe108⤵PID:3216
-
\??\c:\5vjjp.exec:\5vjjp.exe109⤵PID:896
-
\??\c:\rrlffff.exec:\rrlffff.exe110⤵PID:4068
-
\??\c:\1rxrffr.exec:\1rxrffr.exe111⤵PID:4660
-
\??\c:\tntnhb.exec:\tntnhb.exe112⤵PID:3788
-
\??\c:\7vvpj.exec:\7vvpj.exe113⤵PID:4208
-
\??\c:\pdpdj.exec:\pdpdj.exe114⤵PID:892
-
\??\c:\fxxxrll.exec:\fxxxrll.exe115⤵PID:4996
-
\??\c:\bbnhhn.exec:\bbnhhn.exe116⤵PID:3940
-
\??\c:\nnttnn.exec:\nnttnn.exe117⤵PID:1972
-
\??\c:\ppjvp.exec:\ppjvp.exe118⤵PID:752
-
\??\c:\1rxrflf.exec:\1rxrflf.exe119⤵PID:1428
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe120⤵PID:1356
-
\??\c:\tnnhhh.exec:\tnnhhh.exe121⤵PID:1600
-
\??\c:\ddddv.exec:\ddddv.exe122⤵PID:3780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-