Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:01
Behavioral task
behavioral1
Sample
3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe
-
Size
455KB
-
MD5
3c3b26c537169ecff8e2bd22cb4a5610
-
SHA1
7d08704c489e9b256fed52ebd6915a5908623cb2
-
SHA256
28e5b67ce995be5d35afb3e234428b8a0412f978b1564228f974a532f2507c26
-
SHA512
d786c5f08b93c9f67bc2ee9b8eb83a9cae04e81fb552cbfe933676a16a5186c57aace48cd4cc7f2a8859150bdc7d7322fabae4707b4f896246c331d7a23df65e
-
SSDEEP
12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzploA:rd0gFp3lz1/uzploA
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2128-8-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2328-20-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2552-31-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2976-29-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2680-48-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2712-56-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2672-68-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2576-71-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2424-86-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/3004-94-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1564-104-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2772-124-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1432-149-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2496-160-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/856-177-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1760-213-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1948-227-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2356-236-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/804-248-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/348-256-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1032-266-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1132-269-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1412-301-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1504-315-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2528-366-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2408-392-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2380-457-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2940-485-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1032-571-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1648-602-0x0000000000220000-0x0000000000258000-memory.dmp family_blackmoon behavioral1/memory/1416-605-0x00000000003C0000-0x00000000003F8000-memory.dmp family_blackmoon behavioral1/memory/2568-641-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2400-685-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2652-711-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/1808-730-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/2848-819-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/780-858-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral1/memory/284-961-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2128-0-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2128-3-0x0000000001C80000-0x0000000001CB8000-memory.dmp family_berbew C:\jjdvv.exe family_berbew behavioral1/memory/2128-8-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2328-20-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\lxflffr.exe family_berbew C:\bnbbbh.exe family_berbew behavioral1/memory/2552-31-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2976-29-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\3vvdd.exe family_berbew behavioral1/memory/2680-48-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\xfxrlxx.exe family_berbew C:\7pjvd.exe family_berbew behavioral1/memory/2712-56-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2672-58-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2672-68-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew \??\c:\3nnbnt.exe family_berbew behavioral1/memory/2576-71-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\vvdjp.exe family_berbew behavioral1/memory/2424-86-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\ppppj.exe family_berbew behavioral1/memory/3004-94-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\vpdjp.exe family_berbew C:\bbhtnh.exe family_berbew behavioral1/memory/1564-104-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2652-111-0x0000000000270000-0x00000000002A8000-memory.dmp family_berbew C:\djpdd.exe family_berbew C:\hhbbth.exe family_berbew behavioral1/memory/2772-124-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\pjpjd.exe family_berbew C:\nnbhtb.exe family_berbew behavioral1/memory/1432-149-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\xffrxll.exe family_berbew \??\c:\9dvdp.exe family_berbew behavioral1/memory/2496-160-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\dvjpd.exe family_berbew behavioral1/memory/2496-168-0x00000000005D0000-0x0000000000608000-memory.dmp family_berbew C:\ppjpd.exe family_berbew behavioral1/memory/856-177-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\9rfrffl.exe family_berbew C:\dvpjv.exe family_berbew C:\7lxflrf.exe family_berbew \??\c:\ddvjj.exe family_berbew behavioral1/memory/1760-213-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\rrrrrxx.exe family_berbew behavioral1/memory/1948-227-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\ppdvp.exe family_berbew C:\xxrrflf.exe family_berbew behavioral1/memory/2356-236-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\dvddd.exe family_berbew behavioral1/memory/804-248-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\1bbnnn.exe family_berbew behavioral1/memory/348-256-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\rlxfrrx.exe family_berbew behavioral1/memory/1032-266-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/1132-269-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew C:\7ttbbh.exe family_berbew C:\7llrrxl.exe family_berbew C:\hnhttt.exe family_berbew behavioral1/memory/1648-293-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/1412-301-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/1504-315-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2704-358-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral1/memory/2528-366-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
jjdvv.exelxflffr.exebnbbbh.exe3vvdd.exexfxrlxx.exe7pjvd.exe3nnbnt.exevvdjp.exeppppj.exevpdjp.exebbhtnh.exedjpdd.exehhbbth.exepjpjd.exennbhtb.exexffrxll.exe9dvdp.exedvjpd.exeppjpd.exe9rfrffl.exedvpjv.exe7lxflrf.exeddvjj.exerrrrrxx.exeppdvp.exexxrrflf.exedvddd.exe1bbnnn.exerlxfrrx.exe7ttbbh.exe7llrrxl.exehnhttt.exefxrfffr.exehhbtht.exepjvdp.exe9xrrfrf.exetnhhbt.exebhbnhh.exedvjvj.exelrrrrrl.exenhttht.exebbnthn.exe1ddvv.exexrflrxl.exebtnthn.exe5vjpp.exeppdpd.exexrlxrrf.exe3bnnbb.exedjdvp.exexxlxflr.exe1lfflrf.exevpdjj.exellflrlx.exe1llrrff.exe3btnhh.exeddvjv.exeffxxffl.exenhtbbn.exe3btthn.exejjjdp.exerlffxxl.exetbbnhn.exevpjdp.exepid process 2328 jjdvv.exe 2976 lxflffr.exe 2552 bnbbbh.exe 2680 3vvdd.exe 2712 xfxrlxx.exe 2672 7pjvd.exe 2576 3nnbnt.exe 2424 vvdjp.exe 3004 ppppj.exe 1564 vpdjp.exe 2652 bbhtnh.exe 2772 djpdd.exe 1436 hhbbth.exe 2140 pjpjd.exe 1432 nnbhtb.exe 616 xffrxll.exe 2496 9dvdp.exe 856 dvjpd.exe 2908 ppjpd.exe 1196 9rfrffl.exe 2020 dvpjv.exe 1976 7lxflrf.exe 1760 ddvjj.exe 1948 rrrrrxx.exe 2356 ppdvp.exe 804 xxrrflf.exe 348 dvddd.exe 1032 1bbnnn.exe 1132 rlxfrrx.exe 2284 7ttbbh.exe 1656 7llrrxl.exe 1648 hnhttt.exe 1412 fxrfffr.exe 1632 hhbtht.exe 1504 pjvdp.exe 2492 9xrrfrf.exe 2116 tnhhbt.exe 2220 bhbnhh.exe 2616 dvjvj.exe 2552 lrrrrrl.exe 2536 nhttht.exe 2704 bbnthn.exe 2528 1ddvv.exe 2692 xrflrxl.exe 2436 btnthn.exe 2408 5vjpp.exe 1696 ppdpd.exe 3004 xrlxrrf.exe 2628 3bnnbb.exe 2760 djdvp.exe 2784 xxlxflr.exe 2780 1lfflrf.exe 892 vpdjj.exe 868 llflrlx.exe 1188 1llrrff.exe 2380 3btnhh.exe 1304 ddvjv.exe 1112 ffxxffl.exe 2496 nhtbbn.exe 2444 3btthn.exe 2940 jjjdp.exe 2144 rlffxxl.exe 1996 tbbnhn.exe 1936 vpjdp.exe -
Processes:
resource yara_rule behavioral1/memory/2128-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2128-3-0x0000000001C80000-0x0000000001CB8000-memory.dmp upx C:\jjdvv.exe upx behavioral1/memory/2128-8-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2328-20-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\lxflffr.exe upx C:\bnbbbh.exe upx behavioral1/memory/2552-31-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2976-29-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\3vvdd.exe upx behavioral1/memory/2680-48-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\xfxrlxx.exe upx C:\7pjvd.exe upx behavioral1/memory/2712-56-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2672-58-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2672-68-0x0000000000400000-0x0000000000438000-memory.dmp upx \??\c:\3nnbnt.exe upx behavioral1/memory/2576-71-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\vvdjp.exe upx behavioral1/memory/2424-86-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\ppppj.exe upx behavioral1/memory/3004-94-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\vpdjp.exe upx C:\bbhtnh.exe upx behavioral1/memory/1564-104-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\djpdd.exe upx C:\hhbbth.exe upx behavioral1/memory/2772-124-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\pjpjd.exe upx C:\nnbhtb.exe upx behavioral1/memory/1432-149-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\xffrxll.exe upx \??\c:\9dvdp.exe upx behavioral1/memory/2496-160-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\dvjpd.exe upx C:\ppjpd.exe upx behavioral1/memory/856-177-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\9rfrffl.exe upx C:\dvpjv.exe upx C:\7lxflrf.exe upx \??\c:\ddvjj.exe upx behavioral1/memory/1760-213-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\rrrrrxx.exe upx behavioral1/memory/1948-227-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\ppdvp.exe upx C:\xxrrflf.exe upx behavioral1/memory/2356-236-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\dvddd.exe upx behavioral1/memory/804-248-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\1bbnnn.exe upx behavioral1/memory/348-256-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\rlxfrrx.exe upx behavioral1/memory/1032-266-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1132-269-0x0000000000400000-0x0000000000438000-memory.dmp upx C:\7ttbbh.exe upx C:\7llrrxl.exe upx C:\hnhttt.exe upx behavioral1/memory/1648-293-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1412-301-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/1504-315-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2704-358-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2528-366-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2692-373-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral1/memory/2408-392-0x0000000000400000-0x0000000000438000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exejjdvv.exelxflffr.exebnbbbh.exe3vvdd.exexfxrlxx.exe7pjvd.exe3nnbnt.exevvdjp.exeppppj.exevpdjp.exebbhtnh.exedjpdd.exehhbbth.exepjpjd.exennbhtb.exedescription pid process target process PID 2128 wrote to memory of 2328 2128 3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe jjdvv.exe PID 2128 wrote to memory of 2328 2128 3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe jjdvv.exe PID 2128 wrote to memory of 2328 2128 3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe jjdvv.exe PID 2128 wrote to memory of 2328 2128 3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe jjdvv.exe PID 2328 wrote to memory of 2976 2328 jjdvv.exe lxflffr.exe PID 2328 wrote to memory of 2976 2328 jjdvv.exe lxflffr.exe PID 2328 wrote to memory of 2976 2328 jjdvv.exe lxflffr.exe PID 2328 wrote to memory of 2976 2328 jjdvv.exe lxflffr.exe PID 2976 wrote to memory of 2552 2976 lxflffr.exe bnbbbh.exe PID 2976 wrote to memory of 2552 2976 lxflffr.exe bnbbbh.exe PID 2976 wrote to memory of 2552 2976 lxflffr.exe bnbbbh.exe PID 2976 wrote to memory of 2552 2976 lxflffr.exe bnbbbh.exe PID 2552 wrote to memory of 2680 2552 bnbbbh.exe 3vvdd.exe PID 2552 wrote to memory of 2680 2552 bnbbbh.exe 3vvdd.exe PID 2552 wrote to memory of 2680 2552 bnbbbh.exe 3vvdd.exe PID 2552 wrote to memory of 2680 2552 bnbbbh.exe 3vvdd.exe PID 2680 wrote to memory of 2712 2680 3vvdd.exe xfxrlxx.exe PID 2680 wrote to memory of 2712 2680 3vvdd.exe xfxrlxx.exe PID 2680 wrote to memory of 2712 2680 3vvdd.exe xfxrlxx.exe PID 2680 wrote to memory of 2712 2680 3vvdd.exe xfxrlxx.exe PID 2712 wrote to memory of 2672 2712 xfxrlxx.exe 7pjvd.exe PID 2712 wrote to memory of 2672 2712 xfxrlxx.exe 7pjvd.exe PID 2712 wrote to memory of 2672 2712 xfxrlxx.exe 7pjvd.exe PID 2712 wrote to memory of 2672 2712 xfxrlxx.exe 7pjvd.exe PID 2672 wrote to memory of 2576 2672 7pjvd.exe 3nnbnt.exe PID 2672 wrote to memory of 2576 2672 7pjvd.exe 3nnbnt.exe PID 2672 wrote to memory of 2576 2672 7pjvd.exe 3nnbnt.exe PID 2672 wrote to memory of 2576 2672 7pjvd.exe 3nnbnt.exe PID 2576 wrote to memory of 2424 2576 3nnbnt.exe vvdjp.exe PID 2576 wrote to memory of 2424 2576 3nnbnt.exe vvdjp.exe PID 2576 wrote to memory of 2424 2576 3nnbnt.exe vvdjp.exe PID 2576 wrote to memory of 2424 2576 3nnbnt.exe vvdjp.exe PID 2424 wrote to memory of 3004 2424 vvdjp.exe ppppj.exe PID 2424 wrote to memory of 3004 2424 vvdjp.exe ppppj.exe PID 2424 wrote to memory of 3004 2424 vvdjp.exe ppppj.exe PID 2424 wrote to memory of 3004 2424 vvdjp.exe ppppj.exe PID 3004 wrote to memory of 1564 3004 ppppj.exe vpdjp.exe PID 3004 wrote to memory of 1564 3004 ppppj.exe vpdjp.exe PID 3004 wrote to memory of 1564 3004 ppppj.exe vpdjp.exe PID 3004 wrote to memory of 1564 3004 ppppj.exe vpdjp.exe PID 1564 wrote to memory of 2652 1564 vpdjp.exe bbhtnh.exe PID 1564 wrote to memory of 2652 1564 vpdjp.exe bbhtnh.exe PID 1564 wrote to memory of 2652 1564 vpdjp.exe bbhtnh.exe PID 1564 wrote to memory of 2652 1564 vpdjp.exe bbhtnh.exe PID 2652 wrote to memory of 2772 2652 bbhtnh.exe djpdd.exe PID 2652 wrote to memory of 2772 2652 bbhtnh.exe djpdd.exe PID 2652 wrote to memory of 2772 2652 bbhtnh.exe djpdd.exe PID 2652 wrote to memory of 2772 2652 bbhtnh.exe djpdd.exe PID 2772 wrote to memory of 1436 2772 djpdd.exe hhbbth.exe PID 2772 wrote to memory of 1436 2772 djpdd.exe hhbbth.exe PID 2772 wrote to memory of 1436 2772 djpdd.exe hhbbth.exe PID 2772 wrote to memory of 1436 2772 djpdd.exe hhbbth.exe PID 1436 wrote to memory of 2140 1436 hhbbth.exe pjpjd.exe PID 1436 wrote to memory of 2140 1436 hhbbth.exe pjpjd.exe PID 1436 wrote to memory of 2140 1436 hhbbth.exe pjpjd.exe PID 1436 wrote to memory of 2140 1436 hhbbth.exe pjpjd.exe PID 2140 wrote to memory of 1432 2140 pjpjd.exe nnbhtb.exe PID 2140 wrote to memory of 1432 2140 pjpjd.exe nnbhtb.exe PID 2140 wrote to memory of 1432 2140 pjpjd.exe nnbhtb.exe PID 2140 wrote to memory of 1432 2140 pjpjd.exe nnbhtb.exe PID 1432 wrote to memory of 616 1432 nnbhtb.exe xffrxll.exe PID 1432 wrote to memory of 616 1432 nnbhtb.exe xffrxll.exe PID 1432 wrote to memory of 616 1432 nnbhtb.exe xffrxll.exe PID 1432 wrote to memory of 616 1432 nnbhtb.exe xffrxll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3c3b26c537169ecff8e2bd22cb4a5610_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\jjdvv.exec:\jjdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\lxflffr.exec:\lxflffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\bnbbbh.exec:\bnbbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\3vvdd.exec:\3vvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xfxrlxx.exec:\xfxrlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7pjvd.exec:\7pjvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\3nnbnt.exec:\3nnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\vvdjp.exec:\vvdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\ppppj.exec:\ppppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vpdjp.exec:\vpdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\bbhtnh.exec:\bbhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\djpdd.exec:\djpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hhbbth.exec:\hhbbth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\nnbhtb.exec:\nnbhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\xffrxll.exec:\xffrxll.exe17⤵
- Executes dropped EXE
PID:616 -
\??\c:\9dvdp.exec:\9dvdp.exe18⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dvjpd.exec:\dvjpd.exe19⤵
- Executes dropped EXE
PID:856 -
\??\c:\ppjpd.exec:\ppjpd.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\9rfrffl.exec:\9rfrffl.exe21⤵
- Executes dropped EXE
PID:1196 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7lxflrf.exec:\7lxflrf.exe23⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ddvjj.exec:\ddvjj.exe24⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe25⤵
- Executes dropped EXE
PID:1948 -
\??\c:\ppdvp.exec:\ppdvp.exe26⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xxrrflf.exec:\xxrrflf.exe27⤵
- Executes dropped EXE
PID:804 -
\??\c:\dvddd.exec:\dvddd.exe28⤵
- Executes dropped EXE
PID:348 -
\??\c:\1bbnnn.exec:\1bbnnn.exe29⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe30⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7ttbbh.exec:\7ttbbh.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7llrrxl.exec:\7llrrxl.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hnhttt.exec:\hnhttt.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\fxrfffr.exec:\fxrfffr.exe34⤵
- Executes dropped EXE
PID:1412 -
\??\c:\hhbtht.exec:\hhbtht.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjvdp.exec:\pjvdp.exe36⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9xrrfrf.exec:\9xrrfrf.exe37⤵
- Executes dropped EXE
PID:2492 -
\??\c:\tnhhbt.exec:\tnhhbt.exe38⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bhbnhh.exec:\bhbnhh.exe39⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvjvj.exec:\dvjvj.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lrrrrrl.exec:\lrrrrrl.exe41⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhttht.exec:\nhttht.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\bbnthn.exec:\bbnthn.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1ddvv.exec:\1ddvv.exe44⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xrflrxl.exec:\xrflrxl.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\btnthn.exec:\btnthn.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\5vjpp.exec:\5vjpp.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppdpd.exec:\ppdpd.exe48⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrlxrrf.exec:\xrlxrrf.exe49⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3bnnbb.exec:\3bnnbb.exe50⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djdvp.exec:\djdvp.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxlxflr.exec:\xxlxflr.exe52⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1lfflrf.exec:\1lfflrf.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpdjj.exec:\vpdjj.exe54⤵
- Executes dropped EXE
PID:892 -
\??\c:\llflrlx.exec:\llflrlx.exe55⤵
- Executes dropped EXE
PID:868 -
\??\c:\1llrrff.exec:\1llrrff.exe56⤵
- Executes dropped EXE
PID:1188 -
\??\c:\3btnhh.exec:\3btnhh.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\ddvjv.exec:\ddvjv.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ffxxffl.exec:\ffxxffl.exe59⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nhtbbn.exec:\nhtbbn.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3btthn.exec:\3btthn.exe61⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jjjdp.exec:\jjjdp.exe62⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlffxxl.exec:\rlffxxl.exe63⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tbbnhn.exec:\tbbnhn.exe64⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vpjdp.exec:\vpjdp.exe65⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1fffffl.exec:\1fffffl.exe66⤵PID:2936
-
\??\c:\7lflflf.exec:\7lflflf.exe67⤵PID:1760
-
\??\c:\nnbttb.exec:\nnbttb.exe68⤵PID:2752
-
\??\c:\vvpdp.exec:\vvpdp.exe69⤵PID:2272
-
\??\c:\ffrflrf.exec:\ffrflrf.exe70⤵PID:1676
-
\??\c:\ttnttt.exec:\ttnttt.exe71⤵PID:1524
-
\??\c:\pvddv.exec:\pvddv.exe72⤵PID:2244
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe73⤵PID:336
-
\??\c:\lllrxlx.exec:\lllrxlx.exe74⤵PID:1032
-
\??\c:\3hbhnt.exec:\3hbhnt.exe75⤵PID:1420
-
\??\c:\ddvdv.exec:\ddvdv.exe76⤵PID:824
-
\??\c:\7xlflrx.exec:\7xlflrx.exe77⤵PID:3016
-
\??\c:\bbtthn.exec:\bbtthn.exe78⤵PID:2804
-
\??\c:\7jvvp.exec:\7jvvp.exe79⤵PID:1648
-
\??\c:\rxrffrl.exec:\rxrffrl.exe80⤵PID:1416
-
\??\c:\bthhtb.exec:\bthhtb.exe81⤵PID:1640
-
\??\c:\tthtnb.exec:\tthtnb.exe82⤵PID:1504
-
\??\c:\vpjvd.exec:\vpjvd.exe83⤵PID:2344
-
\??\c:\ffrffff.exec:\ffrffff.exe84⤵PID:2116
-
\??\c:\bbbnhh.exec:\bbbnhh.exe85⤵PID:2220
-
\??\c:\ppdjd.exec:\ppdjd.exe86⤵PID:2568
-
\??\c:\lllxlrl.exec:\lllxlrl.exe87⤵PID:2412
-
\??\c:\1fxfrxl.exec:\1fxfrxl.exe88⤵PID:2824
-
\??\c:\hhbhth.exec:\hhbhth.exe89⤵PID:2728
-
\??\c:\pvdpd.exec:\pvdpd.exe90⤵PID:2672
-
\??\c:\xxxxlfl.exec:\xxxxlfl.exe91⤵PID:2576
-
\??\c:\lrrxlfx.exec:\lrrxlfx.exe92⤵PID:2400
-
\??\c:\7hbbth.exec:\7hbbth.exe93⤵PID:2420
-
\??\c:\pppdj.exec:\pppdj.exe94⤵PID:1696
-
\??\c:\frxrlxl.exec:\frxrlxl.exe95⤵PID:1884
-
\??\c:\nhbhnb.exec:\nhbhnb.exe96⤵PID:2628
-
\??\c:\bbnthh.exec:\bbnthh.exe97⤵PID:2652
-
\??\c:\djppj.exec:\djppj.exe98⤵PID:2136
-
\??\c:\lllxlrf.exec:\lllxlrf.exe99⤵PID:1808
-
\??\c:\bbbnbn.exec:\bbbnbn.exe100⤵PID:1812
-
\??\c:\vpppv.exec:\vpppv.exe101⤵PID:1764
-
\??\c:\rxrrfrf.exec:\rxrrfrf.exe102⤵PID:1432
-
\??\c:\tthbhn.exec:\tthbhn.exe103⤵PID:2656
-
\??\c:\vpjvd.exec:\vpjvd.exe104⤵PID:1336
-
\??\c:\9djjj.exec:\9djjj.exe105⤵PID:1244
-
\??\c:\9xfxlxf.exec:\9xfxlxf.exe106⤵PID:3064
-
\??\c:\hbthnt.exec:\hbthnt.exe107⤵PID:2948
-
\??\c:\pjdjd.exec:\pjdjd.exe108⤵PID:1932
-
\??\c:\ddddp.exec:\ddddp.exe109⤵PID:1600
-
\??\c:\xflrfff.exec:\xflrfff.exe110⤵PID:2196
-
\??\c:\nnbhtb.exec:\nnbhtb.exe111⤵PID:1916
-
\??\c:\ppjdp.exec:\ppjdp.exe112⤵PID:1596
-
\??\c:\5jdjj.exec:\5jdjj.exe113⤵PID:404
-
\??\c:\xxlrffr.exec:\xxlrffr.exe114⤵PID:2848
-
\??\c:\5hbbbh.exec:\5hbbbh.exe115⤵PID:1204
-
\??\c:\pvpjv.exec:\pvpjv.exe116⤵PID:944
-
\??\c:\ffxllrl.exec:\ffxllrl.exe117⤵PID:988
-
\??\c:\nnhnbh.exec:\nnhnbh.exe118⤵PID:800
-
\??\c:\5vpjj.exec:\5vpjj.exe119⤵PID:2260
-
\??\c:\jddvp.exec:\jddvp.exe120⤵PID:780
-
\??\c:\rrllrxx.exec:\rrllrxx.exe121⤵PID:2004
-
\??\c:\tbbnbh.exec:\tbbnbh.exe122⤵PID:2888
-
\??\c:\dvpdd.exec:\dvpdd.exe123⤵PID:1656
-
\??\c:\lrlfxrx.exec:\lrlfxrx.exe124⤵PID:2160
-
\??\c:\3htttb.exec:\3htttb.exe125⤵PID:1984
-
\??\c:\vdppv.exec:\vdppv.exe126⤵PID:2128
-
\??\c:\3pvpp.exec:\3pvpp.exe127⤵PID:2312
-
\??\c:\xxrrxxx.exec:\xxrrxxx.exe128⤵PID:1644
-
\??\c:\bhbhbn.exec:\bhbhbn.exe129⤵PID:2328
-
\??\c:\9jvjd.exec:\9jvjd.exe130⤵PID:1604
-
\??\c:\fxxrffr.exec:\fxxrffr.exe131⤵PID:2676
-
\??\c:\xxrfrfx.exec:\xxrfrfx.exe132⤵PID:2564
-
\??\c:\nbnbtn.exec:\nbnbtn.exe133⤵PID:3056
-
\??\c:\7dvjd.exec:\7dvjd.exe134⤵PID:2648
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe135⤵PID:2432
-
\??\c:\htnhbn.exec:\htnhbn.exe136⤵PID:284
-
\??\c:\1vvdd.exec:\1vvdd.exe137⤵PID:2696
-
\??\c:\xxrllll.exec:\xxrllll.exe138⤵PID:2916
-
\??\c:\lllxlxr.exec:\lllxlxr.exe139⤵PID:2932
-
\??\c:\ttthbh.exec:\ttthbh.exe140⤵PID:2620
-
\??\c:\vdjdd.exec:\vdjdd.exe141⤵PID:2508
-
\??\c:\lfrxllx.exec:\lfrxllx.exe142⤵PID:2756
-
\??\c:\3hbbtb.exec:\3hbbtb.exe143⤵PID:2068
-
\??\c:\9thnhh.exec:\9thnhh.exe144⤵PID:1484
-
\??\c:\dvpjv.exec:\dvpjv.exe145⤵PID:1748
-
\??\c:\llxxffl.exec:\llxxffl.exe146⤵PID:2292
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe147⤵PID:2060
-
\??\c:\nhbbnt.exec:\nhbbnt.exe148⤵PID:2476
-
\??\c:\vdjpv.exec:\vdjpv.exe149⤵PID:2512
-
\??\c:\9xxxlrx.exec:\9xxxlrx.exe150⤵PID:1232
-
\??\c:\fxrfxlf.exec:\fxrfxlf.exe151⤵PID:852
-
\??\c:\7nnbtn.exec:\7nnbtn.exe152⤵PID:2040
-
\??\c:\ddpvd.exec:\ddpvd.exe153⤵PID:2496
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe154⤵PID:2908
-
\??\c:\tbhthn.exec:\tbhthn.exe155⤵PID:1920
-
\??\c:\ttnnht.exec:\ttnnht.exe156⤵PID:1924
-
\??\c:\jpvvv.exec:\jpvvv.exe157⤵PID:1992
-
\??\c:\rxxfxff.exec:\rxxfxff.exe158⤵PID:1936
-
\??\c:\hhnhtb.exec:\hhnhtb.exe159⤵PID:1704
-
\??\c:\hbbntb.exec:\hbbntb.exe160⤵PID:1088
-
\??\c:\9jjpj.exec:\9jjpj.exe161⤵PID:404
-
\??\c:\9flxlxl.exec:\9flxlxl.exe162⤵PID:2848
-
\??\c:\tttbnt.exec:\tttbnt.exe163⤵PID:1472
-
\??\c:\tnnthh.exec:\tnnthh.exe164⤵PID:944
-
\??\c:\vjpdj.exec:\vjpdj.exe165⤵PID:340
-
\??\c:\rrrxrxr.exec:\rrrxrxr.exe166⤵PID:1660
-
\??\c:\bbhnbh.exec:\bbhnbh.exe167⤵PID:1444
-
\??\c:\tbbnbn.exec:\tbbnbn.exe168⤵PID:1032
-
\??\c:\7jdpd.exec:\7jdpd.exe169⤵PID:1420
-
\??\c:\3rxlxfr.exec:\3rxlxfr.exe170⤵PID:2148
-
\??\c:\xlxrrxr.exec:\xlxrrxr.exe171⤵PID:3016
-
\??\c:\nhbhhn.exec:\nhbhhn.exe172⤵PID:2100
-
\??\c:\dpdpd.exec:\dpdpd.exe173⤵PID:1648
-
\??\c:\lfrfrff.exec:\lfrfrff.exe174⤵PID:1412
-
\??\c:\rrlrxfx.exec:\rrlrxfx.exe175⤵PID:2720
-
\??\c:\hnhtbn.exec:\hnhtbn.exe176⤵PID:2488
-
\??\c:\7vjvj.exec:\7vjvj.exe177⤵PID:2188
-
\??\c:\jppvp.exec:\jppvp.exe178⤵PID:2612
-
\??\c:\7xfrlrx.exec:\7xfrlrx.exe179⤵PID:2596
-
\??\c:\hhbnnb.exec:\hhbnnb.exe180⤵PID:2552
-
\??\c:\ppdvj.exec:\ppdvj.exe181⤵PID:2820
-
\??\c:\frrlrxl.exec:\frrlrxl.exe182⤵PID:2744
-
\??\c:\llflxrx.exec:\llflxrx.exe183⤵PID:2524
-
\??\c:\3ttntn.exec:\3ttntn.exe184⤵PID:2440
-
\??\c:\dpjdp.exec:\dpjdp.exe185⤵PID:284
-
\??\c:\lxxllxf.exec:\lxxllxf.exe186⤵PID:2484
-
\??\c:\3llxflf.exec:\3llxflf.exe187⤵PID:2456
-
\??\c:\hbhbth.exec:\hbhbth.exe188⤵PID:2664
-
\??\c:\jdpvj.exec:\jdpvj.exe189⤵PID:1696
-
\??\c:\lllxlrl.exec:\lllxlrl.exe190⤵PID:2740
-
\??\c:\rllrfrl.exec:\rllrfrl.exe191⤵PID:1344
-
\??\c:\hbnnbt.exec:\hbnnbt.exe192⤵PID:1820
-
\??\c:\5jdvj.exec:\5jdvj.exe193⤵PID:2780
-
\??\c:\ffxrflx.exec:\ffxrflx.exe194⤵PID:1636
-
\??\c:\nnntnn.exec:\nnntnn.exe195⤵PID:868
-
\??\c:\3hnntn.exec:\3hnntn.exe196⤵PID:1764
-
\??\c:\5pdjv.exec:\5pdjv.exe197⤵PID:1432
-
\??\c:\rxrxxfr.exec:\rxrxxfr.exe198⤵PID:1620
-
\??\c:\bbbtht.exec:\bbbtht.exe199⤵PID:2656
-
\??\c:\1bbnth.exec:\1bbnth.exe200⤵PID:1232
-
\??\c:\vdjvv.exec:\vdjvv.exe201⤵PID:1244
-
\??\c:\rfrfxlf.exec:\rfrfxlf.exe202⤵PID:2444
-
\??\c:\ntbbbt.exec:\ntbbbt.exe203⤵PID:1668
-
\??\c:\1dvdd.exec:\1dvdd.exe204⤵PID:2212
-
\??\c:\1xxfxfr.exec:\1xxfxfr.exe205⤵PID:2020
-
\??\c:\lfrflrx.exec:\lfrflrx.exe206⤵PID:2144
-
\??\c:\1nnbnt.exec:\1nnbnt.exe207⤵PID:1464
-
\??\c:\1jjvp.exec:\1jjvp.exe208⤵PID:1596
-
\??\c:\jjvdp.exec:\jjvdp.exe209⤵PID:2796
-
\??\c:\ffrflrl.exec:\ffrflrl.exe210⤵PID:828
-
\??\c:\tbtnbh.exec:\tbtnbh.exe211⤵PID:2008
-
\??\c:\dddpv.exec:\dddpv.exe212⤵PID:804
-
\??\c:\ppdjd.exec:\ppdjd.exe213⤵PID:1524
-
\??\c:\xrfrxll.exec:\xrfrxll.exe214⤵PID:988
-
\??\c:\hhnnbh.exec:\hhnnbh.exe215⤵PID:2988
-
\??\c:\pjddj.exec:\pjddj.exe216⤵PID:1964
-
\??\c:\1pppj.exec:\1pppj.exe217⤵PID:780
-
\??\c:\lfrrflr.exec:\lfrrflr.exe218⤵PID:1908
-
\??\c:\hhbnbt.exec:\hhbnbt.exe219⤵PID:2888
-
\??\c:\pjvpp.exec:\pjvpp.exe220⤵PID:352
-
\??\c:\xrxxllr.exec:\xrxxllr.exe221⤵PID:1968
-
\??\c:\nnbntb.exec:\nnbntb.exe222⤵PID:2012
-
\??\c:\hhhthn.exec:\hhhthn.exe223⤵PID:1648
-
\??\c:\jdvdv.exec:\jdvdv.exe224⤵PID:2108
-
\??\c:\xxxfxxf.exec:\xxxfxxf.exe225⤵PID:1644
-
\??\c:\1htthn.exec:\1htthn.exe226⤵PID:2520
-
\??\c:\jjdpd.exec:\jjdpd.exe227⤵PID:2332
-
\??\c:\pjdjv.exec:\pjdjv.exe228⤵PID:2604
-
\??\c:\1rrxxfr.exec:\1rrxxfr.exe229⤵PID:2540
-
\??\c:\nhtbhn.exec:\nhtbhn.exe230⤵PID:2412
-
\??\c:\vpjjv.exec:\vpjjv.exe231⤵PID:2820
-
\??\c:\5dvvd.exec:\5dvvd.exe232⤵PID:2704
-
\??\c:\7rlrfrx.exec:\7rlrfrx.exe233⤵PID:2672
-
\??\c:\1thnbh.exec:\1thnbh.exe234⤵PID:2468
-
\??\c:\hbnntt.exec:\hbnntt.exe235⤵PID:284
-
\??\c:\jdvdp.exec:\jdvdp.exe236⤵PID:2424
-
\??\c:\lfflrxr.exec:\lfflrxr.exe237⤵PID:1548
-
\??\c:\tntnbb.exec:\tntnbb.exe238⤵PID:2620
-
\??\c:\1vvjv.exec:\1vvjv.exe239⤵PID:2508
-
\??\c:\3vppd.exec:\3vppd.exe240⤵PID:2748
-
\??\c:\xrrxllx.exec:\xrrxllx.exe241⤵PID:2136
-
\??\c:\nhnbnh.exec:\nhnbnh.exe242⤵PID:1836