Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:39
Behavioral task
behavioral1
Sample
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe
-
Size
92KB
-
MD5
93912641f99906fe48a1af744f07ba50
-
SHA1
6dc095b6dec18890629d84b7aa9a15bd791b56c2
-
SHA256
34846e4c4ca3fa3dab34a70346c125b4c37af6d19f1e4e9d9d37dde431c1f2ff
-
SHA512
18067b9f50455377eb4c97c5dd9acb06729d3740308e8be33ef665c644a9361dd765b8195cd01da3afeec2bcc037935727b69226241e9bab275af71287c89b5c
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpWJ:8hOmTsF93UYfwC6GIout0fmCiiiXA6mg
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/4664-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2892-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4280-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4712-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/568-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/604-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2368-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4660-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1456-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-515-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/732-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjjdd.exerlrlflf.exehbhbhb.exe9dddv.exelrfxrlf.exetbbtnt.exehbnhtn.exe9vjdp.exevddpj.exelxxlffx.exebttnbb.exe5dvjd.exejddvp.exeflxrlxx.exehhnhth.exe1vddp.exe5dpdv.exexxlfxrl.exerllfxrx.exetntntn.exedvjjv.exexfrlflf.exetntbtt.exebhbhnn.exepjjdp.exejjjdv.exerxfxlll.exehntnhh.exedppdv.exe5fxxrxl.exelrrlrlf.exebntnhh.exejddvd.exejddvp.exexrfffxl.exexffxxrl.exe9nhbtt.exedvvvj.exe5pdvp.exelxrflxl.exehtnhtt.exentbbbb.exevddpv.exeflrffrl.exe5xxlffr.exebnhbtt.exe5tbtnn.exevppjd.exevpddp.exexrllxxx.exexrrfrrf.exebnhbnn.exetbtthb.exevjdvj.exelxlfrff.exefflfxrl.exetbttnh.exebnnhtt.exevvdpd.exedppjd.exelxffxrr.exelrrrlff.exebtbhbb.exehttttt.exepid process 1872 vjjdd.exe 4856 rlrlflf.exe 1912 hbhbhb.exe 60 9dddv.exe 3404 lrfxrlf.exe 412 tbbtnt.exe 2892 hbnhtn.exe 2040 9vjdp.exe 2772 vddpj.exe 3892 lxxlffx.exe 2364 bttnbb.exe 3972 5dvjd.exe 3144 jddvp.exe 4280 flxrlxx.exe 3244 hhnhth.exe 3740 1vddp.exe 1976 5dpdv.exe 1156 xxlfxrl.exe 4988 rllfxrx.exe 3264 tntntn.exe 1924 dvjjv.exe 116 xfrlflf.exe 2356 tntbtt.exe 4188 bhbhnn.exe 2408 pjjdp.exe 2524 jjjdv.exe 464 rxfxlll.exe 544 hntnhh.exe 4712 dppdv.exe 768 5fxxrxl.exe 3212 lrrlrlf.exe 3744 bntnhh.exe 1256 jddvd.exe 2916 jddvp.exe 568 xrfffxl.exe 3124 xffxxrl.exe 1116 9nhbtt.exe 4912 dvvvj.exe 3928 5pdvp.exe 1784 lxrflxl.exe 1592 htnhtt.exe 3408 ntbbbb.exe 1424 vddpv.exe 3068 flrffrl.exe 2884 5xxlffr.exe 4144 bnhbtt.exe 2132 5tbtnn.exe 1572 vppjd.exe 4224 vpddp.exe 1516 xrllxxx.exe 2284 xrrfrrf.exe 4428 bnhbnn.exe 5008 tbtthb.exe 3800 vjdvj.exe 1648 lxlfrff.exe 912 fflfxrl.exe 2072 tbttnh.exe 2040 bnnhtt.exe 4732 vvdpd.exe 3896 dppjd.exe 2728 lxffxrr.exe 2968 lrrrlff.exe 5096 btbhbb.exe 4276 httttt.exe -
Processes:
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjdd.exe upx behavioral2/memory/4664-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1872-10-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrlflf.exe upx C:\hbhbhb.exe upx behavioral2/memory/4856-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9dddv.exe upx behavioral2/memory/60-21-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrfxrlf.exe upx behavioral2/memory/3404-29-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tbbtnt.exe upx behavioral2/memory/412-30-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhtn.exe upx C:\9vjdp.exe upx behavioral2/memory/2040-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2892-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vddpj.exe upx C:\lxxlffx.exe upx behavioral2/memory/2772-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2040-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bttnbb.exe upx behavioral2/memory/3892-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dvjd.exe upx C:\jddvp.exe upx behavioral2/memory/3972-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3144-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\flxrlxx.exe upx C:\hhnhth.exe upx behavioral2/memory/4280-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1vddp.exe upx behavioral2/memory/3244-78-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dpdv.exe upx behavioral2/memory/3740-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlfxrl.exe upx behavioral2/memory/1976-88-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rllfxrx.exe upx C:\tntntn.exe upx behavioral2/memory/4988-96-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjjv.exe upx behavioral2/memory/3264-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xfrlflf.exe upx C:\tntbtt.exe upx C:\bhbhnn.exe upx \??\c:\pjjdp.exe upx behavioral2/memory/2408-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjdv.exe upx \??\c:\rxfxlll.exe upx behavioral2/memory/2524-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hntnhh.exe upx behavioral2/memory/464-132-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dppdv.exe upx behavioral2/memory/4712-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5fxxrxl.exe upx behavioral2/memory/768-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrlrlf.exe upx C:\bntnhh.exe upx behavioral2/memory/568-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1116-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3928-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1592-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1424-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4144-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2132-191-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exevjjdd.exerlrlflf.exehbhbhb.exe9dddv.exelrfxrlf.exetbbtnt.exehbnhtn.exe9vjdp.exevddpj.exelxxlffx.exebttnbb.exe5dvjd.exejddvp.exeflxrlxx.exehhnhth.exe1vddp.exe5dpdv.exexxlfxrl.exerllfxrx.exetntntn.exedvjjv.exedescription pid process target process PID 4664 wrote to memory of 1872 4664 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe vjjdd.exe PID 4664 wrote to memory of 1872 4664 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe vjjdd.exe PID 4664 wrote to memory of 1872 4664 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe vjjdd.exe PID 1872 wrote to memory of 4856 1872 vjjdd.exe rlrlflf.exe PID 1872 wrote to memory of 4856 1872 vjjdd.exe rlrlflf.exe PID 1872 wrote to memory of 4856 1872 vjjdd.exe rlrlflf.exe PID 4856 wrote to memory of 1912 4856 rlrlflf.exe hbhbhb.exe PID 4856 wrote to memory of 1912 4856 rlrlflf.exe hbhbhb.exe PID 4856 wrote to memory of 1912 4856 rlrlflf.exe hbhbhb.exe PID 1912 wrote to memory of 60 1912 hbhbhb.exe 9dddv.exe PID 1912 wrote to memory of 60 1912 hbhbhb.exe 9dddv.exe PID 1912 wrote to memory of 60 1912 hbhbhb.exe 9dddv.exe PID 60 wrote to memory of 3404 60 9dddv.exe lrfxrlf.exe PID 60 wrote to memory of 3404 60 9dddv.exe lrfxrlf.exe PID 60 wrote to memory of 3404 60 9dddv.exe lrfxrlf.exe PID 3404 wrote to memory of 412 3404 lrfxrlf.exe tbbtnt.exe PID 3404 wrote to memory of 412 3404 lrfxrlf.exe tbbtnt.exe PID 3404 wrote to memory of 412 3404 lrfxrlf.exe tbbtnt.exe PID 412 wrote to memory of 2892 412 tbbtnt.exe hbnhtn.exe PID 412 wrote to memory of 2892 412 tbbtnt.exe hbnhtn.exe PID 412 wrote to memory of 2892 412 tbbtnt.exe hbnhtn.exe PID 2892 wrote to memory of 2040 2892 hbnhtn.exe 9vjdp.exe PID 2892 wrote to memory of 2040 2892 hbnhtn.exe 9vjdp.exe PID 2892 wrote to memory of 2040 2892 hbnhtn.exe 9vjdp.exe PID 2040 wrote to memory of 2772 2040 9vjdp.exe vddpj.exe PID 2040 wrote to memory of 2772 2040 9vjdp.exe vddpj.exe PID 2040 wrote to memory of 2772 2040 9vjdp.exe vddpj.exe PID 2772 wrote to memory of 3892 2772 vddpj.exe lxxlffx.exe PID 2772 wrote to memory of 3892 2772 vddpj.exe lxxlffx.exe PID 2772 wrote to memory of 3892 2772 vddpj.exe lxxlffx.exe PID 3892 wrote to memory of 2364 3892 lxxlffx.exe bttnbb.exe PID 3892 wrote to memory of 2364 3892 lxxlffx.exe bttnbb.exe PID 3892 wrote to memory of 2364 3892 lxxlffx.exe bttnbb.exe PID 2364 wrote to memory of 3972 2364 bttnbb.exe 5dvjd.exe PID 2364 wrote to memory of 3972 2364 bttnbb.exe 5dvjd.exe PID 2364 wrote to memory of 3972 2364 bttnbb.exe 5dvjd.exe PID 3972 wrote to memory of 3144 3972 5dvjd.exe jddvp.exe PID 3972 wrote to memory of 3144 3972 5dvjd.exe jddvp.exe PID 3972 wrote to memory of 3144 3972 5dvjd.exe jddvp.exe PID 3144 wrote to memory of 4280 3144 jddvp.exe flxrlxx.exe PID 3144 wrote to memory of 4280 3144 jddvp.exe flxrlxx.exe PID 3144 wrote to memory of 4280 3144 jddvp.exe flxrlxx.exe PID 4280 wrote to memory of 3244 4280 flxrlxx.exe hhnhth.exe PID 4280 wrote to memory of 3244 4280 flxrlxx.exe hhnhth.exe PID 4280 wrote to memory of 3244 4280 flxrlxx.exe hhnhth.exe PID 3244 wrote to memory of 3740 3244 hhnhth.exe 1vddp.exe PID 3244 wrote to memory of 3740 3244 hhnhth.exe 1vddp.exe PID 3244 wrote to memory of 3740 3244 hhnhth.exe 1vddp.exe PID 3740 wrote to memory of 1976 3740 1vddp.exe 5dpdv.exe PID 3740 wrote to memory of 1976 3740 1vddp.exe 5dpdv.exe PID 3740 wrote to memory of 1976 3740 1vddp.exe 5dpdv.exe PID 1976 wrote to memory of 1156 1976 5dpdv.exe xxlfxrl.exe PID 1976 wrote to memory of 1156 1976 5dpdv.exe xxlfxrl.exe PID 1976 wrote to memory of 1156 1976 5dpdv.exe xxlfxrl.exe PID 1156 wrote to memory of 4988 1156 xxlfxrl.exe rllfxrx.exe PID 1156 wrote to memory of 4988 1156 xxlfxrl.exe rllfxrx.exe PID 1156 wrote to memory of 4988 1156 xxlfxrl.exe rllfxrx.exe PID 4988 wrote to memory of 3264 4988 rllfxrx.exe tntntn.exe PID 4988 wrote to memory of 3264 4988 rllfxrx.exe tntntn.exe PID 4988 wrote to memory of 3264 4988 rllfxrx.exe tntntn.exe PID 3264 wrote to memory of 1924 3264 tntntn.exe dvjjv.exe PID 3264 wrote to memory of 1924 3264 tntntn.exe dvjjv.exe PID 3264 wrote to memory of 1924 3264 tntntn.exe dvjjv.exe PID 1924 wrote to memory of 116 1924 dvjjv.exe xfrlflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\vjjdd.exec:\vjjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rlrlflf.exec:\rlrlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\hbhbhb.exec:\hbhbhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\9dddv.exec:\9dddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\lrfxrlf.exec:\lrfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\tbbtnt.exec:\tbbtnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\hbnhtn.exec:\hbnhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9vjdp.exec:\9vjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vddpj.exec:\vddpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lxxlffx.exec:\lxxlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\bttnbb.exec:\bttnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5dvjd.exec:\5dvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\jddvp.exec:\jddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\flxrlxx.exec:\flxrlxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\hhnhth.exec:\hhnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\1vddp.exec:\1vddp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\5dpdv.exec:\5dpdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\rllfxrx.exec:\rllfxrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\tntntn.exec:\tntntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\dvjjv.exec:\dvjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\xfrlflf.exec:\xfrlflf.exe23⤵
- Executes dropped EXE
PID:116 -
\??\c:\tntbtt.exec:\tntbtt.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bhbhnn.exec:\bhbhnn.exe25⤵
- Executes dropped EXE
PID:4188 -
\??\c:\pjjdp.exec:\pjjdp.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\jjjdv.exec:\jjjdv.exe27⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rxfxlll.exec:\rxfxlll.exe28⤵
- Executes dropped EXE
PID:464 -
\??\c:\hntnhh.exec:\hntnhh.exe29⤵
- Executes dropped EXE
PID:544 -
\??\c:\dppdv.exec:\dppdv.exe30⤵
- Executes dropped EXE
PID:4712 -
\??\c:\5fxxrxl.exec:\5fxxrxl.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\lrrlrlf.exec:\lrrlrlf.exe32⤵
- Executes dropped EXE
PID:3212 -
\??\c:\bntnhh.exec:\bntnhh.exe33⤵
- Executes dropped EXE
PID:3744 -
\??\c:\jddvd.exec:\jddvd.exe34⤵
- Executes dropped EXE
PID:1256 -
\??\c:\jddvp.exec:\jddvp.exe35⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrfffxl.exec:\xrfffxl.exe36⤵
- Executes dropped EXE
PID:568 -
\??\c:\xffxxrl.exec:\xffxxrl.exe37⤵
- Executes dropped EXE
PID:3124 -
\??\c:\9nhbtt.exec:\9nhbtt.exe38⤵
- Executes dropped EXE
PID:1116 -
\??\c:\dvvvj.exec:\dvvvj.exe39⤵
- Executes dropped EXE
PID:4912 -
\??\c:\5pdvp.exec:\5pdvp.exe40⤵
- Executes dropped EXE
PID:3928 -
\??\c:\lxrflxl.exec:\lxrflxl.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\htnhtt.exec:\htnhtt.exe42⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ntbbbb.exec:\ntbbbb.exe43⤵
- Executes dropped EXE
PID:3408 -
\??\c:\vddpv.exec:\vddpv.exe44⤵
- Executes dropped EXE
PID:1424 -
\??\c:\flrffrl.exec:\flrffrl.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\5xxlffr.exec:\5xxlffr.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bnhbtt.exec:\bnhbtt.exe47⤵
- Executes dropped EXE
PID:4144 -
\??\c:\5tbtnn.exec:\5tbtnn.exe48⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:1572 -
\??\c:\vpddp.exec:\vpddp.exe50⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xrllxxx.exec:\xrllxxx.exe51⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe52⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bnhbnn.exec:\bnhbnn.exe53⤵
- Executes dropped EXE
PID:4428 -
\??\c:\tbtthb.exec:\tbtthb.exe54⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vjdvj.exec:\vjdvj.exe55⤵
- Executes dropped EXE
PID:3800 -
\??\c:\lxlfrff.exec:\lxlfrff.exe56⤵
- Executes dropped EXE
PID:1648 -
\??\c:\fflfxrl.exec:\fflfxrl.exe57⤵
- Executes dropped EXE
PID:912 -
\??\c:\tbttnh.exec:\tbttnh.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bnnhtt.exec:\bnnhtt.exe59⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vvdpd.exec:\vvdpd.exe60⤵
- Executes dropped EXE
PID:4732 -
\??\c:\dppjd.exec:\dppjd.exe61⤵
- Executes dropped EXE
PID:3896 -
\??\c:\lxffxrr.exec:\lxffxrr.exe62⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lrrrlff.exec:\lrrrlff.exe63⤵
- Executes dropped EXE
PID:2968 -
\??\c:\btbhbb.exec:\btbhbb.exe64⤵
- Executes dropped EXE
PID:5096 -
\??\c:\httttt.exec:\httttt.exe65⤵
- Executes dropped EXE
PID:4276 -
\??\c:\pdpjj.exec:\pdpjj.exe66⤵PID:3132
-
\??\c:\vvvpj.exec:\vvvpj.exe67⤵PID:4152
-
\??\c:\rllfrll.exec:\rllfrll.exe68⤵PID:5080
-
\??\c:\bnthbb.exec:\bnthbb.exe69⤵PID:4532
-
\??\c:\7vdvv.exec:\7vdvv.exe70⤵PID:4468
-
\??\c:\xxfrffx.exec:\xxfrffx.exe71⤵PID:1156
-
\??\c:\llrrllf.exec:\llrrllf.exe72⤵PID:4432
-
\??\c:\tbhbtn.exec:\tbhbtn.exe73⤵PID:4264
-
\??\c:\vjppd.exec:\vjppd.exe74⤵PID:884
-
\??\c:\xxflxfx.exec:\xxflxfx.exe75⤵PID:228
-
\??\c:\hnhbtt.exec:\hnhbtt.exe76⤵PID:116
-
\??\c:\btbtnn.exec:\btbtnn.exe77⤵PID:1864
-
\??\c:\ddvpd.exec:\ddvpd.exe78⤵PID:4952
-
\??\c:\1lllffx.exec:\1lllffx.exe79⤵PID:3876
-
\??\c:\xrffxfx.exec:\xrffxfx.exe80⤵PID:1124
-
\??\c:\hnnbtt.exec:\hnnbtt.exe81⤵PID:704
-
\??\c:\9hthhh.exec:\9hthhh.exe82⤵PID:3252
-
\??\c:\3dddp.exec:\3dddp.exe83⤵PID:488
-
\??\c:\1xrllff.exec:\1xrllff.exe84⤵PID:2168
-
\??\c:\nttntt.exec:\nttntt.exe85⤵PID:604
-
\??\c:\dpppd.exec:\dpppd.exe86⤵PID:4880
-
\??\c:\vdvpd.exec:\vdvpd.exe87⤵PID:4000
-
\??\c:\lflfxxl.exec:\lflfxxl.exe88⤵PID:732
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe89⤵PID:4728
-
\??\c:\hbhbtt.exec:\hbhbtt.exe90⤵PID:3848
-
\??\c:\nbhnhh.exec:\nbhnhh.exe91⤵PID:1184
-
\??\c:\3pppd.exec:\3pppd.exe92⤵PID:5048
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe93⤵PID:4476
-
\??\c:\lfffxxx.exec:\lfffxxx.exe94⤵PID:2844
-
\??\c:\thnnnn.exec:\thnnnn.exe95⤵PID:3920
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:1788
-
\??\c:\vdjdv.exec:\vdjdv.exe97⤵PID:3988
-
\??\c:\djjdv.exec:\djjdv.exe98⤵PID:1576
-
\??\c:\3xrflfr.exec:\3xrflfr.exe99⤵PID:3408
-
\??\c:\rrfxxll.exec:\rrfxxll.exe100⤵PID:1412
-
\??\c:\nnttnh.exec:\nnttnh.exe101⤵PID:4308
-
\??\c:\hnbthh.exec:\hnbthh.exe102⤵PID:4452
-
\??\c:\vdjvj.exec:\vdjvj.exe103⤵PID:4820
-
\??\c:\pvdvj.exec:\pvdvj.exe104⤵PID:4640
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe105⤵PID:4440
-
\??\c:\bhnbht.exec:\bhnbht.exe106⤵PID:2368
-
\??\c:\9htntt.exec:\9htntt.exe107⤵PID:2284
-
\??\c:\ddppp.exec:\ddppp.exe108⤵PID:1372
-
\??\c:\pjpjv.exec:\pjpjv.exe109⤵PID:3448
-
\??\c:\fflfxxx.exec:\fflfxxx.exe110⤵PID:912
-
\??\c:\lfllffx.exec:\lfllffx.exe111⤵PID:2072
-
\??\c:\hbnhnn.exec:\hbnhnn.exe112⤵PID:4784
-
\??\c:\btbhhh.exec:\btbhhh.exe113⤵PID:2360
-
\??\c:\1hnthb.exec:\1hnthb.exe114⤵PID:1560
-
\??\c:\jvvpd.exec:\jvvpd.exe115⤵PID:5096
-
\??\c:\pdvjd.exec:\pdvjd.exe116⤵PID:3144
-
\??\c:\lxxrrxr.exec:\lxxrrxr.exe117⤵PID:4152
-
\??\c:\9xrrlrl.exec:\9xrrlrl.exe118⤵PID:4660
-
\??\c:\nhhbhb.exec:\nhhbhb.exe119⤵PID:4524
-
\??\c:\bnnhbb.exec:\bnnhbb.exe120⤵PID:4532
-
\??\c:\pjjdj.exec:\pjjdj.exe121⤵PID:3344
-
\??\c:\7ppjd.exec:\7ppjd.exe122⤵PID:2184
-
\??\c:\fxrlffx.exec:\fxrlffx.exe123⤵PID:460
-
\??\c:\tnnhhh.exec:\tnnhhh.exe124⤵PID:1316
-
\??\c:\bhnhbb.exec:\bhnhbb.exe125⤵PID:884
-
\??\c:\ffxfflf.exec:\ffxfflf.exe126⤵PID:3164
-
\??\c:\tbhbnn.exec:\tbhbnn.exe127⤵PID:2876
-
\??\c:\jdpjp.exec:\jdpjp.exe128⤵PID:3260
-
\??\c:\xfrlxxx.exec:\xfrlxxx.exe129⤵PID:4952
-
\??\c:\htbbtt.exec:\htbbtt.exe130⤵PID:3876
-
\??\c:\btttbb.exec:\btttbb.exe131⤵PID:1124
-
\??\c:\vvjdp.exec:\vvjdp.exe132⤵PID:3656
-
\??\c:\hntnhb.exec:\hntnhb.exe133⤵PID:752
-
\??\c:\dpdjp.exec:\dpdjp.exe134⤵PID:488
-
\??\c:\htbbtt.exec:\htbbtt.exe135⤵PID:768
-
\??\c:\nntnnn.exec:\nntnnn.exe136⤵PID:4808
-
\??\c:\llrlllf.exec:\llrlllf.exe137⤵PID:3212
-
\??\c:\dpjpj.exec:\dpjpj.exe138⤵PID:5116
-
\??\c:\vjjdv.exec:\vjjdv.exe139⤵PID:3664
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe140⤵PID:1228
-
\??\c:\xxrlxrr.exec:\xxrlxrr.exe141⤵PID:1336
-
\??\c:\bhnnhn.exec:\bhnnhn.exe142⤵PID:4268
-
\??\c:\pddvv.exec:\pddvv.exe143⤵PID:1116
-
\??\c:\vpjvv.exec:\vpjvv.exe144⤵PID:4476
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe145⤵PID:2492
-
\??\c:\xrfffff.exec:\xrfffff.exe146⤵PID:1456
-
\??\c:\btttnn.exec:\btttnn.exe147⤵PID:384
-
\??\c:\jvddp.exec:\jvddp.exe148⤵PID:4652
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe149⤵PID:3692
-
\??\c:\bntnhh.exec:\bntnhh.exe150⤵PID:4560
-
\??\c:\5jpdd.exec:\5jpdd.exe151⤵PID:548
-
\??\c:\rxxllff.exec:\rxxllff.exe152⤵PID:5112
-
\??\c:\llflflf.exec:\llflflf.exe153⤵PID:5056
-
\??\c:\hnbhnn.exec:\hnbhnn.exe154⤵PID:4224
-
\??\c:\ddvjv.exec:\ddvjv.exe155⤵PID:4048
-
\??\c:\7vpjj.exec:\7vpjj.exe156⤵PID:3008
-
\??\c:\xxfxffx.exec:\xxfxffx.exe157⤵PID:1308
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe158⤵PID:2536
-
\??\c:\tbnhbb.exec:\tbnhbb.exe159⤵PID:2268
-
\??\c:\nnnhbb.exec:\nnnhbb.exe160⤵PID:3604
-
\??\c:\jjpvp.exec:\jjpvp.exe161⤵PID:2616
-
\??\c:\pddjv.exec:\pddjv.exe162⤵PID:4884
-
\??\c:\xffxfll.exec:\xffxfll.exe163⤵PID:1344
-
\??\c:\rxllxxr.exec:\rxllxxr.exe164⤵PID:3972
-
\??\c:\tnhhtn.exec:\tnhhtn.exe165⤵PID:3132
-
\??\c:\hbhntt.exec:\hbhntt.exe166⤵PID:3804
-
\??\c:\jppjp.exec:\jppjp.exe167⤵PID:2008
-
\??\c:\lfxxxxr.exec:\lfxxxxr.exe168⤵PID:4660
-
\??\c:\hbnnnn.exec:\hbnnnn.exe169⤵PID:4524
-
\??\c:\5ntnhh.exec:\5ntnhh.exe170⤵PID:3184
-
\??\c:\5djpj.exec:\5djpj.exe171⤵PID:4432
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe172⤵PID:4908
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe173⤵PID:4600
-
\??\c:\hbbhhn.exec:\hbbhhn.exe174⤵PID:4992
-
\??\c:\bttnbb.exec:\bttnbb.exe175⤵PID:2356
-
\??\c:\3jvpd.exec:\3jvpd.exe176⤵PID:3856
-
\??\c:\jjjpp.exec:\jjjpp.exe177⤵PID:2408
-
\??\c:\ffxrlfr.exec:\ffxrlfr.exe178⤵PID:704
-
\??\c:\xxrrxlx.exec:\xxrrxlx.exe179⤵PID:3236
-
\??\c:\tttntn.exec:\tttntn.exe180⤵PID:2288
-
\??\c:\nnhhbb.exec:\nnhhbb.exe181⤵PID:752
-
\??\c:\9hhbtt.exec:\9hhbtt.exe182⤵PID:488
-
\??\c:\jdpdd.exec:\jdpdd.exe183⤵PID:768
-
\??\c:\vvppv.exec:\vvppv.exe184⤵PID:3420
-
\??\c:\fxlllff.exec:\fxlllff.exe185⤵PID:2812
-
\??\c:\lrrllxx.exec:\lrrllxx.exe186⤵PID:1836
-
\??\c:\hnbbbb.exec:\hnbbbb.exe187⤵PID:4940
-
\??\c:\hhbbbb.exec:\hhbbbb.exe188⤵PID:1184
-
\??\c:\5vddd.exec:\5vddd.exe189⤵PID:8
-
\??\c:\vvdjp.exec:\vvdjp.exe190⤵PID:4720
-
\??\c:\jppdv.exec:\jppdv.exe191⤵PID:2844
-
\??\c:\xrfffrr.exec:\xrfffrr.exe192⤵PID:3920
-
\??\c:\bnbbtb.exec:\bnbbtb.exe193⤵PID:1788
-
\??\c:\5hbbnt.exec:\5hbbnt.exe194⤵PID:3988
-
\??\c:\hthbbh.exec:\hthbbh.exe195⤵PID:3408
-
\??\c:\pjvdj.exec:\pjvdj.exe196⤵PID:4460
-
\??\c:\flrrrrl.exec:\flrrrrl.exe197⤵PID:2300
-
\??\c:\7lxfrrl.exec:\7lxfrrl.exe198⤵PID:4560
-
\??\c:\nnhthb.exec:\nnhthb.exe199⤵PID:2188
-
\??\c:\bttttb.exec:\bttttb.exe200⤵PID:4456
-
\??\c:\5dppp.exec:\5dppp.exe201⤵PID:4440
-
\??\c:\rflxfxf.exec:\rflxfxf.exe202⤵PID:1912
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe203⤵PID:4428
-
\??\c:\7hhtth.exec:\7hhtth.exe204⤵PID:1704
-
\??\c:\bnnttb.exec:\bnnttb.exe205⤵PID:992
-
\??\c:\jdjpp.exec:\jdjpp.exe206⤵PID:3676
-
\??\c:\lxlllrr.exec:\lxlllrr.exe207⤵PID:2072
-
\??\c:\llflrrx.exec:\llflrrx.exe208⤵PID:3648
-
\??\c:\tnhbnt.exec:\tnhbnt.exe209⤵PID:1052
-
\??\c:\hbthnn.exec:\hbthnn.exe210⤵PID:1236
-
\??\c:\ppvvv.exec:\ppvvv.exe211⤵PID:3144
-
\??\c:\vjvjd.exec:\vjvjd.exe212⤵PID:3132
-
\??\c:\xxllfll.exec:\xxllfll.exe213⤵PID:3804
-
\??\c:\xxxfffl.exec:\xxxfffl.exe214⤵PID:1700
-
\??\c:\bbhhbh.exec:\bbhhbh.exe215⤵PID:4524
-
\??\c:\btttnt.exec:\btttnt.exe216⤵PID:2184
-
\??\c:\pvdjp.exec:\pvdjp.exe217⤵PID:208
-
\??\c:\jdvjv.exec:\jdvjv.exe218⤵PID:116
-
\??\c:\fffxrrr.exec:\fffxrrr.exe219⤵PID:1864
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe220⤵PID:1352
-
\??\c:\nnhtbn.exec:\nnhtbn.exe221⤵PID:4624
-
\??\c:\hnttnt.exec:\hnttnt.exe222⤵PID:3876
-
\??\c:\vjdjd.exec:\vjdjd.exe223⤵PID:4088
-
\??\c:\jjvdd.exec:\jjvdd.exe224⤵PID:2664
-
\??\c:\frfllrr.exec:\frfllrr.exe225⤵PID:3236
-
\??\c:\fflxrxx.exec:\fflxrxx.exe226⤵PID:5064
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe227⤵PID:752
-
\??\c:\ttntbh.exec:\ttntbh.exe228⤵PID:488
-
\??\c:\ttnnnt.exec:\ttnnnt.exe229⤵PID:732
-
\??\c:\dpdjd.exec:\dpdjd.exe230⤵PID:364
-
\??\c:\ddpvp.exec:\ddpvp.exe231⤵PID:3992
-
\??\c:\xllrrlr.exec:\xllrrlr.exe232⤵PID:2916
-
\??\c:\hhnttb.exec:\hhnttb.exe233⤵PID:1336
-
\??\c:\hthnnb.exec:\hthnnb.exe234⤵PID:3948
-
\??\c:\dpdjv.exec:\dpdjv.exe235⤵PID:8
-
\??\c:\dpdvv.exec:\dpdvv.exe236⤵PID:4476
-
\??\c:\dvppj.exec:\dvppj.exe237⤵PID:2492
-
\??\c:\rxrxxxf.exec:\rxrxxxf.exe238⤵PID:4472
-
\??\c:\frrrxlr.exec:\frrrxlr.exe239⤵PID:1576
-
\??\c:\hhhnnt.exec:\hhhnnt.exe240⤵PID:4684
-
\??\c:\btbbtb.exec:\btbbtb.exe241⤵PID:1092
-
\??\c:\ppppj.exec:\ppppj.exe242⤵PID:4460