Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:22
Behavioral task
behavioral1
Sample
bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe
-
Size
279KB
-
MD5
bbf1826f77fc1200a1501e9ed5a3c1c0
-
SHA1
27e0c711cdda423a3bafb5e88a5680fe7d9b0439
-
SHA256
b0b4d7411ba834090df0b34a3b31e7a120732b50f7ea06be30305b5ec56b57e6
-
SHA512
279431f887ff46d846607d174996a2a5acb5ab5fb00c2bd8ed17d560b006de54ee68bb2018fab61e6e124d02bb0c1587c30677969c8f0baee849a5f172ad373d
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpV:B4wFHoSoXW434wFHoS3eg4aeFaKHpV
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
Processes:
resource yara_rule behavioral2/memory/3888-5-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4028-13-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4020-14-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4020-20-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1052-27-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3220-35-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4816-41-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4408-40-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4408-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4688-49-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4688-54-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2844-61-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3332-70-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/868-76-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3832-84-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1516-90-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3044-97-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/980-103-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4136-111-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4592-118-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3040-127-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4356-131-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3528-134-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3528-140-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4224-149-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1844-154-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3380-156-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3380-160-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3048-165-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2596-171-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3484-179-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4856-181-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4856-186-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/820-195-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2848-193-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2848-199-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3256-202-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3256-207-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1888-214-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/232-221-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4360-227-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3888-228-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3888-232-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1244-237-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4020-242-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2104-247-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2432-252-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/880-256-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/824-261-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1520-266-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4036-268-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4036-271-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3060-276-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2844-281-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4108-286-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/1656-291-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/3508-296-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4708-302-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/2592-306-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4052-1784-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/752-1881-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/492-2298-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral2/memory/4908-3886-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tbhhbn.exevppjj.exejdvpv.exerxrlfxr.exebbbhhn.exedjpjv.exetnhnnt.exepvdpj.exetbnbnn.exevdjpp.exerxxrfrf.exebhhnhn.exebbhhbh.exevpvjd.exelxfrffl.exedpdvd.exejddpv.exe3bnhhh.exe5pjpj.exelrxffff.exevvjvp.exehbnnhh.exe7pdpj.exellrfxrl.exedjdpd.exepvvpp.exevpdpd.exe9djdp.exe3hhbnn.exejjpjv.exe7xrfxxl.exevpjvj.exeflfxlrl.exe1tttnn.exehtthbb.exevpjdp.exe5xlffxx.exehbbnhb.exevpdvp.exejddvj.exefrrlfxr.exehnnnbt.exe7pvpv.exefrxllfx.exerlrxrxl.exenhhttn.exevddvv.exerffxrfx.exeppvpd.exerxxlfrl.exebtbhht.exetnttbb.exedjppj.exe1xrlffr.exebthnhn.exentbtbb.exedvvpj.exerllxrlf.exetbtnbt.exentbnhh.exejdpdv.exeflrlxrf.exe9xxlxff.exebnbnhn.exepid process 4028 tbhhbn.exe 4020 vppjj.exe 1052 jdvpv.exe 3220 rxrlfxr.exe 4816 bbbhhn.exe 4408 djpjv.exe 4688 tnhnnt.exe 2844 pvdpj.exe 3332 tbnbnn.exe 868 vdjpp.exe 3832 rxxrfrf.exe 1516 bhhnhn.exe 3044 bbhhbh.exe 980 vpvjd.exe 4136 lxfrffl.exe 4592 dpdvd.exe 3040 jddpv.exe 4356 3bnhhh.exe 3528 5pjpj.exe 4224 lrxffff.exe 1844 vvjvp.exe 3380 hbnnhh.exe 3048 7pdpj.exe 2596 llrfxrl.exe 3484 djdpd.exe 4856 pvvpp.exe 820 vpdpd.exe 2848 9djdp.exe 3256 3hhbnn.exe 1888 jjpjv.exe 232 7xrfxxl.exe 4360 vpjvj.exe 3888 flfxlrl.exe 1244 1tttnn.exe 4020 htthbb.exe 2104 vpjdp.exe 2432 5xlffxx.exe 880 hbbnhb.exe 824 vpdvp.exe 1520 jddvj.exe 4036 frrlfxr.exe 3060 hnnnbt.exe 2844 7pvpv.exe 4108 frxllfx.exe 1656 rlrxrxl.exe 3508 nhhttn.exe 4708 vddvv.exe 2592 rffxrfx.exe 1636 ppvpd.exe 752 rxxlfrl.exe 4592 btbhht.exe 1988 tnttbb.exe 3716 djppj.exe 3900 1xrlffr.exe 2308 bthnhn.exe 4500 ntbtbb.exe 400 dvvpj.exe 1844 rllxrlf.exe 4168 tbtnbt.exe 4612 ntbnhh.exe 564 jdpdv.exe 4116 flrlxrf.exe 4204 9xxlxff.exe 4856 bnbnhn.exe -
Processes:
resource yara_rule behavioral2/memory/3888-1-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3888-5-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\tbhhbn.exe upx behavioral2/memory/4028-8-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\vppjj.exe upx behavioral2/memory/4028-13-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4020-14-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\jdvpv.exe upx behavioral2/memory/4020-20-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1052-22-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\rxrlfxr.exe upx behavioral2/memory/1052-27-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3220-29-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\bbbhhn.exe upx behavioral2/memory/4816-33-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3220-35-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\djpjv.exe upx behavioral2/memory/4816-41-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4408-40-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\tnhnnt.exe upx behavioral2/memory/4408-48-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4688-49-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\pvdpj.exe upx behavioral2/memory/2844-56-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4688-54-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\tbnbnn.exe upx behavioral2/memory/2844-61-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3332-63-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\vdjpp.exe upx behavioral2/memory/3332-70-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/868-67-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\rxxrfrf.exe upx behavioral2/memory/868-76-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3832-78-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\bhhnhn.exe upx behavioral2/memory/1516-82-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3832-84-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\bbhhbh.exe upx behavioral2/memory/1516-90-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3044-91-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\vpvjd.exe upx behavioral2/memory/980-98-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3044-97-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\lxfrffl.exe upx behavioral2/memory/980-103-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4136-106-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\dpdvd.exe upx behavioral2/memory/4136-111-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\jddpv.exe upx behavioral2/memory/4592-118-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3040-119-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4592-113-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\3bnhhh.exe upx behavioral2/memory/3040-127-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\5pjpj.exe upx behavioral2/memory/4356-131-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/3528-134-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4356-123-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\lrxffff.exe upx behavioral2/memory/3528-140-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/4224-138-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\vvjvp.exe upx behavioral2/memory/4224-149-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral2/memory/1844-154-0x0000000000400000-0x000000000044D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exetbhhbn.exevppjj.exejdvpv.exerxrlfxr.exebbbhhn.exedjpjv.exetnhnnt.exepvdpj.exetbnbnn.exevdjpp.exerxxrfrf.exebhhnhn.exebbhhbh.exevpvjd.exelxfrffl.exedpdvd.exejddpv.exe3bnhhh.exe5pjpj.exelrxffff.exevvjvp.exedescription pid process target process PID 3888 wrote to memory of 4028 3888 bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe tbhhbn.exe PID 3888 wrote to memory of 4028 3888 bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe tbhhbn.exe PID 3888 wrote to memory of 4028 3888 bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe tbhhbn.exe PID 4028 wrote to memory of 4020 4028 tbhhbn.exe vppjj.exe PID 4028 wrote to memory of 4020 4028 tbhhbn.exe vppjj.exe PID 4028 wrote to memory of 4020 4028 tbhhbn.exe vppjj.exe PID 4020 wrote to memory of 1052 4020 vppjj.exe jdvpv.exe PID 4020 wrote to memory of 1052 4020 vppjj.exe jdvpv.exe PID 4020 wrote to memory of 1052 4020 vppjj.exe jdvpv.exe PID 1052 wrote to memory of 3220 1052 jdvpv.exe rxrlfxr.exe PID 1052 wrote to memory of 3220 1052 jdvpv.exe rxrlfxr.exe PID 1052 wrote to memory of 3220 1052 jdvpv.exe rxrlfxr.exe PID 3220 wrote to memory of 4816 3220 rxrlfxr.exe bbbhhn.exe PID 3220 wrote to memory of 4816 3220 rxrlfxr.exe bbbhhn.exe PID 3220 wrote to memory of 4816 3220 rxrlfxr.exe bbbhhn.exe PID 4816 wrote to memory of 4408 4816 bbbhhn.exe djpjv.exe PID 4816 wrote to memory of 4408 4816 bbbhhn.exe djpjv.exe PID 4816 wrote to memory of 4408 4816 bbbhhn.exe djpjv.exe PID 4408 wrote to memory of 4688 4408 djpjv.exe tnhnnt.exe PID 4408 wrote to memory of 4688 4408 djpjv.exe tnhnnt.exe PID 4408 wrote to memory of 4688 4408 djpjv.exe tnhnnt.exe PID 4688 wrote to memory of 2844 4688 tnhnnt.exe pvdpj.exe PID 4688 wrote to memory of 2844 4688 tnhnnt.exe pvdpj.exe PID 4688 wrote to memory of 2844 4688 tnhnnt.exe pvdpj.exe PID 2844 wrote to memory of 3332 2844 pvdpj.exe tbnbnn.exe PID 2844 wrote to memory of 3332 2844 pvdpj.exe tbnbnn.exe PID 2844 wrote to memory of 3332 2844 pvdpj.exe tbnbnn.exe PID 3332 wrote to memory of 868 3332 tbnbnn.exe vdjpp.exe PID 3332 wrote to memory of 868 3332 tbnbnn.exe vdjpp.exe PID 3332 wrote to memory of 868 3332 tbnbnn.exe vdjpp.exe PID 868 wrote to memory of 3832 868 vdjpp.exe rxxrfrf.exe PID 868 wrote to memory of 3832 868 vdjpp.exe rxxrfrf.exe PID 868 wrote to memory of 3832 868 vdjpp.exe rxxrfrf.exe PID 3832 wrote to memory of 1516 3832 rxxrfrf.exe bhhnhn.exe PID 3832 wrote to memory of 1516 3832 rxxrfrf.exe bhhnhn.exe PID 3832 wrote to memory of 1516 3832 rxxrfrf.exe bhhnhn.exe PID 1516 wrote to memory of 3044 1516 bhhnhn.exe bbhhbh.exe PID 1516 wrote to memory of 3044 1516 bhhnhn.exe bbhhbh.exe PID 1516 wrote to memory of 3044 1516 bhhnhn.exe bbhhbh.exe PID 3044 wrote to memory of 980 3044 bbhhbh.exe vpvjd.exe PID 3044 wrote to memory of 980 3044 bbhhbh.exe vpvjd.exe PID 3044 wrote to memory of 980 3044 bbhhbh.exe vpvjd.exe PID 980 wrote to memory of 4136 980 vpvjd.exe lxfrffl.exe PID 980 wrote to memory of 4136 980 vpvjd.exe lxfrffl.exe PID 980 wrote to memory of 4136 980 vpvjd.exe lxfrffl.exe PID 4136 wrote to memory of 4592 4136 lxfrffl.exe dpdvd.exe PID 4136 wrote to memory of 4592 4136 lxfrffl.exe dpdvd.exe PID 4136 wrote to memory of 4592 4136 lxfrffl.exe dpdvd.exe PID 4592 wrote to memory of 3040 4592 dpdvd.exe jddpv.exe PID 4592 wrote to memory of 3040 4592 dpdvd.exe jddpv.exe PID 4592 wrote to memory of 3040 4592 dpdvd.exe jddpv.exe PID 3040 wrote to memory of 4356 3040 jddpv.exe 3bnhhh.exe PID 3040 wrote to memory of 4356 3040 jddpv.exe 3bnhhh.exe PID 3040 wrote to memory of 4356 3040 jddpv.exe 3bnhhh.exe PID 4356 wrote to memory of 3528 4356 3bnhhh.exe 5pjpj.exe PID 4356 wrote to memory of 3528 4356 3bnhhh.exe 5pjpj.exe PID 4356 wrote to memory of 3528 4356 3bnhhh.exe 5pjpj.exe PID 3528 wrote to memory of 4224 3528 5pjpj.exe lrxffff.exe PID 3528 wrote to memory of 4224 3528 5pjpj.exe lrxffff.exe PID 3528 wrote to memory of 4224 3528 5pjpj.exe lrxffff.exe PID 4224 wrote to memory of 1844 4224 lrxffff.exe vvjvp.exe PID 4224 wrote to memory of 1844 4224 lrxffff.exe vvjvp.exe PID 4224 wrote to memory of 1844 4224 lrxffff.exe vvjvp.exe PID 1844 wrote to memory of 3380 1844 vvjvp.exe hbnnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bbf1826f77fc1200a1501e9ed5a3c1c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\tbhhbn.exec:\tbhhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\vppjj.exec:\vppjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\jdvpv.exec:\jdvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bbbhhn.exec:\bbbhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\djpjv.exec:\djpjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\tnhnnt.exec:\tnhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\pvdpj.exec:\pvdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\tbnbnn.exec:\tbnbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\vdjpp.exec:\vdjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\rxxrfrf.exec:\rxxrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\bhhnhn.exec:\bhhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bbhhbh.exec:\bbhhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\vpvjd.exec:\vpvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\lxfrffl.exec:\lxfrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\dpdvd.exec:\dpdvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\jddpv.exec:\jddpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\3bnhhh.exec:\3bnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\5pjpj.exec:\5pjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\lrxffff.exec:\lrxffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\vvjvp.exec:\vvjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\hbnnhh.exec:\hbnnhh.exe23⤵
- Executes dropped EXE
PID:3380 -
\??\c:\7pdpj.exec:\7pdpj.exe24⤵
- Executes dropped EXE
PID:3048 -
\??\c:\llrfxrl.exec:\llrfxrl.exe25⤵
- Executes dropped EXE
PID:2596 -
\??\c:\djdpd.exec:\djdpd.exe26⤵
- Executes dropped EXE
PID:3484 -
\??\c:\pvvpp.exec:\pvvpp.exe27⤵
- Executes dropped EXE
PID:4856 -
\??\c:\vpdpd.exec:\vpdpd.exe28⤵
- Executes dropped EXE
PID:820 -
\??\c:\9djdp.exec:\9djdp.exe29⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3hhbnn.exec:\3hhbnn.exe30⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jjpjv.exec:\jjpjv.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7xrfxxl.exec:\7xrfxxl.exe32⤵
- Executes dropped EXE
PID:232 -
\??\c:\vpjvj.exec:\vpjvj.exe33⤵
- Executes dropped EXE
PID:4360 -
\??\c:\flfxlrl.exec:\flfxlrl.exe34⤵
- Executes dropped EXE
PID:3888 -
\??\c:\1tttnn.exec:\1tttnn.exe35⤵
- Executes dropped EXE
PID:1244 -
\??\c:\htthbb.exec:\htthbb.exe36⤵
- Executes dropped EXE
PID:4020 -
\??\c:\vpjdp.exec:\vpjdp.exe37⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5xlffxx.exec:\5xlffxx.exe38⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbbnhb.exec:\hbbnhb.exe39⤵
- Executes dropped EXE
PID:880 -
\??\c:\vpdvp.exec:\vpdvp.exe40⤵
- Executes dropped EXE
PID:824 -
\??\c:\jddvj.exec:\jddvj.exe41⤵
- Executes dropped EXE
PID:1520 -
\??\c:\frrlfxr.exec:\frrlfxr.exe42⤵
- Executes dropped EXE
PID:4036 -
\??\c:\hnnnbt.exec:\hnnnbt.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\7pvpv.exec:\7pvpv.exe44⤵
- Executes dropped EXE
PID:2844 -
\??\c:\frxllfx.exec:\frxllfx.exe45⤵
- Executes dropped EXE
PID:4108 -
\??\c:\rlrxrxl.exec:\rlrxrxl.exe46⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhhttn.exec:\nhhttn.exe47⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vddvv.exec:\vddvv.exe48⤵
- Executes dropped EXE
PID:4708 -
\??\c:\rffxrfx.exec:\rffxrfx.exe49⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ppvpd.exec:\ppvpd.exe50⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe51⤵
- Executes dropped EXE
PID:752 -
\??\c:\btbhht.exec:\btbhht.exe52⤵
- Executes dropped EXE
PID:4592 -
\??\c:\tnttbb.exec:\tnttbb.exe53⤵
- Executes dropped EXE
PID:1988 -
\??\c:\djppj.exec:\djppj.exe54⤵
- Executes dropped EXE
PID:3716 -
\??\c:\1xrlffr.exec:\1xrlffr.exe55⤵
- Executes dropped EXE
PID:3900 -
\??\c:\bthnhn.exec:\bthnhn.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\ntbtbb.exec:\ntbtbb.exe57⤵
- Executes dropped EXE
PID:4500 -
\??\c:\dvvpj.exec:\dvvpj.exe58⤵
- Executes dropped EXE
PID:400 -
\??\c:\rllxrlf.exec:\rllxrlf.exe59⤵
- Executes dropped EXE
PID:1844 -
\??\c:\tbtnbt.exec:\tbtnbt.exe60⤵
- Executes dropped EXE
PID:4168 -
\??\c:\ntbnhh.exec:\ntbnhh.exe61⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jdpdv.exec:\jdpdv.exe62⤵
- Executes dropped EXE
PID:564 -
\??\c:\flrlxrf.exec:\flrlxrf.exe63⤵
- Executes dropped EXE
PID:4116 -
\??\c:\9xxlxff.exec:\9xxlxff.exe64⤵
- Executes dropped EXE
PID:4204 -
\??\c:\bnbnhn.exec:\bnbnhn.exe65⤵
- Executes dropped EXE
PID:4856 -
\??\c:\pdvpj.exec:\pdvpj.exe66⤵PID:2064
-
\??\c:\5vpdp.exec:\5vpdp.exe67⤵PID:1032
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe68⤵PID:4548
-
\??\c:\7flfffl.exec:\7flfffl.exe69⤵PID:4804
-
\??\c:\1bhbhh.exec:\1bhbhh.exe70⤵PID:1452
-
\??\c:\dvjvj.exec:\dvjvj.exe71⤵PID:2156
-
\??\c:\vppdp.exec:\vppdp.exe72⤵PID:1388
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe73⤵PID:1004
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe74⤵PID:3392
-
\??\c:\hhnbnh.exec:\hhnbnh.exe75⤵PID:3228
-
\??\c:\jvjdj.exec:\jvjdj.exe76⤵PID:3680
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe77⤵PID:3452
-
\??\c:\rlxrffr.exec:\rlxrffr.exe78⤵PID:3732
-
\??\c:\5hhbnn.exec:\5hhbnn.exe79⤵PID:3148
-
\??\c:\vpdjp.exec:\vpdjp.exe80⤵PID:1520
-
\??\c:\pddpd.exec:\pddpd.exe81⤵PID:1884
-
\??\c:\rflxrlx.exec:\rflxrlx.exe82⤵PID:972
-
\??\c:\hbbnhb.exec:\hbbnhb.exe83⤵PID:3428
-
\??\c:\bbbhbh.exec:\bbbhbh.exe84⤵PID:5040
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe85⤵PID:4984
-
\??\c:\xlfxllf.exec:\xlfxllf.exe86⤵PID:4024
-
\??\c:\hthnhn.exec:\hthnhn.exe87⤵PID:2588
-
\??\c:\tbhbtn.exec:\tbhbtn.exe88⤵PID:2676
-
\??\c:\vdjdv.exec:\vdjdv.exe89⤵PID:4052
-
\??\c:\lxxrllf.exec:\lxxrllf.exe90⤵PID:2764
-
\??\c:\bnhtbh.exec:\bnhtbh.exe91⤵PID:1332
-
\??\c:\htnhhb.exec:\htnhhb.exe92⤵PID:4048
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe93⤵PID:3528
-
\??\c:\flrllfx.exec:\flrllfx.exe94⤵PID:3068
-
\??\c:\hnnnhn.exec:\hnnnhn.exe95⤵PID:5116
-
\??\c:\vvppd.exec:\vvppd.exe96⤵PID:2364
-
\??\c:\jvjdv.exec:\jvjdv.exe97⤵PID:1368
-
\??\c:\lfllxrx.exec:\lfllxrx.exe98⤵PID:676
-
\??\c:\btbttn.exec:\btbttn.exe99⤵PID:3048
-
\??\c:\hbhbtb.exec:\hbhbtb.exe100⤵PID:2448
-
\??\c:\bbtnbb.exec:\bbtnbb.exe101⤵PID:4836
-
\??\c:\pjpjd.exec:\pjpjd.exe102⤵PID:1260
-
\??\c:\fflllll.exec:\fflllll.exe103⤵PID:3484
-
\??\c:\1rrrllr.exec:\1rrrllr.exe104⤵PID:64
-
\??\c:\nbnhhh.exec:\nbnhhh.exe105⤵PID:2636
-
\??\c:\vppjd.exec:\vppjd.exe106⤵PID:3128
-
\??\c:\jddvp.exec:\jddvp.exe107⤵PID:4700
-
\??\c:\rllfxxr.exec:\rllfxxr.exe108⤵PID:3224
-
\??\c:\tnbthb.exec:\tnbthb.exe109⤵PID:4860
-
\??\c:\nhnnbb.exec:\nhnnbb.exe110⤵PID:4596
-
\??\c:\pdjdp.exec:\pdjdp.exe111⤵PID:1448
-
\??\c:\pvpdd.exec:\pvpdd.exe112⤵PID:2604
-
\??\c:\ffllffx.exec:\ffllffx.exe113⤵PID:1972
-
\??\c:\lllfrrl.exec:\lllfrrl.exe114⤵PID:2728
-
\??\c:\nntnbt.exec:\nntnbt.exe115⤵PID:880
-
\??\c:\nhhbnh.exec:\nhhbnh.exe116⤵PID:3960
-
\??\c:\djdpp.exec:\djdpp.exe117⤵PID:924
-
\??\c:\frrrffr.exec:\frrrffr.exe118⤵PID:4264
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe119⤵PID:3992
-
\??\c:\hbnhhh.exec:\hbnhhh.exe120⤵PID:4536
-
\??\c:\bhthbb.exec:\bhthbb.exe121⤵PID:2692
-
\??\c:\dpppj.exec:\dpppj.exe122⤵PID:2212
-
\??\c:\fxxfxxr.exec:\fxxfxxr.exe123⤵PID:1224
-
\??\c:\rflffff.exec:\rflffff.exe124⤵PID:2552
-
\??\c:\thhnbn.exec:\thhnbn.exe125⤵PID:1228
-
\??\c:\7btbnt.exec:\7btbnt.exe126⤵PID:2760
-
\??\c:\1vpdv.exec:\1vpdv.exe127⤵PID:3424
-
\??\c:\3pdvp.exec:\3pdvp.exe128⤵PID:4500
-
\??\c:\lffxlrr.exec:\lffxlrr.exe129⤵PID:1800
-
\??\c:\rxxlfxl.exec:\rxxlfxl.exe130⤵PID:2044
-
\??\c:\tbbnhb.exec:\tbbnhb.exe131⤵PID:1012
-
\??\c:\dpvpd.exec:\dpvpd.exe132⤵PID:732
-
\??\c:\vdpdv.exec:\vdpdv.exe133⤵PID:4612
-
\??\c:\frxlfxx.exec:\frxlfxx.exe134⤵PID:3668
-
\??\c:\5ttttt.exec:\5ttttt.exe135⤵PID:3564
-
\??\c:\nhhnhb.exec:\nhhnhb.exe136⤵PID:864
-
\??\c:\7ppjv.exec:\7ppjv.exe137⤵PID:4132
-
\??\c:\ffffrlf.exec:\ffffrlf.exe138⤵PID:4768
-
\??\c:\nhtnnh.exec:\nhtnnh.exe139⤵PID:1572
-
\??\c:\bhtthh.exec:\bhtthh.exe140⤵PID:3476
-
\??\c:\dpjdv.exec:\dpjdv.exe141⤵PID:1820
-
\??\c:\dvjvv.exec:\dvjvv.exe142⤵PID:4328
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe143⤵PID:2900
-
\??\c:\hbhtth.exec:\hbhtth.exe144⤵PID:1388
-
\??\c:\hnnhtn.exec:\hnnhtn.exe145⤵PID:436
-
\??\c:\7ddvp.exec:\7ddvp.exe146⤵PID:4284
-
\??\c:\rllfxrl.exec:\rllfxrl.exe147⤵PID:2104
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe148⤵PID:2480
-
\??\c:\btnbnn.exec:\btnbnn.exe149⤵PID:1620
-
\??\c:\pvddd.exec:\pvddd.exe150⤵PID:3616
-
\??\c:\pvdpd.exec:\pvdpd.exe151⤵PID:4688
-
\??\c:\lxrfrfr.exec:\lxrfrfr.exe152⤵PID:2324
-
\??\c:\htnhtn.exec:\htnhtn.exe153⤵PID:3184
-
\??\c:\btnhtt.exec:\btnhtt.exe154⤵PID:4108
-
\??\c:\vvdvv.exec:\vvdvv.exe155⤵PID:1476
-
\??\c:\flfflff.exec:\flfflff.exe156⤵PID:3092
-
\??\c:\tnnbbn.exec:\tnnbbn.exe157⤵PID:892
-
\??\c:\hhthth.exec:\hhthth.exe158⤵PID:2552
-
\??\c:\djdpj.exec:\djdpj.exe159⤵PID:4580
-
\??\c:\pjvjp.exec:\pjvjp.exe160⤵PID:3604
-
\??\c:\3btbht.exec:\3btbht.exe161⤵PID:4512
-
\??\c:\ntnbtn.exec:\ntnbtn.exe162⤵PID:5116
-
\??\c:\7djpd.exec:\7djpd.exe163⤵PID:1664
-
\??\c:\jdpjp.exec:\jdpjp.exe164⤵PID:2184
-
\??\c:\rlrfrlf.exec:\rlrfrlf.exe165⤵PID:3736
-
\??\c:\hnnhtt.exec:\hnnhtt.exe166⤵PID:4236
-
\??\c:\hntnbb.exec:\hntnbb.exe167⤵PID:2272
-
\??\c:\pvpdp.exec:\pvpdp.exe168⤵PID:3668
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe169⤵PID:1508
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe170⤵PID:864
-
\??\c:\hhhthb.exec:\hhhthb.exe171⤵PID:3928
-
\??\c:\7nhtnt.exec:\7nhtnt.exe172⤵PID:4820
-
\??\c:\vvjdv.exec:\vvjdv.exe173⤵PID:4548
-
\??\c:\rlxrllr.exec:\rlxrllr.exe174⤵PID:4700
-
\??\c:\tntnnh.exec:\tntnnh.exe175⤵PID:3224
-
\??\c:\9nnhbt.exec:\9nnhbt.exe176⤵PID:4328
-
\??\c:\pvvvd.exec:\pvvvd.exe177⤵PID:428
-
\??\c:\llfxfxf.exec:\llfxfxf.exe178⤵PID:4316
-
\??\c:\xfrlxrr.exec:\xfrlxrr.exe179⤵PID:4208
-
\??\c:\bnhbtn.exec:\bnhbtn.exe180⤵PID:2944
-
\??\c:\jjvpj.exec:\jjvpj.exe181⤵PID:2728
-
\??\c:\5vpdp.exec:\5vpdp.exe182⤵PID:2196
-
\??\c:\9xrrrfx.exec:\9xrrrfx.exe183⤵PID:3960
-
\??\c:\bbnhbh.exec:\bbnhbh.exe184⤵PID:3788
-
\??\c:\tbnhtn.exec:\tbnhtn.exe185⤵PID:1296
-
\??\c:\jjjdv.exec:\jjjdv.exe186⤵PID:972
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe187⤵PID:4024
-
\??\c:\rrlfffl.exec:\rrlfffl.exe188⤵PID:2212
-
\??\c:\1hbtnh.exec:\1hbtnh.exe189⤵PID:4592
-
\??\c:\jjdvp.exec:\jjdvp.exe190⤵PID:3188
-
\??\c:\jpddj.exec:\jpddj.exe191⤵PID:2000
-
\??\c:\llrfrrx.exec:\llrfrrx.exe192⤵PID:1900
-
\??\c:\hhnnnh.exec:\hhnnnh.exe193⤵PID:2536
-
\??\c:\tbthtt.exec:\tbthtt.exe194⤵PID:3580
-
\??\c:\vdvpd.exec:\vdvpd.exe195⤵PID:2928
-
\??\c:\ppvvv.exec:\ppvvv.exe196⤵PID:4560
-
\??\c:\xrrllrl.exec:\xrrllrl.exe197⤵PID:1836
-
\??\c:\bbtbnn.exec:\bbtbnn.exe198⤵PID:2596
-
\??\c:\hnthtn.exec:\hnthtn.exe199⤵PID:4612
-
\??\c:\vjjdj.exec:\vjjdj.exe200⤵PID:2420
-
\??\c:\rrxlxxr.exec:\rrxlxxr.exe201⤵PID:1428
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe202⤵PID:3752
-
\??\c:\hhnbnh.exec:\hhnbnh.exe203⤵PID:1032
-
\??\c:\1hbnbn.exec:\1hbnbn.exe204⤵PID:648
-
\??\c:\vvdvd.exec:\vvdvd.exe205⤵PID:2320
-
\??\c:\jvdjj.exec:\jvdjj.exe206⤵PID:1464
-
\??\c:\rfrfxlx.exec:\rfrfxlx.exe207⤵PID:3288
-
\??\c:\tbttnn.exec:\tbttnn.exe208⤵PID:1492
-
\??\c:\3nbnbb.exec:\3nbnbb.exe209⤵PID:1448
-
\??\c:\dpvpd.exec:\dpvpd.exe210⤵PID:2984
-
\??\c:\pjjdv.exec:\pjjdv.exe211⤵PID:1892
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe212⤵PID:1972
-
\??\c:\xlxffrf.exec:\xlxffrf.exe213⤵PID:3704
-
\??\c:\5httnt.exec:\5httnt.exe214⤵PID:3732
-
\??\c:\vjvpp.exec:\vjvpp.exe215⤵PID:2368
-
\??\c:\vjdvj.exec:\vjdvj.exe216⤵PID:5048
-
\??\c:\9lrlxlf.exec:\9lrlxlf.exe217⤵PID:4948
-
\??\c:\3bhbbt.exec:\3bhbbt.exe218⤵PID:4544
-
\??\c:\hnnhtb.exec:\hnnhtb.exe219⤵PID:952
-
\??\c:\vjpjv.exec:\vjpjv.exe220⤵PID:5024
-
\??\c:\jvjdp.exec:\jvjdp.exe221⤵PID:4480
-
\??\c:\9rrffxl.exec:\9rrffxl.exe222⤵PID:1600
-
\??\c:\ttthbt.exec:\ttthbt.exe223⤵PID:3424
-
\??\c:\htnhhh.exec:\htnhhh.exe224⤵PID:1900
-
\??\c:\vjdpv.exec:\vjdpv.exe225⤵PID:3456
-
\??\c:\5flxlfx.exec:\5flxlfx.exe226⤵PID:2928
-
\??\c:\rlrlfff.exec:\rlrlfff.exe227⤵PID:3200
-
\??\c:\3tthbt.exec:\3tthbt.exe228⤵PID:4236
-
\??\c:\ntthbt.exec:\ntthbt.exe229⤵PID:4608
-
\??\c:\jvdvd.exec:\jvdvd.exe230⤵PID:1168
-
\??\c:\pddpd.exec:\pddpd.exe231⤵PID:4856
-
\??\c:\xllxxrx.exec:\xllxxrx.exe232⤵PID:2300
-
\??\c:\ttbntb.exec:\ttbntb.exe233⤵PID:3256
-
\??\c:\vdjjv.exec:\vdjjv.exe234⤵PID:4288
-
\??\c:\3vppj.exec:\3vppj.exe235⤵PID:4548
-
\??\c:\1ffxlfx.exec:\1ffxlfx.exe236⤵PID:3224
-
\??\c:\lxfxllx.exec:\lxfxllx.exe237⤵PID:2936
-
\??\c:\ntnhbb.exec:\ntnhbb.exe238⤵PID:4328
-
\??\c:\djpjp.exec:\djpjp.exe239⤵PID:428
-
\??\c:\9djvp.exec:\9djvp.exe240⤵PID:5052
-
\??\c:\rxxrrlf.exec:\rxxrrlf.exe241⤵PID:4404
-
\??\c:\3lfxlrl.exec:\3lfxlrl.exe242⤵PID:4436