Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:16
Behavioral task
behavioral1
Sample
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe
-
Size
214KB
-
MD5
d406c0f45f7623b706c8150342941700
-
SHA1
c10276044e0a0a5f3f7a220f266a45185f988f7d
-
SHA256
d8a3a6f121968815cf9095c0345c76b06940d35b983431881253a4e013295fed
-
SHA512
11fa00d1abdbf5f9920c6bc6459563f2b8cf038917c44c753f35545c63ca151b3f586e1ea128b373367e48e6e7585035547f5f8e978ecc6bbb48b18aa7131d98
-
SSDEEP
3072:ZhOm2sI93UufdC67ciEu0P5axvqdUmdznCvs7BuRoYFBg/gXVqPfSoi0yG24ePay:Zcm7ImGddXEu0ucju6/4kf724s
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-8-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2112-17-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2728-27-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2636-36-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2736-46-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2768-54-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1712-64-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2632-72-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2940-84-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2664-100-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2536-125-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2308-135-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1176-152-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1256-154-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2244-185-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/596-218-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/636-223-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/844-229-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1932-238-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2372-254-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2580-278-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/888-293-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/3040-305-0x0000000000230000-0x000000000025D000-memory.dmp family_blackmoon behavioral1/memory/3040-307-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2860-334-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2784-353-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2616-378-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2960-411-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2388-419-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1056-450-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1528-522-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/888-574-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/1548-600-0x00000000002A0000-0x00000000002CD000-memory.dmp family_blackmoon behavioral1/memory/1220-679-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2080-885-0x0000000000230000-0x000000000025D000-memory.dmp family_blackmoon behavioral1/memory/2696-909-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1924-960-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/2776-971-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon behavioral1/memory/1648-1026-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2988-1146-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2604-1191-0x0000000000400000-0x000000000042D000-memory.dmp family_blackmoon behavioral1/memory/2528-1249-0x0000000000220000-0x000000000024D000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\tnttbb.exe family_berbew \??\c:\1rllrxf.exe family_berbew C:\7xrrxrx.exe family_berbew C:\9vdvp.exe family_berbew C:\hbbbnt.exe family_berbew C:\7tbbhh.exe family_berbew C:\dvpjd.exe family_berbew C:\lfrxllr.exe family_berbew C:\5nhtbh.exe family_berbew C:\5jddv.exe family_berbew C:\rfrlffl.exe family_berbew C:\hhnnbb.exe family_berbew C:\jjvvj.exe family_berbew C:\jjvdp.exe family_berbew C:\3fxxrrf.exe family_berbew C:\hhbhbh.exe family_berbew C:\btbthh.exe family_berbew C:\vvddj.exe family_berbew C:\btnthn.exe family_berbew C:\tnhntt.exe family_berbew C:\7jvdd.exe family_berbew C:\xrrxxxf.exe family_berbew C:\3bnntt.exe family_berbew C:\jvjjp.exe family_berbew C:\5vjpp.exe family_berbew C:\5lxfrxf.exe family_berbew \??\c:\bthhbh.exe family_berbew \??\c:\jdppd.exe family_berbew C:\fxrrlrx.exe family_berbew C:\xrffrlr.exe family_berbew \??\c:\tnbhtt.exe family_berbew C:\1tthnb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tnttbb.exe1rllrxf.exe7xrrxrx.exe9vdvp.exehbbbnt.exe7tbbhh.exedvpjd.exelfrxllr.exe5nhtbh.exe5jddv.exerfrlffl.exehhnnbb.exejjvvj.exejjvdp.exe3fxxrrf.exehhbhbh.exebtbthh.exevvddj.exebtnthn.exetnhntt.exe7jvdd.exexrrxxxf.exe3bnntt.exejvjjp.exe5vjpp.exe5lxfrxf.exebthhbh.exejdppd.exefxrrlrx.exexrffrlr.exetnbhtt.exe1tthnb.exe7vpvd.exeflfxllr.exerrlrflf.exe3hnhnt.exejvjvd.exepjdjd.exelfxrflr.exexlllrxf.exe3lllxrx.exettntbb.exejdjpd.exe3lxlrrl.exennntbb.exejjpvp.exe5btthh.exejjjpp.exefxrrxrx.exerrffxfx.exehbntht.exetnnntt.exepjdpp.exe7xxfflr.exerfxrrrx.exe5nhnbb.exehhbhbb.exejddjp.exelfrrxrf.exe9rlrxfl.exebbhntt.exebntttb.exevvvvv.exeppdjp.exepid process 2112 tnttbb.exe 2728 1rllrxf.exe 2636 7xrrxrx.exe 2736 9vdvp.exe 2768 hbbbnt.exe 1712 7tbbhh.exe 2632 dvpjd.exe 2508 lfrxllr.exe 2940 5nhtbh.exe 2664 5jddv.exe 2776 rfrlffl.exe 2916 hhnnbb.exe 2536 jjvvj.exe 2308 jjvdp.exe 1628 3fxxrrf.exe 1176 hhbhbh.exe 1256 btbthh.exe 2564 vvddj.exe 1748 btnthn.exe 2244 tnhntt.exe 2260 7jvdd.exe 852 xrrxxxf.exe 2876 3bnntt.exe 596 jvjjp.exe 636 5vjpp.exe 844 5lxfrxf.exe 1932 bthhbh.exe 2372 jdppd.exe 892 fxrrlrx.exe 1240 xrffrlr.exe 2580 tnbhtt.exe 2000 1tthnb.exe 888 7vpvd.exe 2988 flfxllr.exe 3040 rrlrflf.exe 2312 3hnhnt.exe 2680 jvjvd.exe 3052 pjdjd.exe 2692 lfxrflr.exe 2860 xlllrxf.exe 2848 3lllxrx.exe 2784 ttntbb.exe 2524 jdjpd.exe 2740 3lxlrrl.exe 2660 nnntbb.exe 2616 jjpvp.exe 1808 5btthh.exe 2980 jjjpp.exe 2512 fxrrxrx.exe 2932 rrffxfx.exe 2960 hbntht.exe 2388 tnnntt.exe 2024 pjdpp.exe 1976 7xxfflr.exe 2208 rfxrrrx.exe 2028 5nhnbb.exe 2592 hhbhbb.exe 1056 jddjp.exe 1744 lfrrxrf.exe 1652 9rlrxfl.exe 1416 bbhntt.exe 628 bntttb.exe 2248 vvvvv.exe 2264 ppdjp.exe -
Processes:
resource yara_rule behavioral1/memory/1772-0-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1772-8-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2112-17-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2728-27-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2636-28-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2636-36-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2736-46-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1712-64-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2632-72-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2940-84-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2664-91-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2664-100-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2536-125-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2308-126-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2308-135-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1176-152-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1256-154-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2244-185-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/596-218-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/636-223-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/844-229-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1932-238-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2372-254-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2580-278-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/888-293-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3040-307-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2312-308-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2860-334-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2784-353-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2616-372-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2616-378-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2980-385-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2932-398-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2960-411-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2388-412-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2388-419-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1056-450-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1652-463-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1108-502-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1528-515-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1528-522-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/888-574-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1548-593-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2716-619-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2784-638-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/3008-657-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1220-679-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1596-754-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/380-799-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1664-860-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2080-885-0x0000000000230000-0x000000000025D000-memory.dmp upx behavioral1/memory/3028-886-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2744-914-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1648-1026-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1988-1052-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1716-1065-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1336-1090-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2156-1127-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2988-1146-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/1572-1153-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2700-1172-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2604-1191-0x0000000000400000-0x000000000042D000-memory.dmp upx behavioral1/memory/2568-1216-0x0000000000400000-0x000000000042D000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d406c0f45f7623b706c8150342941700_NeikiAnalytics.exetnttbb.exe1rllrxf.exe7xrrxrx.exe9vdvp.exehbbbnt.exe7tbbhh.exedvpjd.exelfrxllr.exe5nhtbh.exe5jddv.exerfrlffl.exehhnnbb.exejjvvj.exejjvdp.exe3fxxrrf.exedescription pid process target process PID 1772 wrote to memory of 2112 1772 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe tnttbb.exe PID 1772 wrote to memory of 2112 1772 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe tnttbb.exe PID 1772 wrote to memory of 2112 1772 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe tnttbb.exe PID 1772 wrote to memory of 2112 1772 d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe tnttbb.exe PID 2112 wrote to memory of 2728 2112 tnttbb.exe 1rllrxf.exe PID 2112 wrote to memory of 2728 2112 tnttbb.exe 1rllrxf.exe PID 2112 wrote to memory of 2728 2112 tnttbb.exe 1rllrxf.exe PID 2112 wrote to memory of 2728 2112 tnttbb.exe 1rllrxf.exe PID 2728 wrote to memory of 2636 2728 1rllrxf.exe 7xrrxrx.exe PID 2728 wrote to memory of 2636 2728 1rllrxf.exe 7xrrxrx.exe PID 2728 wrote to memory of 2636 2728 1rllrxf.exe 7xrrxrx.exe PID 2728 wrote to memory of 2636 2728 1rllrxf.exe 7xrrxrx.exe PID 2636 wrote to memory of 2736 2636 7xrrxrx.exe 9vdvp.exe PID 2636 wrote to memory of 2736 2636 7xrrxrx.exe 9vdvp.exe PID 2636 wrote to memory of 2736 2636 7xrrxrx.exe 9vdvp.exe PID 2636 wrote to memory of 2736 2636 7xrrxrx.exe 9vdvp.exe PID 2736 wrote to memory of 2768 2736 9vdvp.exe hbbbnt.exe PID 2736 wrote to memory of 2768 2736 9vdvp.exe hbbbnt.exe PID 2736 wrote to memory of 2768 2736 9vdvp.exe hbbbnt.exe PID 2736 wrote to memory of 2768 2736 9vdvp.exe hbbbnt.exe PID 2768 wrote to memory of 1712 2768 hbbbnt.exe 7tbbhh.exe PID 2768 wrote to memory of 1712 2768 hbbbnt.exe 7tbbhh.exe PID 2768 wrote to memory of 1712 2768 hbbbnt.exe 7tbbhh.exe PID 2768 wrote to memory of 1712 2768 hbbbnt.exe 7tbbhh.exe PID 1712 wrote to memory of 2632 1712 7tbbhh.exe dvpjd.exe PID 1712 wrote to memory of 2632 1712 7tbbhh.exe dvpjd.exe PID 1712 wrote to memory of 2632 1712 7tbbhh.exe dvpjd.exe PID 1712 wrote to memory of 2632 1712 7tbbhh.exe dvpjd.exe PID 2632 wrote to memory of 2508 2632 dvpjd.exe lfrxllr.exe PID 2632 wrote to memory of 2508 2632 dvpjd.exe lfrxllr.exe PID 2632 wrote to memory of 2508 2632 dvpjd.exe lfrxllr.exe PID 2632 wrote to memory of 2508 2632 dvpjd.exe lfrxllr.exe PID 2508 wrote to memory of 2940 2508 lfrxllr.exe 5nhtbh.exe PID 2508 wrote to memory of 2940 2508 lfrxllr.exe 5nhtbh.exe PID 2508 wrote to memory of 2940 2508 lfrxllr.exe 5nhtbh.exe PID 2508 wrote to memory of 2940 2508 lfrxllr.exe 5nhtbh.exe PID 2940 wrote to memory of 2664 2940 5nhtbh.exe 5jddv.exe PID 2940 wrote to memory of 2664 2940 5nhtbh.exe 5jddv.exe PID 2940 wrote to memory of 2664 2940 5nhtbh.exe 5jddv.exe PID 2940 wrote to memory of 2664 2940 5nhtbh.exe 5jddv.exe PID 2664 wrote to memory of 2776 2664 5jddv.exe rfrlffl.exe PID 2664 wrote to memory of 2776 2664 5jddv.exe rfrlffl.exe PID 2664 wrote to memory of 2776 2664 5jddv.exe rfrlffl.exe PID 2664 wrote to memory of 2776 2664 5jddv.exe rfrlffl.exe PID 2776 wrote to memory of 2916 2776 rfrlffl.exe hhnnbb.exe PID 2776 wrote to memory of 2916 2776 rfrlffl.exe hhnnbb.exe PID 2776 wrote to memory of 2916 2776 rfrlffl.exe hhnnbb.exe PID 2776 wrote to memory of 2916 2776 rfrlffl.exe hhnnbb.exe PID 2916 wrote to memory of 2536 2916 hhnnbb.exe jjvvj.exe PID 2916 wrote to memory of 2536 2916 hhnnbb.exe jjvvj.exe PID 2916 wrote to memory of 2536 2916 hhnnbb.exe jjvvj.exe PID 2916 wrote to memory of 2536 2916 hhnnbb.exe jjvvj.exe PID 2536 wrote to memory of 2308 2536 jjvvj.exe jjvdp.exe PID 2536 wrote to memory of 2308 2536 jjvvj.exe jjvdp.exe PID 2536 wrote to memory of 2308 2536 jjvvj.exe jjvdp.exe PID 2536 wrote to memory of 2308 2536 jjvvj.exe jjvdp.exe PID 2308 wrote to memory of 1628 2308 jjvdp.exe 3fxxrrf.exe PID 2308 wrote to memory of 1628 2308 jjvdp.exe 3fxxrrf.exe PID 2308 wrote to memory of 1628 2308 jjvdp.exe 3fxxrrf.exe PID 2308 wrote to memory of 1628 2308 jjvdp.exe 3fxxrrf.exe PID 1628 wrote to memory of 1176 1628 3fxxrrf.exe hhbhbh.exe PID 1628 wrote to memory of 1176 1628 3fxxrrf.exe hhbhbh.exe PID 1628 wrote to memory of 1176 1628 3fxxrrf.exe hhbhbh.exe PID 1628 wrote to memory of 1176 1628 3fxxrrf.exe hhbhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d406c0f45f7623b706c8150342941700_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\tnttbb.exec:\tnttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\1rllrxf.exec:\1rllrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7xrrxrx.exec:\7xrrxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\9vdvp.exec:\9vdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbbbnt.exec:\hbbbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\7tbbhh.exec:\7tbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\dvpjd.exec:\dvpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lfrxllr.exec:\lfrxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5nhtbh.exec:\5nhtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5jddv.exec:\5jddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rfrlffl.exec:\rfrlffl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\hhnnbb.exec:\hhnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\jjvvj.exec:\jjvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jjvdp.exec:\jjvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\3fxxrrf.exec:\3fxxrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\hhbhbh.exec:\hhbhbh.exe17⤵
- Executes dropped EXE
PID:1176 -
\??\c:\btbthh.exec:\btbthh.exe18⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vvddj.exec:\vvddj.exe19⤵
- Executes dropped EXE
PID:2564 -
\??\c:\btnthn.exec:\btnthn.exe20⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tnhntt.exec:\tnhntt.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7jvdd.exec:\7jvdd.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe23⤵
- Executes dropped EXE
PID:852 -
\??\c:\3bnntt.exec:\3bnntt.exe24⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvjjp.exec:\jvjjp.exe25⤵
- Executes dropped EXE
PID:596 -
\??\c:\5vjpp.exec:\5vjpp.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\5lxfrxf.exec:\5lxfrxf.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\bthhbh.exec:\bthhbh.exe28⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdppd.exec:\jdppd.exe29⤵
- Executes dropped EXE
PID:2372 -
\??\c:\fxrrlrx.exec:\fxrrlrx.exe30⤵
- Executes dropped EXE
PID:892 -
\??\c:\xrffrlr.exec:\xrffrlr.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tnbhtt.exec:\tnbhtt.exe32⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1tthnb.exec:\1tthnb.exe33⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7vpvd.exec:\7vpvd.exe34⤵
- Executes dropped EXE
PID:888 -
\??\c:\flfxllr.exec:\flfxllr.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rrlrflf.exec:\rrlrflf.exe36⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3hnhnt.exec:\3hnhnt.exe37⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jvjvd.exec:\jvjvd.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\pjdjd.exec:\pjdjd.exe39⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lfxrflr.exec:\lfxrflr.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xlllrxf.exec:\xlllrxf.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3lllxrx.exec:\3lllxrx.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ttntbb.exec:\ttntbb.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jdjpd.exec:\jdjpd.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3lxlrrl.exec:\3lxlrrl.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nnntbb.exec:\nnntbb.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jjpvp.exec:\jjpvp.exe47⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5btthh.exec:\5btthh.exe48⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjjpp.exec:\jjjpp.exe49⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe50⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrffxfx.exec:\rrffxfx.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbntht.exec:\hbntht.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tnnntt.exec:\tnnntt.exe53⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjdpp.exec:\pjdpp.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7xxfflr.exec:\7xxfflr.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5nhnbb.exec:\5nhnbb.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hhbhbb.exec:\hhbhbb.exe58⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jddjp.exec:\jddjp.exe59⤵
- Executes dropped EXE
PID:1056 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe60⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9rlrxfl.exec:\9rlrxfl.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bbhntt.exec:\bbhntt.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bntttb.exec:\bntttb.exe63⤵
- Executes dropped EXE
PID:628 -
\??\c:\vvvvv.exec:\vvvvv.exe64⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ppdjp.exec:\ppdjp.exe65⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe66⤵PID:2864
-
\??\c:\rrflrrf.exec:\rrflrrf.exe67⤵PID:1108
-
\??\c:\thtnbt.exec:\thtnbt.exe68⤵PID:380
-
\??\c:\ppjpj.exec:\ppjpj.exe69⤵PID:1528
-
\??\c:\7dpjp.exec:\7dpjp.exe70⤵PID:1844
-
\??\c:\xrflrrf.exec:\xrflrrf.exe71⤵PID:1952
-
\??\c:\nhhttb.exec:\nhhttb.exe72⤵PID:2896
-
\??\c:\1btbhn.exec:\1btbhn.exe73⤵PID:892
-
\??\c:\pjddv.exec:\pjddv.exe74⤵PID:1052
-
\??\c:\pdvvj.exec:\pdvvj.exe75⤵PID:2336
-
\??\c:\lxrrxll.exec:\lxrrxll.exe76⤵PID:992
-
\??\c:\5lfrxxx.exec:\5lfrxxx.exe77⤵PID:1632
-
\??\c:\hbnttt.exec:\hbnttt.exe78⤵PID:888
-
\??\c:\jddjd.exec:\jddjd.exe79⤵PID:2128
-
\??\c:\vpppj.exec:\vpppj.exe80⤵PID:1732
-
\??\c:\llfxffl.exec:\llfxffl.exe81⤵PID:1548
-
\??\c:\5nbhnt.exec:\5nbhnt.exe82⤵PID:1680
-
\??\c:\5tnbbt.exec:\5tnbbt.exe83⤵PID:2624
-
\??\c:\jdvvv.exec:\jdvvv.exe84⤵PID:2704
-
\??\c:\3vppp.exec:\3vppp.exe85⤵PID:2716
-
\??\c:\llfxflx.exec:\llfxflx.exe86⤵PID:2764
-
\??\c:\hhhbbh.exec:\hhhbbh.exe87⤵PID:2848
-
\??\c:\3bbhnt.exec:\3bbhnt.exe88⤵PID:2784
-
\??\c:\vvpjp.exec:\vvpjp.exe89⤵PID:2212
-
\??\c:\dvjvv.exec:\dvjvv.exe90⤵PID:2548
-
\??\c:\9xrlxlr.exec:\9xrlxlr.exe91⤵PID:3008
-
\??\c:\5nhbhh.exec:\5nhbhh.exe92⤵PID:2944
-
\??\c:\9thnbh.exec:\9thnbh.exe93⤵PID:1220
-
\??\c:\7vppp.exec:\7vppp.exe94⤵PID:2804
-
\??\c:\xrxxffl.exec:\xrxxffl.exe95⤵PID:2952
-
\??\c:\rrllrrx.exec:\rrllrrx.exe96⤵PID:2016
-
\??\c:\3hhnbh.exec:\3hhnbh.exe97⤵PID:2536
-
\??\c:\3hhtbh.exec:\3hhtbh.exe98⤵PID:1820
-
\??\c:\dvjpd.exec:\dvjpd.exe99⤵PID:2024
-
\??\c:\7xlffxx.exec:\7xlffxx.exe100⤵PID:1980
-
\??\c:\lfllrrf.exec:\lfllrrf.exe101⤵PID:2556
-
\??\c:\tnttbh.exec:\tnttbh.exe102⤵PID:2028
-
\??\c:\btnntb.exec:\btnntb.exe103⤵PID:1912
-
\??\c:\ddvjp.exec:\ddvjp.exe104⤵PID:808
-
\??\c:\vpjjj.exec:\vpjjj.exe105⤵PID:1748
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe106⤵PID:1596
-
\??\c:\nnthtb.exec:\nnthtb.exe107⤵PID:1900
-
\??\c:\nhbnhn.exec:\nhbnhn.exe108⤵PID:2868
-
\??\c:\dpjdj.exec:\dpjdj.exe109⤵PID:2288
-
\??\c:\dpvvd.exec:\dpvvd.exe110⤵PID:2232
-
\??\c:\rflrffx.exec:\rflrffx.exe111⤵PID:596
-
\??\c:\hhbntt.exec:\hhbntt.exe112⤵PID:1108
-
\??\c:\tnbhhn.exec:\tnbhhn.exe113⤵PID:380
-
\??\c:\ddjvd.exec:\ddjvd.exe114⤵PID:1528
-
\??\c:\ddjdj.exec:\ddjdj.exe115⤵PID:2448
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe116⤵PID:1952
-
\??\c:\xrxrflr.exec:\xrxrflr.exe117⤵PID:912
-
\??\c:\bbtbhh.exec:\bbtbhh.exe118⤵PID:1724
-
\??\c:\9vjpp.exec:\9vjpp.exe119⤵PID:2888
-
\??\c:\pdvvp.exec:\pdvvp.exe120⤵PID:2900
-
\??\c:\lfxlrrx.exec:\lfxlrrx.exe121⤵PID:576
-
\??\c:\bthbhh.exec:\bthbhh.exe122⤵PID:2884
-
\??\c:\tnbhnb.exec:\tnbhnb.exe123⤵PID:1664
-
\??\c:\dvjpd.exec:\dvjpd.exe124⤵PID:2112
-
\??\c:\5vppd.exec:\5vppd.exe125⤵PID:1232
-
\??\c:\7rxxxxf.exec:\7rxxxxf.exe126⤵PID:2080
-
\??\c:\frxflrr.exec:\frxflrr.exe127⤵PID:3028
-
\??\c:\nhbttb.exec:\nhbttb.exe128⤵PID:3052
-
\??\c:\vpvpd.exec:\vpvpd.exe129⤵PID:2648
-
\??\c:\jdpvd.exec:\jdpvd.exe130⤵PID:2696
-
\??\c:\rlxxffl.exec:\rlxxffl.exe131⤵PID:2744
-
\??\c:\hbnntt.exec:\hbnntt.exe132⤵PID:2752
-
\??\c:\thbttn.exec:\thbttn.exe133⤵PID:2784
-
\??\c:\vvpdp.exec:\vvpdp.exe134⤵PID:2560
-
\??\c:\vpjpd.exec:\vpjpd.exe135⤵PID:2508
-
\??\c:\9ffxxfr.exec:\9ffxxfr.exe136⤵PID:2948
-
\??\c:\ttbbnt.exec:\ttbbnt.exe137⤵PID:1808
-
\??\c:\tnbbnn.exec:\tnbbnn.exe138⤵PID:1924
-
\??\c:\pjpvj.exec:\pjpvj.exe139⤵PID:2776
-
\??\c:\frxflrx.exec:\frxflrx.exe140⤵PID:2036
-
\??\c:\xrlfrxf.exec:\xrlfrxf.exe141⤵PID:2432
-
\??\c:\nhtbbt.exec:\nhtbbt.exe142⤵PID:2388
-
\??\c:\5tbbbb.exec:\5tbbbb.exe143⤵PID:2472
-
\??\c:\jdpvd.exec:\jdpvd.exe144⤵PID:1064
-
\??\c:\pdpdd.exec:\pdpdd.exe145⤵PID:1628
-
\??\c:\xrxrxff.exec:\xrxrxff.exe146⤵PID:1260
-
\??\c:\7xfxflf.exec:\7xfxflf.exe147⤵PID:768
-
\??\c:\3ntthh.exec:\3ntthh.exe148⤵PID:1720
-
\??\c:\bthhhn.exec:\bthhhn.exe149⤵PID:1648
-
\??\c:\jdvjp.exec:\jdvjp.exe150⤵PID:2228
-
\??\c:\5lflxxf.exec:\5lflxxf.exe151⤵PID:1644
-
\??\c:\ffflrff.exec:\ffflrff.exe152⤵PID:1596
-
\??\c:\hbhnnt.exec:\hbhnnt.exe153⤵PID:1988
-
\??\c:\1ppjp.exec:\1ppjp.exe154⤵PID:792
-
\??\c:\dvpvv.exec:\dvpvv.exe155⤵PID:1716
-
\??\c:\rrlxflf.exec:\rrlxflf.exe156⤵PID:2116
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe157⤵PID:1564
-
\??\c:\hbhtth.exec:\hbhtth.exe158⤵PID:1364
-
\??\c:\1bnbbh.exec:\1bnbbh.exe159⤵PID:1336
-
\??\c:\dvvvj.exec:\dvvvj.exe160⤵PID:1640
-
\??\c:\jpdjj.exec:\jpdjj.exe161⤵PID:1844
-
\??\c:\7frrxxl.exec:\7frrxxl.exe162⤵PID:2104
-
\??\c:\frflrxx.exec:\frflrxx.exe163⤵PID:848
-
\??\c:\1htbhh.exec:\1htbhh.exe164⤵PID:2224
-
\??\c:\bnbhnt.exec:\bnbhnt.exe165⤵PID:2156
-
\??\c:\jdjpv.exec:\jdjpv.exe166⤵PID:3004
-
\??\c:\rlxrflx.exec:\rlxrflx.exe167⤵PID:2084
-
\??\c:\1tthnt.exec:\1tthnt.exe168⤵PID:2988
-
\??\c:\ppjpd.exec:\ppjpd.exe169⤵PID:1572
-
\??\c:\jjvdj.exec:\jjvdj.exe170⤵PID:3044
-
\??\c:\5lffllr.exec:\5lffllr.exe171⤵PID:2652
-
\??\c:\hthhhh.exec:\hthhhh.exe172⤵PID:2700
-
\??\c:\ppdvp.exec:\ppdvp.exe173⤵PID:2732
-
\??\c:\dpjpd.exec:\dpjpd.exe174⤵PID:1152
-
\??\c:\rrxxllx.exec:\rrxxllx.exe175⤵PID:2604
-
\??\c:\bthtbh.exec:\bthtbh.exe176⤵PID:2544
-
\??\c:\nhbhnb.exec:\nhbhnb.exe177⤵PID:2760
-
\??\c:\7vvjp.exec:\7vvjp.exe178⤵PID:2528
-
\??\c:\jjdjp.exec:\jjdjp.exe179⤵PID:2568
-
\??\c:\rrfrxfl.exec:\rrfrxfl.exe180⤵PID:2540
-
\??\c:\5xxflrf.exec:\5xxflrf.exe181⤵PID:1524
-
\??\c:\7hbnnb.exec:\7hbnnb.exe182⤵PID:2484
-
\??\c:\vjdvp.exec:\vjdvp.exe183⤵PID:2788
-
\??\c:\1dvvd.exec:\1dvvd.exe184⤵PID:2780
-
\??\c:\rlxxffl.exec:\rlxxffl.exe185⤵PID:2952
-
\??\c:\rrflrfr.exec:\rrflrfr.exe186⤵PID:1964
-
\??\c:\9bbhhh.exec:\9bbhhh.exe187⤵PID:2412
-
\??\c:\jdvdj.exec:\jdvdj.exe188⤵PID:1608
-
\??\c:\jdvdd.exec:\jdvdd.exe189⤵PID:2044
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe190⤵PID:1768
-
\??\c:\7rfrlrf.exec:\7rfrlrf.exe191⤵PID:1444
-
\??\c:\btnthn.exec:\btnthn.exe192⤵PID:2028
-
\??\c:\hthhnn.exec:\hthhnn.exe193⤵PID:1744
-
\??\c:\dvpvp.exec:\dvpvp.exe194⤵PID:2284
-
\??\c:\jdvvd.exec:\jdvvd.exe195⤵PID:1752
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe196⤵PID:2228
-
\??\c:\rfrrfxf.exec:\rfrrfxf.exe197⤵PID:1900
-
\??\c:\bththn.exec:\bththn.exe198⤵PID:2476
-
\??\c:\tnhbhh.exec:\tnhbhh.exe199⤵PID:1616
-
\??\c:\ddjvv.exec:\ddjvv.exe200⤵PID:792
-
\??\c:\jdppd.exec:\jdppd.exe201⤵PID:3048
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe202⤵PID:1348
-
\??\c:\9xrlrrf.exec:\9xrlrrf.exe203⤵PID:1940
-
\??\c:\nhbhbb.exec:\nhbhbb.exe204⤵PID:1856
-
\??\c:\9thhnh.exec:\9thhnh.exe205⤵PID:948
-
\??\c:\jdvdp.exec:\jdvdp.exe206⤵PID:1392
-
\??\c:\5rffffr.exec:\5rffffr.exe207⤵PID:1340
-
\??\c:\rfrrxff.exec:\rfrrxff.exe208⤵PID:1240
-
\??\c:\5nbhnt.exec:\5nbhnt.exe209⤵PID:2888
-
\??\c:\bbhtbh.exec:\bbhtbh.exe210⤵PID:3000
-
\??\c:\ppdpd.exec:\ppdpd.exe211⤵PID:576
-
\??\c:\pdvvd.exec:\pdvvd.exe212⤵PID:3004
-
\??\c:\lllllrx.exec:\lllllrx.exe213⤵PID:2084
-
\??\c:\3frrrxf.exec:\3frrrxf.exe214⤵PID:1836
-
\??\c:\nhbntb.exec:\nhbntb.exe215⤵PID:2364
-
\??\c:\bnbhbh.exec:\bnbhbh.exe216⤵PID:2312
-
\??\c:\dvppv.exec:\dvppv.exe217⤵PID:1684
-
\??\c:\dpddd.exec:\dpddd.exe218⤵PID:1580
-
\??\c:\flflxlx.exec:\flflxlx.exe219⤵PID:2624
-
\??\c:\1lxxllr.exec:\1lxxllr.exe220⤵PID:2712
-
\??\c:\5htttt.exec:\5htttt.exe221⤵PID:2532
-
\??\c:\hbtnbb.exec:\hbtnbb.exe222⤵PID:2860
-
\??\c:\jvjjp.exec:\jvjjp.exe223⤵PID:3036
-
\??\c:\jvjjv.exec:\jvjjv.exe224⤵PID:2848
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe225⤵PID:2188
-
\??\c:\bbttbh.exec:\bbttbh.exe226⤵PID:2496
-
\??\c:\5htttt.exec:\5htttt.exe227⤵PID:2772
-
\??\c:\vpddj.exec:\vpddj.exe228⤵PID:2192
-
\??\c:\1vvdj.exec:\1vvdj.exe229⤵PID:1220
-
\??\c:\1xxflll.exec:\1xxflll.exe230⤵PID:2980
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe231⤵PID:2788
-
\??\c:\7tnttn.exec:\7tnttn.exe232⤵PID:2968
-
\??\c:\1tntbb.exec:\1tntbb.exe233⤵PID:2924
-
\??\c:\dpdvd.exec:\dpdvd.exe234⤵PID:1964
-
\??\c:\5jdjp.exec:\5jdjp.exe235⤵PID:1320
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe236⤵PID:1292
-
\??\c:\3lxxllr.exec:\3lxxllr.exe237⤵PID:2304
-
\??\c:\hhnnnn.exec:\hhnnnn.exe238⤵PID:108
-
\??\c:\7bnttt.exec:\7bnttt.exe239⤵PID:2424
-
\??\c:\ppjvd.exec:\ppjvd.exe240⤵PID:1396
-
\??\c:\ppvpv.exec:\ppvpv.exe241⤵PID:808
-
\??\c:\xxlxfxf.exec:\xxlxfxf.exe242⤵PID:2252