Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:15
Behavioral task
behavioral1
Sample
1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe
-
Size
398KB
-
MD5
1239f186c38b31a8a149c378ad5d9210
-
SHA1
ffbd9a9860cd9f9df4ffbcbf43e29d2336967f8f
-
SHA256
dc6353745cd10375095e5682eed502ec4b25f18239df149b0dfc4e59a903388f
-
SHA512
0bb3b6ed17a25a070c81863844f00bc5ad93d3671c401199432c7f11320cc9f3ee67c1ef3d20d311d8564c47d5d7089e0fb1e6b5fb310e98417b057ad9aaba2f
-
SSDEEP
12288:Q4wFHoSqRyddW7xJCc5TugZKS9sUvkclI0/RTk:BRyLWFMu91RlI0/RTk
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2000-16-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2684-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2532-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2628-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2376-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2564-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2436-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1656-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2876-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2412-110-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/916-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1848-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1328-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2136-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/540-194-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/1052-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/836-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1544-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1044-255-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2980-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2008-323-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2928-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-367-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3024-387-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2876-401-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1808-435-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/380-436-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/592-491-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2360-518-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1644-545-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1644-543-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1616-692-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1740-732-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1764-820-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1316-956-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2216-1008-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\tnbnnn.exe family_berbew behavioral1/memory/2000-8-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\pjvvd.exe family_berbew behavioral1/memory/2000-16-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\5hhnbb.exe family_berbew behavioral1/memory/2532-26-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ddppv.exe family_berbew behavioral1/memory/2684-37-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2532-35-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\fllfrxf.exe family_berbew behavioral1/memory/2628-53-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\btbbbh.exe family_berbew behavioral1/memory/2376-54-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2376-62-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\xfllrfx.exe family_berbew C:\bbnbth.exe family_berbew behavioral1/memory/2564-72-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2436-75-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\hbtthn.exe family_berbew C:\3ffrlxl.exe family_berbew behavioral1/memory/1656-90-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2876-92-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\bbhntt.exe family_berbew C:\jdpdv.exe family_berbew behavioral1/memory/2412-110-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\xlrffrf.exe family_berbew \??\c:\jdvdp.exe family_berbew behavioral1/memory/916-126-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ppjjd.exe family_berbew behavioral1/memory/1848-141-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ntnhnn.exe family_berbew C:\vjjjp.exe family_berbew C:\rlxrxxl.exe family_berbew C:\7bbhtt.exe family_berbew behavioral1/memory/1328-175-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2136-178-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\pdvvp.exe family_berbew C:\hhbhtb.exe family_berbew behavioral1/memory/2136-185-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\lrlrllf.exe family_berbew behavioral1/memory/1052-197-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\fxrlxfr.exe family_berbew C:\jdjvd.exe family_berbew behavioral1/memory/836-213-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\1rlxllr.exe family_berbew behavioral1/memory/3032-222-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\9hhbth.exe family_berbew behavioral1/memory/1544-232-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\pjjjp.exe family_berbew C:\lfxflxf.exe family_berbew C:\9bhttb.exe family_berbew behavioral1/memory/1044-255-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\xxlrxfr.exe family_berbew behavioral1/memory/1996-265-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\ffrfllr.exe family_berbew behavioral1/memory/1952-274-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\jjddp.exe family_berbew behavioral1/memory/1928-284-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2980-309-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2008-316-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2008-323-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2928-324-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2992-333-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
tnbnnn.exepjvvd.exe5hhnbb.exeddppv.exefllfrxf.exebtbbbh.exexfllrfx.exebbnbth.exehbtthn.exe3ffrlxl.exebbhntt.exejdpdv.exexlrffrf.exejdvdp.exeppjjd.exentnhnn.exevjjjp.exerlxrxxl.exe7bbhtt.exepdvvp.exehhbhtb.exelrlrllf.exefxrlxfr.exejdjvd.exe1rlxllr.exe9hhbth.exepjjjp.exelfxflxf.exe9bhttb.exexxlrxfr.exeffrfllr.exejjddp.exejdddj.exelfrfllx.exebbthhh.exedjdjv.exerrxxxfl.exetnhntb.exeppdjv.exerfllrlx.exe1ntbht.exedvdjv.exefflxffr.exehnnbnt.exeddpvj.exeflxxllx.exe9xrfllx.exetnhhnn.exedpjjv.exexxxlrxl.exebbbhnn.exe9vdpj.exerllxfrl.exerxrffxl.exe7tnnbb.exedvjvj.exerlrlrrr.exe7ntntb.exejjvdp.exexxffffr.exehbtntb.exe9bbhnh.exevjjdp.exe1rfrxxl.exepid process 2000 tnbnnn.exe 2708 pjvvd.exe 2532 5hhnbb.exe 2684 ddppv.exe 2628 fllfrxf.exe 2376 btbbbh.exe 2564 xfllrfx.exe 2436 bbnbth.exe 1656 hbtthn.exe 2876 3ffrlxl.exe 2164 bbhntt.exe 2412 jdpdv.exe 916 xlrffrf.exe 384 jdvdp.exe 1848 ppjjd.exe 2212 ntnhnn.exe 2748 vjjjp.exe 2380 rlxrxxl.exe 1328 7bbhtt.exe 2136 pdvvp.exe 540 hhbhtb.exe 1052 lrlrllf.exe 836 fxrlxfr.exe 1528 jdjvd.exe 3032 1rlxllr.exe 1544 9hhbth.exe 956 pjjjp.exe 1044 lfxflxf.exe 496 9bhttb.exe 1996 xxlrxfr.exe 1952 ffrfllr.exe 1928 jjddp.exe 892 jdddj.exe 2824 lfrfllx.exe 2980 bbthhh.exe 2944 djdjv.exe 2008 rrxxxfl.exe 2928 tnhntb.exe 2992 ppdjv.exe 2580 rfllrlx.exe 2772 1ntbht.exe 2628 dvdjv.exe 2472 fflxffr.exe 2452 hnnbnt.exe 2476 ddpvj.exe 3024 flxxllx.exe 2856 9xrfllx.exe 2876 tnhhnn.exe 1624 dpjjv.exe 2516 xxxlrxl.exe 2200 bbbhnn.exe 916 9vdpj.exe 1808 rllxfrl.exe 380 rxrffxl.exe 996 7tnnbb.exe 2316 dvjvj.exe 2044 rlrlrrr.exe 1300 7ntntb.exe 1912 jjvdp.exe 2092 xxffffr.exe 692 hbtntb.exe 592 9bbhnh.exe 1476 vjjdp.exe 2400 1rfrxxl.exe -
Processes:
resource yara_rule behavioral1/memory/2972-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tnbnnn.exe upx behavioral1/memory/2000-8-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjvvd.exe upx behavioral1/memory/2000-16-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5hhnbb.exe upx behavioral1/memory/2532-26-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ddppv.exe upx behavioral1/memory/2684-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2532-35-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fllfrxf.exe upx behavioral1/memory/2628-53-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\btbbbh.exe upx behavioral1/memory/2376-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2376-62-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xfllrfx.exe upx C:\bbnbth.exe upx behavioral1/memory/2564-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2436-75-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hbtthn.exe upx C:\3ffrlxl.exe upx behavioral1/memory/1656-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2876-92-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bbhntt.exe upx C:\jdpdv.exe upx behavioral1/memory/2412-110-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xlrffrf.exe upx \??\c:\jdvdp.exe upx behavioral1/memory/916-126-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppjjd.exe upx behavioral1/memory/1848-141-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ntnhnn.exe upx C:\vjjjp.exe upx C:\rlxrxxl.exe upx C:\7bbhtt.exe upx behavioral1/memory/1328-175-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2136-178-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pdvvp.exe upx C:\hhbhtb.exe upx behavioral1/memory/2136-185-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lrlrllf.exe upx behavioral1/memory/1052-197-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrlxfr.exe upx C:\jdjvd.exe upx behavioral1/memory/836-213-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1rlxllr.exe upx behavioral1/memory/3032-222-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9hhbth.exe upx behavioral1/memory/1544-232-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjjjp.exe upx C:\lfxflxf.exe upx C:\9bhttb.exe upx behavioral1/memory/1044-255-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xxlrxfr.exe upx behavioral1/memory/1996-265-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ffrfllr.exe upx behavioral1/memory/1952-274-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jjddp.exe upx behavioral1/memory/1928-284-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2980-309-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2008-316-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2008-323-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2928-324-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2992-333-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exetnbnnn.exepjvvd.exe5hhnbb.exeddppv.exefllfrxf.exebtbbbh.exexfllrfx.exebbnbth.exehbtthn.exe3ffrlxl.exebbhntt.exejdpdv.exexlrffrf.exejdvdp.exeppjjd.exedescription pid process target process PID 2972 wrote to memory of 2000 2972 1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe tnbnnn.exe PID 2972 wrote to memory of 2000 2972 1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe tnbnnn.exe PID 2972 wrote to memory of 2000 2972 1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe tnbnnn.exe PID 2972 wrote to memory of 2000 2972 1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe tnbnnn.exe PID 2000 wrote to memory of 2708 2000 tnbnnn.exe pjvvd.exe PID 2000 wrote to memory of 2708 2000 tnbnnn.exe pjvvd.exe PID 2000 wrote to memory of 2708 2000 tnbnnn.exe pjvvd.exe PID 2000 wrote to memory of 2708 2000 tnbnnn.exe pjvvd.exe PID 2708 wrote to memory of 2532 2708 pjvvd.exe 5hhnbb.exe PID 2708 wrote to memory of 2532 2708 pjvvd.exe 5hhnbb.exe PID 2708 wrote to memory of 2532 2708 pjvvd.exe 5hhnbb.exe PID 2708 wrote to memory of 2532 2708 pjvvd.exe 5hhnbb.exe PID 2532 wrote to memory of 2684 2532 5hhnbb.exe ddppv.exe PID 2532 wrote to memory of 2684 2532 5hhnbb.exe ddppv.exe PID 2532 wrote to memory of 2684 2532 5hhnbb.exe ddppv.exe PID 2532 wrote to memory of 2684 2532 5hhnbb.exe ddppv.exe PID 2684 wrote to memory of 2628 2684 ddppv.exe fllfrxf.exe PID 2684 wrote to memory of 2628 2684 ddppv.exe fllfrxf.exe PID 2684 wrote to memory of 2628 2684 ddppv.exe fllfrxf.exe PID 2684 wrote to memory of 2628 2684 ddppv.exe fllfrxf.exe PID 2628 wrote to memory of 2376 2628 fllfrxf.exe btbbbh.exe PID 2628 wrote to memory of 2376 2628 fllfrxf.exe btbbbh.exe PID 2628 wrote to memory of 2376 2628 fllfrxf.exe btbbbh.exe PID 2628 wrote to memory of 2376 2628 fllfrxf.exe btbbbh.exe PID 2376 wrote to memory of 2564 2376 btbbbh.exe xfllrfx.exe PID 2376 wrote to memory of 2564 2376 btbbbh.exe xfllrfx.exe PID 2376 wrote to memory of 2564 2376 btbbbh.exe xfllrfx.exe PID 2376 wrote to memory of 2564 2376 btbbbh.exe xfllrfx.exe PID 2564 wrote to memory of 2436 2564 xfllrfx.exe bbnbth.exe PID 2564 wrote to memory of 2436 2564 xfllrfx.exe bbnbth.exe PID 2564 wrote to memory of 2436 2564 xfllrfx.exe bbnbth.exe PID 2564 wrote to memory of 2436 2564 xfllrfx.exe bbnbth.exe PID 2436 wrote to memory of 1656 2436 bbnbth.exe hbtthn.exe PID 2436 wrote to memory of 1656 2436 bbnbth.exe hbtthn.exe PID 2436 wrote to memory of 1656 2436 bbnbth.exe hbtthn.exe PID 2436 wrote to memory of 1656 2436 bbnbth.exe hbtthn.exe PID 1656 wrote to memory of 2876 1656 hbtthn.exe 3ffrlxl.exe PID 1656 wrote to memory of 2876 1656 hbtthn.exe 3ffrlxl.exe PID 1656 wrote to memory of 2876 1656 hbtthn.exe 3ffrlxl.exe PID 1656 wrote to memory of 2876 1656 hbtthn.exe 3ffrlxl.exe PID 2876 wrote to memory of 2164 2876 3ffrlxl.exe bbhntt.exe PID 2876 wrote to memory of 2164 2876 3ffrlxl.exe bbhntt.exe PID 2876 wrote to memory of 2164 2876 3ffrlxl.exe bbhntt.exe PID 2876 wrote to memory of 2164 2876 3ffrlxl.exe bbhntt.exe PID 2164 wrote to memory of 2412 2164 bbhntt.exe jdpdv.exe PID 2164 wrote to memory of 2412 2164 bbhntt.exe jdpdv.exe PID 2164 wrote to memory of 2412 2164 bbhntt.exe jdpdv.exe PID 2164 wrote to memory of 2412 2164 bbhntt.exe jdpdv.exe PID 2412 wrote to memory of 916 2412 jdpdv.exe xlrffrf.exe PID 2412 wrote to memory of 916 2412 jdpdv.exe xlrffrf.exe PID 2412 wrote to memory of 916 2412 jdpdv.exe xlrffrf.exe PID 2412 wrote to memory of 916 2412 jdpdv.exe xlrffrf.exe PID 916 wrote to memory of 384 916 xlrffrf.exe jdvdp.exe PID 916 wrote to memory of 384 916 xlrffrf.exe jdvdp.exe PID 916 wrote to memory of 384 916 xlrffrf.exe jdvdp.exe PID 916 wrote to memory of 384 916 xlrffrf.exe jdvdp.exe PID 384 wrote to memory of 1848 384 jdvdp.exe ppjjd.exe PID 384 wrote to memory of 1848 384 jdvdp.exe ppjjd.exe PID 384 wrote to memory of 1848 384 jdvdp.exe ppjjd.exe PID 384 wrote to memory of 1848 384 jdvdp.exe ppjjd.exe PID 1848 wrote to memory of 2212 1848 ppjjd.exe ntnhnn.exe PID 1848 wrote to memory of 2212 1848 ppjjd.exe ntnhnn.exe PID 1848 wrote to memory of 2212 1848 ppjjd.exe ntnhnn.exe PID 1848 wrote to memory of 2212 1848 ppjjd.exe ntnhnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1239f186c38b31a8a149c378ad5d9210_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tnbnnn.exec:\tnbnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\pjvvd.exec:\pjvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\5hhnbb.exec:\5hhnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ddppv.exec:\ddppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fllfrxf.exec:\fllfrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\btbbbh.exec:\btbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xfllrfx.exec:\xfllrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bbnbth.exec:\bbnbth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\hbtthn.exec:\hbtthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\3ffrlxl.exec:\3ffrlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bbhntt.exec:\bbhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jdpdv.exec:\jdpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xlrffrf.exec:\xlrffrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\jdvdp.exec:\jdvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\ppjjd.exec:\ppjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\ntnhnn.exec:\ntnhnn.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjjjp.exec:\vjjjp.exe18⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe19⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7bbhtt.exec:\7bbhtt.exe20⤵
- Executes dropped EXE
PID:1328 -
\??\c:\pdvvp.exec:\pdvvp.exe21⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhbhtb.exec:\hhbhtb.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\lrlrllf.exec:\lrlrllf.exe23⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe24⤵
- Executes dropped EXE
PID:836 -
\??\c:\jdjvd.exec:\jdjvd.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1rlxllr.exec:\1rlxllr.exe26⤵
- Executes dropped EXE
PID:3032 -
\??\c:\9hhbth.exec:\9hhbth.exe27⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pjjjp.exec:\pjjjp.exe28⤵
- Executes dropped EXE
PID:956 -
\??\c:\lfxflxf.exec:\lfxflxf.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9bhttb.exec:\9bhttb.exe30⤵
- Executes dropped EXE
PID:496 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe31⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ffrfllr.exec:\ffrfllr.exe32⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jjddp.exec:\jjddp.exe33⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdddj.exec:\jdddj.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\lfrfllx.exec:\lfrfllx.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bbthhh.exec:\bbthhh.exe36⤵
- Executes dropped EXE
PID:2980 -
\??\c:\djdjv.exec:\djdjv.exe37⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe38⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tnhntb.exec:\tnhntb.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ppdjv.exec:\ppdjv.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rfllrlx.exec:\rfllrlx.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1ntbht.exec:\1ntbht.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\dvdjv.exec:\dvdjv.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fflxffr.exec:\fflxffr.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\hnnbnt.exec:\hnnbnt.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ddpvj.exec:\ddpvj.exe46⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flxxllx.exec:\flxxllx.exe47⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9xrfllx.exec:\9xrfllx.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tnhhnn.exec:\tnhhnn.exe49⤵
- Executes dropped EXE
PID:2876 -
\??\c:\dpjjv.exec:\dpjjv.exe50⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe51⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bbbhnn.exec:\bbbhnn.exe52⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9vdpj.exec:\9vdpj.exe53⤵
- Executes dropped EXE
PID:916 -
\??\c:\rllxfrl.exec:\rllxfrl.exe54⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rxrffxl.exec:\rxrffxl.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\7tnnbb.exec:\7tnnbb.exe56⤵
- Executes dropped EXE
PID:996 -
\??\c:\dvjvj.exec:\dvjvj.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7ntntb.exec:\7ntntb.exe59⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jjvdp.exec:\jjvdp.exe60⤵
- Executes dropped EXE
PID:1912 -
\??\c:\xxffffr.exec:\xxffffr.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hbtntb.exec:\hbtntb.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\9bbhnh.exec:\9bbhnh.exe63⤵
- Executes dropped EXE
PID:592 -
\??\c:\vjjdp.exec:\vjjdp.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1rfrxxl.exec:\1rfrxxl.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\bbnhhh.exec:\bbnhhh.exe66⤵PID:1108
-
\??\c:\jjddd.exec:\jjddd.exe67⤵PID:2360
-
\??\c:\frrrxfx.exec:\frrrxfx.exe68⤵PID:2392
-
\??\c:\hbbnbb.exec:\hbbnbb.exe69⤵PID:1548
-
\??\c:\vpvjp.exec:\vpvjp.exe70⤵PID:612
-
\??\c:\vvpvd.exec:\vvpvd.exe71⤵PID:1644
-
\??\c:\xrffrrx.exec:\xrffrrx.exe72⤵PID:332
-
\??\c:\tthnbh.exec:\tthnbh.exe73⤵PID:2284
-
\??\c:\ddvjv.exec:\ddvjv.exe74⤵PID:2300
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe75⤵PID:2812
-
\??\c:\fxllxxl.exec:\fxllxxl.exe76⤵PID:1952
-
\??\c:\bnbbnb.exec:\bnbbnb.exe77⤵PID:3000
-
\??\c:\vpjpp.exec:\vpjpp.exe78⤵PID:992
-
\??\c:\lfflrxf.exec:\lfflrxf.exe79⤵PID:2280
-
\??\c:\btnbhh.exec:\btnbhh.exe80⤵PID:2080
-
\??\c:\ttnhnt.exec:\ttnhnt.exe81⤵PID:1944
-
\??\c:\5ppvd.exec:\5ppvd.exe82⤵PID:2932
-
\??\c:\fxllrrx.exec:\fxllrrx.exe83⤵PID:2100
-
\??\c:\tnhbnt.exec:\tnhbnt.exe84⤵PID:2660
-
\??\c:\thbhht.exec:\thbhht.exe85⤵PID:2992
-
\??\c:\5jddv.exec:\5jddv.exe86⤵PID:2640
-
\??\c:\1fllffx.exec:\1fllffx.exe87⤵PID:2528
-
\??\c:\nhtbnn.exec:\nhtbnn.exe88⤵PID:2744
-
\??\c:\3hnnnn.exec:\3hnnnn.exe89⤵PID:1720
-
\??\c:\3ddjp.exec:\3ddjp.exe90⤵PID:2428
-
\??\c:\fxllrfl.exec:\fxllrfl.exe91⤵PID:2456
-
\??\c:\xxfxflr.exec:\xxfxflr.exe92⤵PID:3056
-
\??\c:\1tntbb.exec:\1tntbb.exe93⤵PID:1696
-
\??\c:\3jvpp.exec:\3jvpp.exe94⤵PID:1616
-
\??\c:\flfflrf.exec:\flfflrf.exe95⤵PID:320
-
\??\c:\nhhnbh.exec:\nhhnbh.exe96⤵PID:2716
-
\??\c:\jjvjp.exec:\jjvjp.exe97⤵PID:764
-
\??\c:\pjddj.exec:\pjddj.exe98⤵PID:1716
-
\??\c:\5flrxlx.exec:\5flrxlx.exe99⤵PID:1676
-
\??\c:\tthnhh.exec:\tthnhh.exe100⤵PID:1740
-
\??\c:\pvvpj.exec:\pvvpj.exe101⤵PID:1920
-
\??\c:\jddjv.exec:\jddjv.exe102⤵PID:2172
-
\??\c:\xrflrrx.exec:\xrflrrx.exe103⤵PID:1396
-
\??\c:\tbnntb.exec:\tbnntb.exe104⤵PID:1324
-
\??\c:\pvpdp.exec:\pvpdp.exe105⤵PID:632
-
\??\c:\pjddp.exec:\pjddp.exe106⤵PID:336
-
\??\c:\lrfflrf.exec:\lrfflrf.exe107⤵PID:2308
-
\??\c:\thhhtn.exec:\thhhtn.exe108⤵PID:840
-
\??\c:\1jddd.exec:\1jddd.exe109⤵PID:912
-
\??\c:\xxflrrr.exec:\xxflrrr.exe110⤵PID:1820
-
\??\c:\rffxxrr.exec:\rffxxrr.exe111⤵PID:1736
-
\??\c:\hthnhn.exec:\hthnhn.exe112⤵PID:3040
-
\??\c:\bnbbbt.exec:\bnbbbt.exe113⤵PID:1776
-
\??\c:\jjddd.exec:\jjddd.exe114⤵PID:1544
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe115⤵PID:1764
-
\??\c:\hthhhh.exec:\hthhhh.exe116⤵PID:2808
-
\??\c:\nnhttb.exec:\nnhttb.exe117⤵PID:1044
-
\??\c:\pjdjp.exec:\pjdjp.exe118⤵PID:332
-
\??\c:\xrlllff.exec:\xrlllff.exe119⤵PID:1112
-
\??\c:\rrllllr.exec:\rrllllr.exe120⤵PID:1960
-
\??\c:\bhnhnn.exec:\bhnhnn.exe121⤵PID:2144
-
\??\c:\rlxfxfl.exec:\rlxfxfl.exe122⤵PID:1236
-
\??\c:\nbnthn.exec:\nbnthn.exe123⤵PID:3000
-
\??\c:\7httbt.exec:\7httbt.exe124⤵PID:1280
-
\??\c:\9pppp.exec:\9pppp.exe125⤵PID:1712
-
\??\c:\dvppp.exec:\dvppp.exe126⤵PID:1568
-
\??\c:\1rlxxxf.exec:\1rlxxxf.exe127⤵PID:2000
-
\??\c:\nnhtht.exec:\nnhtht.exe128⤵PID:2016
-
\??\c:\bnbnnn.exec:\bnbnnn.exe129⤵PID:2664
-
\??\c:\5djjv.exec:\5djjv.exe130⤵PID:2536
-
\??\c:\lxrfrxx.exec:\lxrfrxx.exe131⤵PID:2580
-
\??\c:\xxllxxl.exec:\xxllxxl.exe132⤵PID:2560
-
\??\c:\9hnntt.exec:\9hnntt.exe133⤵PID:2528
-
\??\c:\dvjpp.exec:\dvjpp.exe134⤵PID:2464
-
\??\c:\9frxxxf.exec:\9frxxxf.exe135⤵PID:1720
-
\??\c:\lfrxflr.exec:\lfrxflr.exe136⤵PID:2436
-
\??\c:\3nhnbb.exec:\3nhnbb.exe137⤵PID:1316
-
\??\c:\vpjjv.exec:\vpjjv.exe138⤵PID:1656
-
\??\c:\lxlrxlx.exec:\lxlrxlx.exe139⤵PID:1580
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe140⤵PID:2668
-
\??\c:\bbnbbh.exec:\bbnbbh.exe141⤵PID:320
-
\??\c:\vjvjv.exec:\vjvjv.exe142⤵PID:2672
-
\??\c:\djdvd.exec:\djdvd.exe143⤵PID:764
-
\??\c:\1lxflrf.exec:\1lxflrf.exe144⤵PID:768
-
\??\c:\tnnhtn.exec:\tnnhtn.exe145⤵PID:2216
-
\??\c:\pdvjp.exec:\pdvjp.exe146⤵PID:2212
-
\??\c:\fxxflll.exec:\fxxflll.exe147⤵PID:2240
-
\??\c:\fxfxxfl.exec:\fxfxxfl.exe148⤵PID:1516
-
\??\c:\hbtntt.exec:\hbtntt.exe149⤵PID:2044
-
\??\c:\hbhnbb.exec:\hbhnbb.exe150⤵PID:2976
-
\??\c:\3pvjj.exec:\3pvjj.exe151⤵PID:2800
-
\??\c:\rxrxllx.exec:\rxrxllx.exe152⤵PID:560
-
\??\c:\xxrlfrf.exec:\xxrlfrf.exe153⤵PID:1640
-
\??\c:\bbtnbh.exec:\bbtnbh.exe154⤵PID:1812
-
\??\c:\7pdjj.exec:\7pdjj.exe155⤵PID:1476
-
\??\c:\vpddj.exec:\vpddj.exe156⤵PID:836
-
\??\c:\xxlffxx.exec:\xxlffxx.exe157⤵PID:3044
-
\??\c:\hbbhnb.exec:\hbbhnb.exe158⤵PID:3020
-
\??\c:\hbntbb.exec:\hbntbb.exe159⤵PID:2372
-
\??\c:\vpvvd.exec:\vpvvd.exe160⤵PID:1364
-
\??\c:\xfxxrxl.exec:\xfxxrxl.exe161⤵PID:1964
-
\??\c:\nhbhtt.exec:\nhbhtt.exe162⤵PID:1816
-
\??\c:\7jjjj.exec:\7jjjj.exe163⤵PID:1872
-
\??\c:\pvdjp.exec:\pvdjp.exe164⤵PID:1996
-
\??\c:\fxrxffr.exec:\fxrxffr.exe165⤵PID:1752
-
\??\c:\rlfrffl.exec:\rlfrffl.exe166⤵PID:2812
-
\??\c:\7htthb.exec:\7htthb.exe167⤵PID:2192
-
\??\c:\pvvdv.exec:\pvvdv.exe168⤵PID:2328
-
\??\c:\vjvdv.exec:\vjvdv.exe169⤵PID:2096
-
\??\c:\1xflfrf.exec:\1xflfrf.exe170⤵PID:3016
-
\??\c:\nhhbnt.exec:\nhhbnt.exe171⤵PID:2824
-
\??\c:\tnbhbh.exec:\tnbhbh.exe172⤵PID:2960
-
\??\c:\dppdv.exec:\dppdv.exe173⤵PID:3052
-
\??\c:\3rfxxrf.exec:\3rfxxrf.exe174⤵PID:2112
-
\??\c:\ttntnb.exec:\ttntnb.exe175⤵PID:2000
-
\??\c:\bhbbnt.exec:\bhbbnt.exe176⤵PID:2532
-
\??\c:\vvppj.exec:\vvppj.exe177⤵PID:2432
-
\??\c:\9frrxxl.exec:\9frrxxl.exe178⤵PID:2660
-
\??\c:\rlllxlx.exec:\rlllxlx.exe179⤵PID:2580
-
\??\c:\ttnttb.exec:\ttnttb.exe180⤵PID:2640
-
\??\c:\jvvdj.exec:\jvvdj.exe181⤵PID:2528
-
\??\c:\1jjpd.exec:\1jjpd.exe182⤵PID:2744
-
\??\c:\rrrxfxf.exec:\rrrxfxf.exe183⤵PID:1720
-
\??\c:\nhtnbb.exec:\nhtnbb.exe184⤵PID:2420
-
\??\c:\7jjpd.exec:\7jjpd.exe185⤵PID:2456
-
\??\c:\pddvd.exec:\pddvd.exe186⤵PID:300
-
\??\c:\lfxlxrf.exec:\lfxlxrf.exe187⤵PID:1220
-
\??\c:\bnbbhb.exec:\bnbbhb.exe188⤵PID:2496
-
\??\c:\bhhntb.exec:\bhhntb.exe189⤵PID:2012
-
\??\c:\9pppd.exec:\9pppd.exe190⤵PID:1652
-
\??\c:\fllxfrx.exec:\fllxfrx.exe191⤵PID:2720
-
\??\c:\nbtthn.exec:\nbtthn.exe192⤵PID:1980
-
\??\c:\5pjjp.exec:\5pjjp.exe193⤵PID:2348
-
\??\c:\jvvvv.exec:\jvvvv.exe194⤵PID:2320
-
\??\c:\rxrfxlx.exec:\rxrfxlx.exe195⤵PID:888
-
\??\c:\lfxxfff.exec:\lfxxfff.exe196⤵PID:296
-
\??\c:\tbthbh.exec:\tbthbh.exe197⤵PID:1312
-
\??\c:\dpjjv.exec:\dpjjv.exe198⤵PID:1324
-
\??\c:\vdpjp.exec:\vdpjp.exe199⤵PID:632
-
\??\c:\lfxxxlr.exec:\lfxxxlr.exe200⤵PID:336
-
\??\c:\frlrflx.exec:\frlrflx.exe201⤵PID:1052
-
\??\c:\nnhnbh.exec:\nnhnbh.exe202⤵PID:840
-
\??\c:\djjpd.exec:\djjpd.exe203⤵PID:2400
-
\??\c:\fxlxllr.exec:\fxlxllr.exe204⤵PID:2396
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe205⤵PID:1736
-
\??\c:\tbhbtb.exec:\tbhbtb.exe206⤵PID:348
-
\??\c:\ddvjp.exec:\ddvjp.exe207⤵PID:1548
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe208⤵PID:612
-
\??\c:\lllxlrr.exec:\lllxlrr.exe209⤵PID:1544
-
\??\c:\hnhnnh.exec:\hnhnnh.exe210⤵PID:1964
-
\??\c:\pdpvj.exec:\pdpvj.exe211⤵PID:1276
-
\??\c:\3rllllr.exec:\3rllllr.exe212⤵PID:1872
-
\??\c:\7hbttt.exec:\7hbttt.exe213⤵PID:1996
-
\??\c:\tnhnbh.exec:\tnhnbh.exe214⤵PID:2300
-
\??\c:\vdpvd.exec:\vdpvd.exe215⤵PID:2176
-
\??\c:\3fxxxxx.exec:\3fxxxxx.exe216⤵PID:2192
-
\??\c:\bbnnnb.exec:\bbnnnb.exe217⤵PID:1928
-
\??\c:\3jvjp.exec:\3jvjp.exe218⤵PID:3000
-
\??\c:\9vppp.exec:\9vppp.exe219⤵PID:1280
-
\??\c:\xlxxflr.exec:\xlxxflr.exe220⤵PID:1596
-
\??\c:\hbtthh.exec:\hbtthh.exe221⤵PID:3068
-
\??\c:\hnhhtb.exec:\hnhhtb.exe222⤵PID:2152
-
\??\c:\pjjvv.exec:\pjjvv.exe223⤵PID:2932
-
\??\c:\jdvdj.exec:\jdvdj.exe224⤵PID:2644
-
\??\c:\lfxllll.exec:\lfxllll.exe225⤵PID:2784
-
\??\c:\bbnbtb.exec:\bbnbtb.exe226⤵PID:2588
-
\??\c:\pdvdp.exec:\pdvdp.exe227⤵PID:2620
-
\??\c:\3vdjp.exec:\3vdjp.exe228⤵PID:2628
-
\??\c:\xxrxllx.exec:\xxrxllx.exe229⤵PID:2624
-
\??\c:\bnbbbh.exec:\bnbbbh.exe230⤵PID:2484
-
\??\c:\btnnbb.exec:\btnnbb.exe231⤵PID:2468
-
\??\c:\vpjdp.exec:\vpjdp.exe232⤵PID:2908
-
\??\c:\9xlfrrf.exec:\9xlfrrf.exe233⤵PID:1632
-
\??\c:\hbnnbh.exec:\hbnnbh.exe234⤵PID:2164
-
\??\c:\7tnhnn.exec:\7tnhnn.exe235⤵PID:1804
-
\??\c:\5pdvv.exec:\5pdvv.exe236⤵PID:1784
-
\??\c:\pjddj.exec:\pjddj.exe237⤵PID:2496
-
\??\c:\frlflff.exec:\frlflff.exe238⤵PID:2012
-
\??\c:\7hbhnn.exec:\7hbhnn.exe239⤵PID:1808
-
\??\c:\vddpj.exec:\vddpj.exe240⤵PID:1032
-
\??\c:\pjpjp.exec:\pjpjp.exe241⤵PID:1748
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe242⤵PID:796