Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:53
Behavioral task
behavioral1
Sample
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe
-
Size
329KB
-
MD5
1b0d9c6ed23852de54ff9e18db778470
-
SHA1
b444e900fc5ab31a71564519bc3f00e84ebd9e9a
-
SHA256
9b256baffab58b009b05489e753e2c8aa8141411113c75d87fdc956a2070d87c
-
SHA512
ccd49b0566ed5ced043affcdbd8477883138406af7c7fc37dc0aae7be8e7a08a6c7f22211cbe00a6f3d65d6f400a4e374bca0716d8198256b191dc247413a337
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhh:F7Tc8JdSjylh2b77BoTMA9gX59sTsuTR
Malware Config
Signatures
-
Detect Blackmoon payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/892-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-141-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1632-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-804-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\ffffxrf.exe family_berbew \??\c:\ppvvp.exe family_berbew \??\c:\rlfxlrx.exe family_berbew C:\ttnbnh.exe family_berbew C:\llflfrx.exe family_berbew \??\c:\tnhtbn.exe family_berbew \??\c:\dvpvj.exe family_berbew \??\c:\7xllxxf.exe family_berbew C:\9tnhnb.exe family_berbew \??\c:\vdvvp.exe family_berbew C:\ffrlrfx.exe family_berbew \??\c:\pvvjv.exe family_berbew \??\c:\fffrlrl.exe family_berbew C:\jjdpv.exe family_berbew \??\c:\nnbntt.exe family_berbew \??\c:\nnhttb.exe family_berbew C:\jpjvj.exe family_berbew C:\ffxfrxl.exe family_berbew C:\btbhhn.exe family_berbew \??\c:\5frrrlx.exe family_berbew C:\htthbt.exe family_berbew \??\c:\lrfrflx.exe family_berbew C:\7hbttt.exe family_berbew C:\jjjjp.exe family_berbew C:\3xxlrff.exe family_berbew C:\tnbbtb.exe family_berbew C:\dvppd.exe family_berbew \??\c:\hhbhth.exe family_berbew C:\1ntbnt.exe family_berbew C:\xxrxxxl.exe family_berbew C:\tbthth.exe family_berbew C:\dvvjp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ffffxrf.exeppvvp.exerlfxlrx.exettnbnh.exellflfrx.exetnhtbn.exedvpvj.exe7xllxxf.exe9tnhnb.exevdvvp.exeffrlrfx.exepvvjv.exefffrlrl.exennbntt.exejjdpv.exennhttb.exejpjvj.exeffxfrxl.exebtbhhn.exe5frrrlx.exehtthbt.exelrfrflx.exe7hbttt.exejjjjp.exe3xxlrff.exetnbbtb.exedvppd.exehhbhth.exe1ntbnt.exexxrxxxl.exetbthth.exedvvjp.exe9lfxflf.exebnhhnn.exennhbnh.exejdpvd.exe9rlxxfx.exenhtbnn.exetnhbtn.exedvpdv.exelxrlxxf.exe7xlrflf.exetththn.exevvpvj.exedjjpj.exellflxfx.exefxfflrx.exetnbhtb.exeddvjj.exerrlrxlf.exexrflrxf.exehhtbtb.exejjvvd.exe9pjdd.exerxrrlfx.exehhnhhb.exebtnhhh.exevpjvj.exerfrrflx.exebhbhnt.exebhnbhn.exejjjvp.exe7xflxfr.exeffrxrxf.exepid process 1740 ffffxrf.exe 3048 ppvvp.exe 1648 rlfxlrx.exe 2840 ttnbnh.exe 2636 llflfrx.exe 2284 tnhtbn.exe 2640 dvpvj.exe 2504 7xllxxf.exe 2624 9tnhnb.exe 3008 vdvvp.exe 2724 ffrlrfx.exe 2832 pvvjv.exe 892 fffrlrl.exe 1800 nnbntt.exe 1632 jjdpv.exe 1640 nnhttb.exe 2560 jpjvj.exe 852 ffxfrxl.exe 2600 btbhhn.exe 2096 5frrrlx.exe 988 htthbt.exe 2396 lrfrflx.exe 296 7hbttt.exe 1168 jjjjp.exe 2380 3xxlrff.exe 1324 tnbbtb.exe 1376 dvppd.exe 328 hhbhth.exe 900 1ntbnt.exe 1948 xxrxxxl.exe 568 tbthth.exe 2976 dvvjp.exe 1512 9lfxflf.exe 1056 bnhhnn.exe 1440 nnhbnh.exe 1944 jdpvd.exe 2028 9rlxxfx.exe 3068 nhtbnn.exe 2768 tnhbtn.exe 2804 dvpdv.exe 2628 lxrlxxf.exe 2160 7xlrflf.exe 2536 tththn.exe 3016 vvpvj.exe 2524 djjpj.exe 2532 llflxfx.exe 2224 fxfflrx.exe 2556 tnbhtb.exe 3008 ddvjj.exe 2732 rrlrxlf.exe 2868 xrflrxf.exe 1576 hhtbtb.exe 2168 jjvvd.exe 1248 9pjdd.exe 2220 rxrrlfx.exe 1816 hhnhhb.exe 2412 btnhhh.exe 1436 vpjvj.exe 1504 rfrrflx.exe 1360 bhbhnt.exe 1980 bhnbhn.exe 2692 jjjvp.exe 772 7xflxfr.exe 584 ffrxrxf.exe -
Processes:
resource yara_rule behavioral1/memory/1936-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-194-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/988-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1324-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1077-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-1334-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exeffffxrf.exeppvvp.exerlfxlrx.exettnbnh.exellflfrx.exetnhtbn.exedvpvj.exe7xllxxf.exe9tnhnb.exevdvvp.exeffrlrfx.exepvvjv.exefffrlrl.exennbntt.exejjdpv.exedescription pid process target process PID 1936 wrote to memory of 1740 1936 1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe ffffxrf.exe PID 1936 wrote to memory of 1740 1936 1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe ffffxrf.exe PID 1936 wrote to memory of 1740 1936 1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe ffffxrf.exe PID 1936 wrote to memory of 1740 1936 1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe ffffxrf.exe PID 1740 wrote to memory of 3048 1740 ffffxrf.exe ppvvp.exe PID 1740 wrote to memory of 3048 1740 ffffxrf.exe ppvvp.exe PID 1740 wrote to memory of 3048 1740 ffffxrf.exe ppvvp.exe PID 1740 wrote to memory of 3048 1740 ffffxrf.exe ppvvp.exe PID 3048 wrote to memory of 1648 3048 ppvvp.exe rlfxlrx.exe PID 3048 wrote to memory of 1648 3048 ppvvp.exe rlfxlrx.exe PID 3048 wrote to memory of 1648 3048 ppvvp.exe rlfxlrx.exe PID 3048 wrote to memory of 1648 3048 ppvvp.exe rlfxlrx.exe PID 1648 wrote to memory of 2840 1648 rlfxlrx.exe ttnbnh.exe PID 1648 wrote to memory of 2840 1648 rlfxlrx.exe ttnbnh.exe PID 1648 wrote to memory of 2840 1648 rlfxlrx.exe ttnbnh.exe PID 1648 wrote to memory of 2840 1648 rlfxlrx.exe ttnbnh.exe PID 2840 wrote to memory of 2636 2840 ttnbnh.exe llflfrx.exe PID 2840 wrote to memory of 2636 2840 ttnbnh.exe llflfrx.exe PID 2840 wrote to memory of 2636 2840 ttnbnh.exe llflfrx.exe PID 2840 wrote to memory of 2636 2840 ttnbnh.exe llflfrx.exe PID 2636 wrote to memory of 2284 2636 llflfrx.exe tnhtbn.exe PID 2636 wrote to memory of 2284 2636 llflfrx.exe tnhtbn.exe PID 2636 wrote to memory of 2284 2636 llflfrx.exe tnhtbn.exe PID 2636 wrote to memory of 2284 2636 llflfrx.exe tnhtbn.exe PID 2284 wrote to memory of 2640 2284 tnhtbn.exe dvpvj.exe PID 2284 wrote to memory of 2640 2284 tnhtbn.exe dvpvj.exe PID 2284 wrote to memory of 2640 2284 tnhtbn.exe dvpvj.exe PID 2284 wrote to memory of 2640 2284 tnhtbn.exe dvpvj.exe PID 2640 wrote to memory of 2504 2640 dvpvj.exe 7xllxxf.exe PID 2640 wrote to memory of 2504 2640 dvpvj.exe 7xllxxf.exe PID 2640 wrote to memory of 2504 2640 dvpvj.exe 7xllxxf.exe PID 2640 wrote to memory of 2504 2640 dvpvj.exe 7xllxxf.exe PID 2504 wrote to memory of 2624 2504 7xllxxf.exe 9tnhnb.exe PID 2504 wrote to memory of 2624 2504 7xllxxf.exe 9tnhnb.exe PID 2504 wrote to memory of 2624 2504 7xllxxf.exe 9tnhnb.exe PID 2504 wrote to memory of 2624 2504 7xllxxf.exe 9tnhnb.exe PID 2624 wrote to memory of 3008 2624 9tnhnb.exe vdvvp.exe PID 2624 wrote to memory of 3008 2624 9tnhnb.exe vdvvp.exe PID 2624 wrote to memory of 3008 2624 9tnhnb.exe vdvvp.exe PID 2624 wrote to memory of 3008 2624 9tnhnb.exe vdvvp.exe PID 3008 wrote to memory of 2724 3008 vdvvp.exe ffrlrfx.exe PID 3008 wrote to memory of 2724 3008 vdvvp.exe ffrlrfx.exe PID 3008 wrote to memory of 2724 3008 vdvvp.exe ffrlrfx.exe PID 3008 wrote to memory of 2724 3008 vdvvp.exe ffrlrfx.exe PID 2724 wrote to memory of 2832 2724 ffrlrfx.exe pvvjv.exe PID 2724 wrote to memory of 2832 2724 ffrlrfx.exe pvvjv.exe PID 2724 wrote to memory of 2832 2724 ffrlrfx.exe pvvjv.exe PID 2724 wrote to memory of 2832 2724 ffrlrfx.exe pvvjv.exe PID 2832 wrote to memory of 892 2832 pvvjv.exe fffrlrl.exe PID 2832 wrote to memory of 892 2832 pvvjv.exe fffrlrl.exe PID 2832 wrote to memory of 892 2832 pvvjv.exe fffrlrl.exe PID 2832 wrote to memory of 892 2832 pvvjv.exe fffrlrl.exe PID 892 wrote to memory of 1800 892 fffrlrl.exe nnbntt.exe PID 892 wrote to memory of 1800 892 fffrlrl.exe nnbntt.exe PID 892 wrote to memory of 1800 892 fffrlrl.exe nnbntt.exe PID 892 wrote to memory of 1800 892 fffrlrl.exe nnbntt.exe PID 1800 wrote to memory of 1632 1800 nnbntt.exe jjdpv.exe PID 1800 wrote to memory of 1632 1800 nnbntt.exe jjdpv.exe PID 1800 wrote to memory of 1632 1800 nnbntt.exe jjdpv.exe PID 1800 wrote to memory of 1632 1800 nnbntt.exe jjdpv.exe PID 1632 wrote to memory of 1640 1632 jjdpv.exe nnhttb.exe PID 1632 wrote to memory of 1640 1632 jjdpv.exe nnhttb.exe PID 1632 wrote to memory of 1640 1632 jjdpv.exe nnhttb.exe PID 1632 wrote to memory of 1640 1632 jjdpv.exe nnhttb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1b0d9c6ed23852de54ff9e18db778470_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\ffffxrf.exec:\ffffxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\ppvvp.exec:\ppvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\ttnbnh.exec:\ttnbnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\llflfrx.exec:\llflfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tnhtbn.exec:\tnhtbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\dvpvj.exec:\dvpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7xllxxf.exec:\7xllxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\9tnhnb.exec:\9tnhnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\vdvvp.exec:\vdvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\ffrlrfx.exec:\ffrlrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pvvjv.exec:\pvvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fffrlrl.exec:\fffrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\nnbntt.exec:\nnbntt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\jjdpv.exec:\jjdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\nnhttb.exec:\nnhttb.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jpjvj.exec:\jpjvj.exe18⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe19⤵
- Executes dropped EXE
PID:852 -
\??\c:\btbhhn.exec:\btbhhn.exe20⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5frrrlx.exec:\5frrrlx.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\htthbt.exec:\htthbt.exe22⤵
- Executes dropped EXE
PID:988 -
\??\c:\lrfrflx.exec:\lrfrflx.exe23⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7hbttt.exec:\7hbttt.exe24⤵
- Executes dropped EXE
PID:296 -
\??\c:\jjjjp.exec:\jjjjp.exe25⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3xxlrff.exec:\3xxlrff.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnbbtb.exec:\tnbbtb.exe27⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dvppd.exec:\dvppd.exe28⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hhbhth.exec:\hhbhth.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\1ntbnt.exec:\1ntbnt.exe30⤵
- Executes dropped EXE
PID:900 -
\??\c:\xxrxxxl.exec:\xxrxxxl.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tbthth.exec:\tbthth.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\dvvjp.exec:\dvvjp.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9lfxflf.exec:\9lfxflf.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnhhnn.exec:\bnhhnn.exe35⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nnhbnh.exec:\nnhbnh.exe36⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jdpvd.exec:\jdpvd.exe37⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9rlxxfx.exec:\9rlxxfx.exe38⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nhtbnn.exec:\nhtbnn.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\tnhbtn.exec:\tnhbtn.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvpdv.exec:\dvpdv.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\lxrlxxf.exec:\lxrlxxf.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\7xlrflf.exec:\7xlrflf.exe43⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tththn.exec:\tththn.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\vvpvj.exec:\vvpvj.exe45⤵
- Executes dropped EXE
PID:3016 -
\??\c:\djjpj.exec:\djjpj.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llflxfx.exec:\llflxfx.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fxfflrx.exec:\fxfflrx.exe48⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tnbhtb.exec:\tnbhtb.exe49⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddvjj.exec:\ddvjj.exe50⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrlrxlf.exec:\rrlrxlf.exe51⤵
- Executes dropped EXE
PID:2732 -
\??\c:\xrflrxf.exec:\xrflrxf.exe52⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hhtbtb.exec:\hhtbtb.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\jjvvd.exec:\jjvvd.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9pjdd.exec:\9pjdd.exe55⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rxrrlfx.exec:\rxrrlfx.exe56⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhnhhb.exec:\hhnhhb.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\btnhhh.exec:\btnhhh.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vpjvj.exec:\vpjvj.exe59⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rfrrflx.exec:\rfrrflx.exe60⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bhbhnt.exec:\bhbhnt.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\bhnbhn.exec:\bhnbhn.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjjvp.exec:\jjjvp.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7xflxfr.exec:\7xflxfr.exe64⤵
- Executes dropped EXE
PID:772 -
\??\c:\ffrxrxf.exec:\ffrxrxf.exe65⤵
- Executes dropped EXE
PID:584 -
\??\c:\nthtth.exec:\nthtth.exe66⤵PID:2164
-
\??\c:\3vjjp.exec:\3vjjp.exe67⤵PID:648
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe68⤵PID:1820
-
\??\c:\rxlfrxf.exec:\rxlfrxf.exe69⤵PID:2356
-
\??\c:\hhbnht.exec:\hhbnht.exe70⤵PID:1836
-
\??\c:\pjjjd.exec:\pjjjd.exe71⤵PID:1776
-
\??\c:\3xfrlxr.exec:\3xfrlxr.exe72⤵PID:1628
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe73⤵PID:2252
-
\??\c:\hbhhtb.exec:\hbhhtb.exe74⤵PID:1304
-
\??\c:\jpjpp.exec:\jpjpp.exe75⤵PID:688
-
\??\c:\pvvvd.exec:\pvvvd.exe76⤵PID:2216
-
\??\c:\1lxxffr.exec:\1lxxffr.exe77⤵PID:2404
-
\??\c:\7ntbhh.exec:\7ntbhh.exe78⤵PID:568
-
\??\c:\5vpvp.exec:\5vpvp.exe79⤵PID:888
-
\??\c:\jdpvd.exec:\jdpvd.exe80⤵PID:1512
-
\??\c:\lllflfr.exec:\lllflfr.exe81⤵PID:1056
-
\??\c:\hhtbnh.exec:\hhtbnh.exe82⤵PID:1736
-
\??\c:\jjvdp.exec:\jjvdp.exe83⤵PID:2684
-
\??\c:\pjvvj.exec:\pjvvj.exe84⤵PID:2148
-
\??\c:\llxrlrx.exec:\llxrlrx.exe85⤵PID:2612
-
\??\c:\tnhnbh.exec:\tnhnbh.exe86⤵PID:2052
-
\??\c:\hnnbbt.exec:\hnnbbt.exe87⤵PID:2916
-
\??\c:\jjddp.exec:\jjddp.exe88⤵PID:2272
-
\??\c:\xrxxlrf.exec:\xrxxlrf.exe89⤵PID:2880
-
\??\c:\btttbh.exec:\btttbh.exe90⤵PID:2672
-
\??\c:\hbtbnn.exec:\hbtbnn.exe91⤵PID:2520
-
\??\c:\jdjpd.exec:\jdjpd.exe92⤵PID:2504
-
\??\c:\rlfxlxl.exec:\rlfxlxl.exe93⤵PID:2568
-
\??\c:\5xrfrxl.exec:\5xrfrxl.exe94⤵PID:496
-
\??\c:\hnhbnt.exec:\hnhbnt.exe95⤵PID:2708
-
\??\c:\vjjpd.exec:\vjjpd.exe96⤵PID:2740
-
\??\c:\1fxxfff.exec:\1fxxfff.exe97⤵PID:2696
-
\??\c:\1lxrrxl.exec:\1lxrrxl.exe98⤵PID:1536
-
\??\c:\bnhtbn.exec:\bnhtbn.exe99⤵PID:1788
-
\??\c:\1btbnt.exec:\1btbnt.exe100⤵PID:1236
-
\??\c:\1ppvj.exec:\1ppvj.exe101⤵PID:1784
-
\??\c:\5fflxxf.exec:\5fflxxf.exe102⤵PID:2464
-
\??\c:\lxfxffr.exec:\lxfxffr.exe103⤵PID:3004
-
\??\c:\btbhnn.exec:\btbhnn.exe104⤵PID:2412
-
\??\c:\9hhhnt.exec:\9hhhnt.exe105⤵PID:1436
-
\??\c:\dvvjv.exec:\dvvjv.exe106⤵PID:2084
-
\??\c:\lfrlxfx.exec:\lfrlxfx.exe107⤵PID:1360
-
\??\c:\tnbhnt.exec:\tnbhnt.exe108⤵PID:1980
-
\??\c:\djdpj.exec:\djdpj.exe109⤵PID:2692
-
\??\c:\jdjpj.exec:\jdjpj.exe110⤵PID:1488
-
\??\c:\1fxrlfl.exec:\1fxrlfl.exe111⤵PID:584
-
\??\c:\llfrlxl.exec:\llfrlxl.exe112⤵PID:1792
-
\??\c:\ttnbhn.exec:\ttnbhn.exe113⤵PID:1264
-
\??\c:\dvdvv.exec:\dvdvv.exe114⤵PID:1168
-
\??\c:\flxrlrf.exec:\flxrlrf.exe115⤵PID:2356
-
\??\c:\1frrlll.exec:\1frrlll.exe116⤵PID:1780
-
\??\c:\7nbntn.exec:\7nbntn.exe117⤵PID:1544
-
\??\c:\tnhntb.exec:\tnhntb.exe118⤵PID:1376
-
\??\c:\9dvdj.exec:\9dvdj.exe119⤵PID:328
-
\??\c:\rlflxfl.exec:\rlflxfl.exe120⤵PID:1660
-
\??\c:\xrlrxlx.exec:\xrlrxlx.exe121⤵PID:1600
-
\??\c:\bttbhh.exec:\bttbhh.exe122⤵PID:1964
-
\??\c:\jjdvd.exec:\jjdvd.exe123⤵PID:2032
-
\??\c:\dvppd.exec:\dvppd.exe124⤵PID:1852
-
\??\c:\ffxlrfl.exec:\ffxlrfl.exe125⤵PID:2256
-
\??\c:\bbnhtt.exec:\bbnhtt.exe126⤵PID:2152
-
\??\c:\5hthth.exec:\5hthth.exe127⤵PID:1720
-
\??\c:\3vjjv.exec:\3vjjv.exe128⤵PID:2456
-
\??\c:\dvppd.exec:\dvppd.exe129⤵PID:2584
-
\??\c:\xxxlrfr.exec:\xxxlrfr.exe130⤵PID:2648
-
\??\c:\btnbhh.exec:\btnbhh.exe131⤵PID:3064
-
\??\c:\bthnhh.exec:\bthnhh.exe132⤵PID:2656
-
\??\c:\7pjpd.exec:\7pjpd.exe133⤵PID:2052
-
\??\c:\7xrrxxf.exec:\7xrrxxf.exe134⤵PID:2620
-
\??\c:\llxxfll.exec:\llxxfll.exe135⤵PID:2508
-
\??\c:\httttn.exec:\httttn.exe136⤵PID:2636
-
\??\c:\vvjvp.exec:\vvjvp.exe137⤵PID:2500
-
\??\c:\llfxflf.exec:\llfxflf.exe138⤵PID:2616
-
\??\c:\hhtbht.exec:\hhtbht.exe139⤵PID:2580
-
\??\c:\1tnttt.exec:\1tnttt.exe140⤵PID:344
-
\??\c:\dvvvd.exec:\dvvvd.exe141⤵PID:496
-
\??\c:\5vvvv.exec:\5vvvv.exe142⤵PID:2708
-
\??\c:\5lfrllx.exec:\5lfrllx.exe143⤵PID:2740
-
\??\c:\ffrxffr.exec:\ffrxffr.exe144⤵PID:2696
-
\??\c:\1nbtnt.exec:\1nbtnt.exe145⤵PID:1536
-
\??\c:\7jdpv.exec:\7jdpv.exe146⤵PID:1788
-
\??\c:\jdddj.exec:\jdddj.exe147⤵PID:288
-
\??\c:\lrlxxrx.exec:\lrlxxrx.exe148⤵PID:1784
-
\??\c:\tntbnn.exec:\tntbnn.exe149⤵PID:1636
-
\??\c:\tthhtb.exec:\tthhtb.exe150⤵PID:1520
-
\??\c:\3jvjp.exec:\3jvjp.exe151⤵PID:1200
-
\??\c:\pjpjp.exec:\pjpjp.exe152⤵PID:1504
-
\??\c:\9xlflrf.exec:\9xlflrf.exe153⤵PID:1316
-
\??\c:\hhbhnn.exec:\hhbhnn.exe154⤵PID:880
-
\??\c:\dvjjv.exec:\dvjjv.exe155⤵PID:264
-
\??\c:\vvjjj.exec:\vvjjj.exe156⤵PID:1040
-
\??\c:\9fxfllr.exec:\9fxfllr.exe157⤵PID:2140
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe158⤵PID:1080
-
\??\c:\btthnh.exec:\btthnh.exe159⤵PID:2132
-
\??\c:\9vjpp.exec:\9vjpp.exe160⤵PID:1156
-
\??\c:\ffxrflx.exec:\ffxrflx.exe161⤵PID:2324
-
\??\c:\rfrxfff.exec:\rfrxfff.exe162⤵PID:548
-
\??\c:\9bnnnt.exec:\9bnnnt.exe163⤵PID:660
-
\??\c:\btbbbb.exec:\btbbbb.exe164⤵PID:1252
-
\??\c:\pjddp.exec:\pjddp.exe165⤵PID:1828
-
\??\c:\fxxfrll.exec:\fxxfrll.exe166⤵PID:2156
-
\??\c:\ffxrffr.exec:\ffxrffr.exe167⤵PID:752
-
\??\c:\1hbhtt.exec:\1hbhtt.exe168⤵PID:1556
-
\??\c:\vpjpp.exec:\vpjpp.exe169⤵PID:2980
-
\??\c:\jdppd.exec:\jdppd.exe170⤵PID:2960
-
\??\c:\rlflxfr.exec:\rlflxfr.exe171⤵PID:760
-
\??\c:\rlxlflx.exec:\rlxlflx.exe172⤵PID:1812
-
\??\c:\btbnht.exec:\btbnht.exe173⤵PID:1592
-
\??\c:\9pdjp.exec:\9pdjp.exe174⤵PID:1056
-
\??\c:\ddvdj.exec:\ddvdj.exe175⤵PID:1736
-
\??\c:\frllrxl.exec:\frllrxl.exe176⤵PID:2684
-
\??\c:\bbnbhn.exec:\bbnbhn.exe177⤵PID:2148
-
\??\c:\tnntbt.exec:\tnntbt.exe178⤵PID:2808
-
\??\c:\pjvpd.exec:\pjvpd.exe179⤵PID:2860
-
\??\c:\xrlrllx.exec:\xrlrllx.exe180⤵PID:2840
-
\??\c:\xxrxxfx.exec:\xxrxxfx.exe181⤵PID:2748
-
\??\c:\nnbhbb.exec:\nnbhbb.exe182⤵PID:2764
-
\??\c:\jdvpp.exec:\jdvpp.exe183⤵PID:2640
-
\??\c:\vpjpv.exec:\vpjpv.exe184⤵PID:2816
-
\??\c:\xxrrfxl.exec:\xxrrfxl.exe185⤵PID:2500
-
\??\c:\7hnnbn.exec:\7hnnbn.exe186⤵PID:2184
-
\??\c:\hnbnbn.exec:\hnbnbn.exe187⤵PID:352
-
\??\c:\pjvpv.exec:\pjvpv.exe188⤵PID:3012
-
\??\c:\5ppjp.exec:\5ppjp.exe189⤵PID:2680
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe190⤵PID:2844
-
\??\c:\ttbbnt.exec:\ttbbnt.exe191⤵PID:2604
-
\??\c:\hhbtbb.exec:\hhbtbb.exe192⤵PID:2896
-
\??\c:\ppvjj.exec:\ppvjj.exe193⤵PID:2696
-
\??\c:\vvpvj.exec:\vvpvj.exe194⤵PID:2196
-
\??\c:\llxlffx.exec:\llxlffx.exe195⤵PID:1788
-
\??\c:\rrrxrrr.exec:\rrrxrrr.exe196⤵PID:1684
-
\??\c:\hnbttn.exec:\hnbttn.exe197⤵PID:1784
-
\??\c:\pvpjp.exec:\pvpjp.exe198⤵PID:2736
-
\??\c:\pjvdj.exec:\pjvdj.exe199⤵PID:1520
-
\??\c:\fxllxlr.exec:\fxllxlr.exe200⤵PID:1436
-
\??\c:\tntbhn.exec:\tntbhn.exe201⤵PID:1400
-
\??\c:\tnthbt.exec:\tnthbt.exe202⤵PID:332
-
\??\c:\pjvdj.exec:\pjvdj.exe203⤵PID:2108
-
\??\c:\vpvjd.exec:\vpvjd.exe204⤵PID:2692
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe205⤵PID:1716
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe206⤵PID:584
-
\??\c:\hhbbhn.exec:\hhbbhn.exe207⤵PID:808
-
\??\c:\pjdjv.exec:\pjdjv.exe208⤵PID:2132
-
\??\c:\pjpvj.exec:\pjpvj.exe209⤵PID:444
-
\??\c:\fxxfxrf.exec:\fxxfxrf.exe210⤵PID:2324
-
\??\c:\7nbnnn.exec:\7nbnnn.exe211⤵PID:1680
-
\??\c:\btnntt.exec:\btnntt.exe212⤵PID:660
-
\??\c:\ddpdj.exec:\ddpdj.exe213⤵PID:1776
-
\??\c:\pjpdp.exec:\pjpdp.exe214⤵PID:1828
-
\??\c:\xxlxffl.exec:\xxlxffl.exe215⤵PID:1328
-
\??\c:\nbbtbh.exec:\nbbtbh.exe216⤵PID:2144
-
\??\c:\nhhtht.exec:\nhhtht.exe217⤵PID:2904
-
\??\c:\dvjdp.exec:\dvjdp.exe218⤵PID:2292
-
\??\c:\3rfffll.exec:\3rfffll.exe219⤵PID:1992
-
\??\c:\9rlrffl.exec:\9rlrffl.exe220⤵PID:1516
-
\??\c:\tttthn.exec:\tttthn.exe221⤵PID:308
-
\??\c:\hbbhnt.exec:\hbbhnt.exe222⤵PID:1616
-
\??\c:\7jvvp.exec:\7jvvp.exe223⤵PID:1620
-
\??\c:\fxrfrlr.exec:\fxrfrlr.exe224⤵PID:1740
-
\??\c:\ffrrffl.exec:\ffrrffl.exe225⤵PID:3048
-
\??\c:\tnbnbh.exec:\tnbnbh.exe226⤵PID:2780
-
\??\c:\jdvjd.exec:\jdvjd.exe227⤵PID:2756
-
\??\c:\pjvdj.exec:\pjvdj.exe228⤵PID:2608
-
\??\c:\lllfxxl.exec:\lllfxxl.exe229⤵PID:2272
-
\??\c:\nnhnhn.exec:\nnhnhn.exe230⤵PID:2704
-
\??\c:\tnhtht.exec:\tnhtht.exe231⤵PID:2512
-
\??\c:\3jppp.exec:\3jppp.exe232⤵PID:2576
-
\??\c:\xxllrrf.exec:\xxllrrf.exe233⤵PID:2552
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe234⤵PID:1672
-
\??\c:\nhtbhh.exec:\nhtbhh.exe235⤵PID:2224
-
\??\c:\bthnth.exec:\bthnth.exe236⤵PID:2364
-
\??\c:\vvjjv.exec:\vvjjv.exe237⤵PID:344
-
\??\c:\lflrflx.exec:\lflrflx.exe238⤵PID:2720
-
\??\c:\ffxxfll.exec:\ffxxfll.exe239⤵PID:2708
-
\??\c:\tthbnn.exec:\tthbnn.exe240⤵PID:2740
-
\??\c:\3tbbhh.exec:\3tbbhh.exe241⤵PID:2476
-
\??\c:\vdpjj.exec:\vdpjj.exe242⤵PID:1536