Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 06:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe
-
Size
483KB
-
MD5
c8ad59c323405febd7f80d00e706e4c0
-
SHA1
3c7e9809aed2d60f31dcd81a2ff203b2ddc7476e
-
SHA256
eefd90544a2b83cdc2102b2bcdc52fd7db351b8ce40518d23ecfcacd94f995dd
-
SHA512
ab0313ceb46185927b50a7f1997ab532401ead24a5fc7a532e92c86558e032864a0aae5d810700eff5f9150fb48487bbd9f54772d6974abe4d3798decafeb0e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjQ:q7Tc2NYHUrAwqzcO
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3048-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/640-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4588-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5012-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/760-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3568-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/980-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1920-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/460-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1700-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2912-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3484-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2816-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3432-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/232-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4980-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4752-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2872-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2936-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/228-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4492-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4384-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4092-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1000-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/536-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3084-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3236-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2224-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3272-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1084-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2156-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4528-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3388-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2592-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/668-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2588-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3128-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2728-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3960-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/220-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3580-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4348-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4548-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4020-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4476-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4724-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4444-810-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2636-834-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/508-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-1244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/336-1248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3016-1722-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5036 hhttbb.exe 640 jdppv.exe 5012 rffxrlf.exe 4588 xfrrlll.exe 760 1ttnnn.exe 3568 tnhthb.exe 980 rrrxrfr.exe 1920 hnttbb.exe 460 jjvpv.exe 4404 hnhtht.exe 2912 9pjdv.exe 1004 vvpdv.exe 2640 vppdv.exe 1700 rxrllff.exe 3484 pjpdv.exe 2816 vpjpd.exe 3432 lfrllxf.exe 232 dpvpd.exe 4116 fflffxx.exe 4848 hbtbtn.exe 4980 httnbb.exe 1224 jdvjv.exe 4752 pjvpj.exe 2360 hbnnnh.exe 2872 pdjjp.exe 2936 nhnttn.exe 1472 flrxrxl.exe 228 5thbbb.exe 752 djvvd.exe 1596 ppvdd.exe 4108 xrllxxr.exe 2372 9httth.exe 4492 bhhhbh.exe 4348 vvjpj.exe 764 5rfffrr.exe 5052 htbnnn.exe 3164 ppjdd.exe 1652 1rlrfrl.exe 4588 nhnnnn.exe 4384 bbbhhn.exe 4092 vpjjd.exe 1000 xffxrxf.exe 536 bntttt.exe 3084 vvvvv.exe 3236 rxllfff.exe 2224 bhntbb.exe 4780 hbhhhn.exe 3272 1vddd.exe 1352 rlxffff.exe 3336 hhnhnn.exe 1584 vvvvv.exe 1508 1jjjj.exe 3268 xlxxxff.exe 652 hbbbhn.exe 1376 nhhhhn.exe 3076 pvddv.exe 4844 frffxfx.exe 224 bnbbtt.exe 4612 ddppd.exe 1084 rxlfxxx.exe 2156 hthbbb.exe 4848 tnnnnt.exe 4528 lfxxxrr.exe 2540 3llrrrr.exe -
resource yara_rule behavioral2/memory/3048-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/640-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4588-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5012-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/760-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3568-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/980-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/460-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1700-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2912-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3484-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2816-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3432-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/232-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4980-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4752-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2872-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2936-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/228-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4492-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1652-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4384-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4092-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1000-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/536-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3084-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3236-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2224-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3272-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1084-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2156-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4528-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3388-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2592-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1496-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/668-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2588-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3128-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1584-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2728-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3960-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/220-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3580-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4348-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4548-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4836-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4020-592-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 5036 3048 c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe 82 PID 3048 wrote to memory of 5036 3048 c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe 82 PID 3048 wrote to memory of 5036 3048 c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe 82 PID 5036 wrote to memory of 640 5036 hhttbb.exe 83 PID 5036 wrote to memory of 640 5036 hhttbb.exe 83 PID 5036 wrote to memory of 640 5036 hhttbb.exe 83 PID 640 wrote to memory of 5012 640 jdppv.exe 84 PID 640 wrote to memory of 5012 640 jdppv.exe 84 PID 640 wrote to memory of 5012 640 jdppv.exe 84 PID 5012 wrote to memory of 4588 5012 rffxrlf.exe 85 PID 5012 wrote to memory of 4588 5012 rffxrlf.exe 85 PID 5012 wrote to memory of 4588 5012 rffxrlf.exe 85 PID 4588 wrote to memory of 760 4588 xfrrlll.exe 86 PID 4588 wrote to memory of 760 4588 xfrrlll.exe 86 PID 4588 wrote to memory of 760 4588 xfrrlll.exe 86 PID 760 wrote to memory of 3568 760 1ttnnn.exe 87 PID 760 wrote to memory of 3568 760 1ttnnn.exe 87 PID 760 wrote to memory of 3568 760 1ttnnn.exe 87 PID 3568 wrote to memory of 980 3568 tnhthb.exe 88 PID 3568 wrote to memory of 980 3568 tnhthb.exe 88 PID 3568 wrote to memory of 980 3568 tnhthb.exe 88 PID 980 wrote to memory of 1920 980 rrrxrfr.exe 89 PID 980 wrote to memory of 1920 980 rrrxrfr.exe 89 PID 980 wrote to memory of 1920 980 rrrxrfr.exe 89 PID 1920 wrote to memory of 460 1920 hnttbb.exe 90 PID 1920 wrote to memory of 460 1920 hnttbb.exe 90 PID 1920 wrote to memory of 460 1920 hnttbb.exe 90 PID 460 wrote to memory of 4404 460 jjvpv.exe 91 PID 460 wrote to memory of 4404 460 jjvpv.exe 91 PID 460 wrote to memory of 4404 460 jjvpv.exe 91 PID 4404 wrote to memory of 2912 4404 hnhtht.exe 93 PID 4404 wrote to memory of 2912 4404 hnhtht.exe 93 PID 4404 wrote to memory of 2912 4404 hnhtht.exe 93 PID 2912 wrote to memory of 1004 2912 9pjdv.exe 94 PID 2912 wrote to memory of 1004 2912 9pjdv.exe 94 PID 2912 wrote to memory of 1004 2912 9pjdv.exe 94 PID 1004 wrote to memory of 2640 1004 vvpdv.exe 95 PID 1004 wrote to memory of 2640 1004 vvpdv.exe 95 PID 1004 wrote to memory of 2640 1004 vvpdv.exe 95 PID 2640 wrote to memory of 1700 2640 vppdv.exe 96 PID 2640 wrote to memory of 1700 2640 vppdv.exe 96 PID 2640 wrote to memory of 1700 2640 vppdv.exe 96 PID 1700 wrote to memory of 3484 1700 rxrllff.exe 97 PID 1700 wrote to memory of 3484 1700 rxrllff.exe 97 PID 1700 wrote to memory of 3484 1700 rxrllff.exe 97 PID 3484 wrote to memory of 2816 3484 pjpdv.exe 99 PID 3484 wrote to memory of 2816 3484 pjpdv.exe 99 PID 3484 wrote to memory of 2816 3484 pjpdv.exe 99 PID 2816 wrote to memory of 3432 2816 vpjpd.exe 100 PID 2816 wrote to memory of 3432 2816 vpjpd.exe 100 PID 2816 wrote to memory of 3432 2816 vpjpd.exe 100 PID 3432 wrote to memory of 232 3432 lfrllxf.exe 101 PID 3432 wrote to memory of 232 3432 lfrllxf.exe 101 PID 3432 wrote to memory of 232 3432 lfrllxf.exe 101 PID 232 wrote to memory of 4116 232 dpvpd.exe 102 PID 232 wrote to memory of 4116 232 dpvpd.exe 102 PID 232 wrote to memory of 4116 232 dpvpd.exe 102 PID 4116 wrote to memory of 4848 4116 fflffxx.exe 103 PID 4116 wrote to memory of 4848 4116 fflffxx.exe 103 PID 4116 wrote to memory of 4848 4116 fflffxx.exe 103 PID 4848 wrote to memory of 4980 4848 hbtbtn.exe 105 PID 4848 wrote to memory of 4980 4848 hbtbtn.exe 105 PID 4848 wrote to memory of 4980 4848 hbtbtn.exe 105 PID 4980 wrote to memory of 1224 4980 httnbb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c8ad59c323405febd7f80d00e706e4c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hhttbb.exec:\hhttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\jdppv.exec:\jdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\rffxrlf.exec:\rffxrlf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xfrrlll.exec:\xfrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\1ttnnn.exec:\1ttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\tnhthb.exec:\tnhthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\rrrxrfr.exec:\rrrxrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\hnttbb.exec:\hnttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\jjvpv.exec:\jjvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\hnhtht.exec:\hnhtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\9pjdv.exec:\9pjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vvpdv.exec:\vvpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\vppdv.exec:\vppdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rxrllff.exec:\rxrllff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pjpdv.exec:\pjpdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\vpjpd.exec:\vpjpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\lfrllxf.exec:\lfrllxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\dpvpd.exec:\dpvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\fflffxx.exec:\fflffxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\hbtbtn.exec:\hbtbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\httnbb.exec:\httnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\jdvjv.exec:\jdvjv.exe23⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:4752 -
\??\c:\hbnnnh.exec:\hbnnnh.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pdjjp.exec:\pdjjp.exe26⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhnttn.exec:\nhnttn.exe27⤵
- Executes dropped EXE
PID:2936 -
\??\c:\flrxrxl.exec:\flrxrxl.exe28⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5thbbb.exec:\5thbbb.exe29⤵
- Executes dropped EXE
PID:228 -
\??\c:\djvvd.exec:\djvvd.exe30⤵
- Executes dropped EXE
PID:752 -
\??\c:\ppvdd.exec:\ppvdd.exe31⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrllxxr.exec:\xrllxxr.exe32⤵
- Executes dropped EXE
PID:4108 -
\??\c:\9httth.exec:\9httth.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhhhbh.exec:\bhhhbh.exe34⤵
- Executes dropped EXE
PID:4492 -
\??\c:\vvjpj.exec:\vvjpj.exe35⤵
- Executes dropped EXE
PID:4348 -
\??\c:\5rfffrr.exec:\5rfffrr.exe36⤵
- Executes dropped EXE
PID:764 -
\??\c:\htbnnn.exec:\htbnnn.exe37⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ppjdd.exec:\ppjdd.exe38⤵
- Executes dropped EXE
PID:3164 -
\??\c:\1rlrfrl.exec:\1rlrfrl.exe39⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nhnnnn.exec:\nhnnnn.exe40⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bbbhhn.exec:\bbbhhn.exe41⤵
- Executes dropped EXE
PID:4384 -
\??\c:\vpjjd.exec:\vpjjd.exe42⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xffxrxf.exec:\xffxrxf.exe43⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bntttt.exec:\bntttt.exe44⤵
- Executes dropped EXE
PID:536 -
\??\c:\vvvvv.exec:\vvvvv.exe45⤵
- Executes dropped EXE
PID:3084 -
\??\c:\rxllfff.exec:\rxllfff.exe46⤵
- Executes dropped EXE
PID:3236 -
\??\c:\bhntbb.exec:\bhntbb.exe47⤵
- Executes dropped EXE
PID:2224 -
\??\c:\hbhhhn.exec:\hbhhhn.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\1vddd.exec:\1vddd.exe49⤵
- Executes dropped EXE
PID:3272 -
\??\c:\rlxffff.exec:\rlxffff.exe50⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hhnhnn.exec:\hhnhnn.exe51⤵
- Executes dropped EXE
PID:3336 -
\??\c:\vvvvv.exec:\vvvvv.exe52⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1jjjj.exec:\1jjjj.exe53⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xlxxxff.exec:\xlxxxff.exe54⤵
- Executes dropped EXE
PID:3268 -
\??\c:\hbbbhn.exec:\hbbbhn.exe55⤵
- Executes dropped EXE
PID:652 -
\??\c:\nhhhhn.exec:\nhhhhn.exe56⤵
- Executes dropped EXE
PID:1376 -
\??\c:\pvddv.exec:\pvddv.exe57⤵
- Executes dropped EXE
PID:3076 -
\??\c:\frffxfx.exec:\frffxfx.exe58⤵
- Executes dropped EXE
PID:4844 -
\??\c:\bnbbtt.exec:\bnbbtt.exe59⤵
- Executes dropped EXE
PID:224 -
\??\c:\ddppd.exec:\ddppd.exe60⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hthbbb.exec:\hthbbb.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnnnnt.exec:\tnnnnt.exe63⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lfxxxrr.exec:\lfxxxrr.exe64⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3llrrrr.exec:\3llrrrr.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7tnnbh.exec:\7tnnbh.exe66⤵PID:4856
-
\??\c:\1jvpv.exec:\1jvpv.exe67⤵PID:3516
-
\??\c:\5fffxfx.exec:\5fffxfx.exe68⤵PID:936
-
\??\c:\ffrllll.exec:\ffrllll.exe69⤵PID:408
-
\??\c:\tthttb.exec:\tthttb.exe70⤵PID:3388
-
\??\c:\pjvpp.exec:\pjvpp.exe71⤵PID:2420
-
\??\c:\rrrlllf.exec:\rrrlllf.exe72⤵PID:4400
-
\??\c:\bbnntb.exec:\bbnntb.exe73⤵PID:2592
-
\??\c:\3ppjd.exec:\3ppjd.exe74⤵PID:3232
-
\??\c:\5dvvp.exec:\5dvvp.exe75⤵PID:3244
-
\??\c:\xxfllxx.exec:\xxfllxx.exe76⤵PID:1496
-
\??\c:\pvvpp.exec:\pvvpp.exe77⤵PID:2704
-
\??\c:\djjjj.exec:\djjjj.exe78⤵PID:668
-
\??\c:\rrlllff.exec:\rrlllff.exe79⤵PID:3824
-
\??\c:\9ttbhn.exec:\9ttbhn.exe80⤵PID:3564
-
\??\c:\dvjjj.exec:\dvjjj.exe81⤵PID:1180
-
\??\c:\9jjjv.exec:\9jjjv.exe82⤵PID:2588
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe83⤵PID:4496
-
\??\c:\hbnnbb.exec:\hbnnbb.exe84⤵PID:2996
-
\??\c:\pdvdv.exec:\pdvdv.exe85⤵PID:1212
-
\??\c:\9fffflr.exec:\9fffflr.exe86⤵PID:4100
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe87⤵PID:2260
-
\??\c:\1bbbtn.exec:\1bbbtn.exe88⤵PID:4564
-
\??\c:\pjvdv.exec:\pjvdv.exe89⤵PID:536
-
\??\c:\rxxxfff.exec:\rxxxfff.exe90⤵PID:1624
-
\??\c:\hbbbtb.exec:\hbbbtb.exe91⤵PID:3128
-
\??\c:\jdvpj.exec:\jdvpj.exe92⤵PID:4404
-
\??\c:\rrxlfrf.exec:\rrxlfrf.exe93⤵PID:2036
-
\??\c:\llrlffx.exec:\llrlffx.exe94⤵PID:4540
-
\??\c:\htnhbt.exec:\htnhbt.exe95⤵PID:1584
-
\??\c:\pppdv.exec:\pppdv.exe96⤵PID:2228
-
\??\c:\xrxlfll.exec:\xrxlfll.exe97⤵PID:652
-
\??\c:\hbttnn.exec:\hbttnn.exe98⤵PID:2536
-
\??\c:\1dvvp.exec:\1dvvp.exe99⤵PID:4116
-
\??\c:\pjdvj.exec:\pjdvj.exe100⤵PID:1064
-
\??\c:\fflxllx.exec:\fflxllx.exe101⤵PID:3020
-
\??\c:\bbbtnh.exec:\bbbtnh.exe102⤵PID:2728
-
\??\c:\jvjjv.exec:\jvjjv.exe103⤵PID:4508
-
\??\c:\rxrfxrf.exec:\rxrfxrf.exe104⤵PID:3960
-
\??\c:\bhnhbh.exec:\bhnhbh.exe105⤵PID:8
-
\??\c:\vjpjd.exec:\vjpjd.exe106⤵PID:3108
-
\??\c:\lllfllr.exec:\lllfllr.exe107⤵PID:4632
-
\??\c:\nhtntt.exec:\nhtntt.exe108⤵PID:920
-
\??\c:\dvjdd.exec:\dvjdd.exe109⤵PID:220
-
\??\c:\xllxrrr.exec:\xllxrrr.exe110⤵PID:2744
-
\??\c:\pdpjp.exec:\pdpjp.exe111⤵PID:3388
-
\??\c:\xfxlfff.exec:\xfxlfff.exe112⤵PID:380
-
\??\c:\tttnnh.exec:\tttnnh.exe113⤵PID:2512
-
\??\c:\dpdpj.exec:\dpdpj.exe114⤵PID:4764
-
\??\c:\vdvvv.exec:\vdvvv.exe115⤵PID:2456
-
\??\c:\rlrffrx.exec:\rlrffrx.exe116⤵PID:4576
-
\??\c:\hbntth.exec:\hbntth.exe117⤵PID:3580
-
\??\c:\frrrrff.exec:\frrrrff.exe118⤵PID:4088
-
\??\c:\5ffffll.exec:\5ffffll.exe119⤵PID:4348
-
\??\c:\ttbttb.exec:\ttbttb.exe120⤵PID:4132
-
\??\c:\vpppp.exec:\vpppp.exe121⤵PID:2812
-
\??\c:\rxxrfrx.exec:\rxxrfrx.exe122⤵PID:1552
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-