Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:57
Behavioral task
behavioral1
Sample
0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe
-
Size
198KB
-
MD5
fe289044670d3d10eb901ed5c09f2810
-
SHA1
8b164b7782627ac8c6769f8c873db74dfef99274
-
SHA256
0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719
-
SHA512
bbf83f04cbf18e02ed549130bfa4b74f999e87e5569774f7c1f9b5dd77d1af05a01cf4f75fe346a632a5f8eb6e5751b66c2049231411ed5406638110957dcec5
-
SSDEEP
3072:xhOmTsF93UYfwC6GIout3WVi/8HCpi8rY9AABa1YRMxl1522cJ1uI9:xcm4FmowdHoS3WV28HCddWhRO1Lc99
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3836-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3336-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/888-12-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2304-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4672-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/376-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/348-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3104-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1884-59-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1424-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5108-76-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-86-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3040-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1932-95-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3520-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1896-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4924-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1360-161-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3212-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2952-203-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3576-211-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4656-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4952-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4324-225-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4760-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4064-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4420-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5032-306-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2276-351-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2008-367-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1696-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4100-425-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/916-451-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2692-474-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2900-558-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3960-525-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1696-518-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1936-459-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3268-432-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2740-412-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3148-411-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4308-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4388-372-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/392-363-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2308-356-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2780-355-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2284-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4328-330-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1136-316-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4848-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1824-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4276-253-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4076-247-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4672-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3576-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4536-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4400-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3548-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3984-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1892-142-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5036-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1972-668-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4552-673-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnttbb.exe1dddd.exexlfllrr.exejjjjj.exepdpjj.exehthhbb.exelxflxrx.exenbhbtt.exeppddd.exerlxlrrr.exexxxrfff.exejvddd.exelxlfxxr.exejddvv.exefxxrfxl.exefxlrlxr.exeddpjj.exerlfllll.exe5flxrlf.exepjppj.exevpjvd.exelfrlfrl.exetbnnnn.exe9vpjp.exerlrlllf.exe7frlllf.exebnthbb.exejpvpj.exelflfxrl.exe3bhbtt.exejvdvp.exexrxrllf.exethtbtt.exe7hnttb.exe1dpjj.exedjdvp.exeffffflf.exebbhhhn.exe9jvvp.exerfrflfl.exefflfxxl.exenhtbbh.exe9vjdd.exejdppp.exexfxllxx.exefrrlfxr.exebnbtnh.exejdjpp.exejpvvv.exeflrlfrr.exefxrllfl.exenbnnnt.exejpjjj.exe5jvjj.exelxlxfxr.exe7nnhbb.exetbnhbh.exeddddd.exe7pvvv.exe7xxrfll.exelrlllrr.exebttnnn.exenbbttt.exejdjpp.exepid process 3336 nnttbb.exe 888 1dddd.exe 2304 xlfllrr.exe 4672 jjjjj.exe 376 pdpjj.exe 348 hthhbb.exe 396 lxflxrx.exe 3104 nbhbtt.exe 4416 ppddd.exe 1884 rlxlrrr.exe 1424 xxxrfff.exe 5108 jvddd.exe 2528 lxlfxxr.exe 4880 jddvv.exe 3040 fxxrfxl.exe 1932 fxlrlxr.exe 5104 ddpjj.exe 2764 rlfllll.exe 3520 5flxrlf.exe 5036 pjppj.exe 4924 vpjvd.exe 1896 lfrlfrl.exe 8 tbnnnn.exe 1892 9vpjp.exe 3468 rlrlllf.exe 4864 7frlllf.exe 1360 bnthbb.exe 3984 jpvpj.exe 2780 lflfxrl.exe 1992 3bhbtt.exe 3264 jvdvp.exe 3548 xrxrllf.exe 4400 thtbtt.exe 3212 7hnttb.exe 4388 1dpjj.exe 2952 djdvp.exe 1068 ffffflf.exe 4536 bbhhhn.exe 3576 9jvvp.exe 3324 rfrflfl.exe 4656 fflfxxl.exe 4324 nhtbbh.exe 4952 9vjdd.exe 1648 jdppp.exe 5064 xfxllxx.exe 3100 frrlfxr.exe 4396 bnbtnh.exe 4672 jdjpp.exe 4076 jpvvv.exe 4276 flrlfrr.exe 4760 fxrllfl.exe 3196 nbnnnt.exe 1824 jpjjj.exe 3380 5jvjj.exe 4064 lxlxfxr.exe 1256 7nnhbb.exe 4508 tbnhbh.exe 4420 ddddd.exe 3944 7pvvv.exe 1760 7xxrfll.exe 3524 lrlllrr.exe 2860 bttnnn.exe 4848 nbbttt.exe 3304 jdjpp.exe -
Processes:
resource yara_rule behavioral2/memory/3836-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nnttbb.exe upx behavioral2/memory/3836-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3336-8-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\1dddd.exe upx behavioral2/memory/888-12-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xlfllrr.exe upx C:\jjjjj.exe upx behavioral2/memory/2304-24-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pdpjj.exe upx behavioral2/memory/4672-28-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hthhbb.exe upx behavioral2/memory/376-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/348-41-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxflxrx.exe upx behavioral2/memory/396-43-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nbhbtt.exe upx behavioral2/memory/3104-50-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppddd.exe upx C:\rlxlrrr.exe upx C:\xxxrfff.exe upx behavioral2/memory/1884-59-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1424-66-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jvddd.exe upx C:\lxlfxxr.exe upx behavioral2/memory/5108-76-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jddvv.exe upx behavioral2/memory/4880-86-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxxrfxl.exe upx behavioral2/memory/3040-90-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxlrlxr.exe upx behavioral2/memory/1932-95-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ddpjj.exe upx C:\rlfllll.exe upx behavioral2/memory/5104-105-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5flxrlf.exe upx behavioral2/memory/3520-117-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjppj.exe upx \??\c:\lfrlfrl.exe upx behavioral2/memory/1896-130-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4924-124-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\vpjvd.exe upx C:\rlrlllf.exe upx \??\c:\7frlllf.exe upx \??\c:\bnthbb.exe upx C:\jpvpj.exe upx behavioral2/memory/1360-161-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\jvdvp.exe upx behavioral2/memory/3264-179-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xrxrllf.exe upx behavioral2/memory/3212-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2952-203-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3576-211-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4656-221-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4952-226-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4324-225-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4760-257-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4064-270-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4420-279-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3304-299-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5032-306-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4328-326-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2276-351-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2008-367-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exennttbb.exe1dddd.exexlfllrr.exejjjjj.exepdpjj.exehthhbb.exelxflxrx.exenbhbtt.exeppddd.exerlxlrrr.exexxxrfff.exejvddd.exelxlfxxr.exejddvv.exefxxrfxl.exefxlrlxr.exeddpjj.exerlfllll.exe5flxrlf.exepjppj.exevpjvd.exedescription pid process target process PID 3836 wrote to memory of 3336 3836 0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe nnttbb.exe PID 3836 wrote to memory of 3336 3836 0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe nnttbb.exe PID 3836 wrote to memory of 3336 3836 0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe nnttbb.exe PID 3336 wrote to memory of 888 3336 nnttbb.exe 1dddd.exe PID 3336 wrote to memory of 888 3336 nnttbb.exe 1dddd.exe PID 3336 wrote to memory of 888 3336 nnttbb.exe 1dddd.exe PID 888 wrote to memory of 2304 888 1dddd.exe xlfllrr.exe PID 888 wrote to memory of 2304 888 1dddd.exe xlfllrr.exe PID 888 wrote to memory of 2304 888 1dddd.exe xlfllrr.exe PID 2304 wrote to memory of 4672 2304 xlfllrr.exe jdjpp.exe PID 2304 wrote to memory of 4672 2304 xlfllrr.exe jdjpp.exe PID 2304 wrote to memory of 4672 2304 xlfllrr.exe jdjpp.exe PID 4672 wrote to memory of 376 4672 jjjjj.exe pdpjj.exe PID 4672 wrote to memory of 376 4672 jjjjj.exe pdpjj.exe PID 4672 wrote to memory of 376 4672 jjjjj.exe pdpjj.exe PID 376 wrote to memory of 348 376 pdpjj.exe hthhbb.exe PID 376 wrote to memory of 348 376 pdpjj.exe hthhbb.exe PID 376 wrote to memory of 348 376 pdpjj.exe hthhbb.exe PID 348 wrote to memory of 396 348 hthhbb.exe lxflxrx.exe PID 348 wrote to memory of 396 348 hthhbb.exe lxflxrx.exe PID 348 wrote to memory of 396 348 hthhbb.exe lxflxrx.exe PID 396 wrote to memory of 3104 396 lxflxrx.exe xfrlxxr.exe PID 396 wrote to memory of 3104 396 lxflxrx.exe xfrlxxr.exe PID 396 wrote to memory of 3104 396 lxflxrx.exe xfrlxxr.exe PID 3104 wrote to memory of 4416 3104 nbhbtt.exe ppddd.exe PID 3104 wrote to memory of 4416 3104 nbhbtt.exe ppddd.exe PID 3104 wrote to memory of 4416 3104 nbhbtt.exe ppddd.exe PID 4416 wrote to memory of 1884 4416 ppddd.exe rlxlrrr.exe PID 4416 wrote to memory of 1884 4416 ppddd.exe rlxlrrr.exe PID 4416 wrote to memory of 1884 4416 ppddd.exe rlxlrrr.exe PID 1884 wrote to memory of 1424 1884 rlxlrrr.exe xxxrfff.exe PID 1884 wrote to memory of 1424 1884 rlxlrrr.exe xxxrfff.exe PID 1884 wrote to memory of 1424 1884 rlxlrrr.exe xxxrfff.exe PID 1424 wrote to memory of 5108 1424 xxxrfff.exe jvddd.exe PID 1424 wrote to memory of 5108 1424 xxxrfff.exe jvddd.exe PID 1424 wrote to memory of 5108 1424 xxxrfff.exe jvddd.exe PID 5108 wrote to memory of 2528 5108 jvddd.exe lxlfxxr.exe PID 5108 wrote to memory of 2528 5108 jvddd.exe lxlfxxr.exe PID 5108 wrote to memory of 2528 5108 jvddd.exe lxlfxxr.exe PID 2528 wrote to memory of 4880 2528 lxlfxxr.exe jddvv.exe PID 2528 wrote to memory of 4880 2528 lxlfxxr.exe jddvv.exe PID 2528 wrote to memory of 4880 2528 lxlfxxr.exe jddvv.exe PID 4880 wrote to memory of 3040 4880 jddvv.exe dpvvv.exe PID 4880 wrote to memory of 3040 4880 jddvv.exe dpvvv.exe PID 4880 wrote to memory of 3040 4880 jddvv.exe dpvvv.exe PID 3040 wrote to memory of 1932 3040 fxxrfxl.exe fxlrlxr.exe PID 3040 wrote to memory of 1932 3040 fxxrfxl.exe fxlrlxr.exe PID 3040 wrote to memory of 1932 3040 fxxrfxl.exe fxlrlxr.exe PID 1932 wrote to memory of 5104 1932 fxlrlxr.exe jjvvv.exe PID 1932 wrote to memory of 5104 1932 fxlrlxr.exe jjvvv.exe PID 1932 wrote to memory of 5104 1932 fxlrlxr.exe jjvvv.exe PID 5104 wrote to memory of 2764 5104 ddpjj.exe rlfllll.exe PID 5104 wrote to memory of 2764 5104 ddpjj.exe rlfllll.exe PID 5104 wrote to memory of 2764 5104 ddpjj.exe rlfllll.exe PID 2764 wrote to memory of 3520 2764 rlfllll.exe 5flxrlf.exe PID 2764 wrote to memory of 3520 2764 rlfllll.exe 5flxrlf.exe PID 2764 wrote to memory of 3520 2764 rlfllll.exe 5flxrlf.exe PID 3520 wrote to memory of 5036 3520 5flxrlf.exe pjppj.exe PID 3520 wrote to memory of 5036 3520 5flxrlf.exe pjppj.exe PID 3520 wrote to memory of 5036 3520 5flxrlf.exe pjppj.exe PID 5036 wrote to memory of 4924 5036 pjppj.exe vpjvd.exe PID 5036 wrote to memory of 4924 5036 pjppj.exe vpjvd.exe PID 5036 wrote to memory of 4924 5036 pjppj.exe vpjvd.exe PID 4924 wrote to memory of 1896 4924 vpjvd.exe lfrlfrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a9ff6946ab34aae0f6919c584865ac55689e0b559a3f4ab8a9f1b25cd58b719_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\nnttbb.exec:\nnttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\1dddd.exec:\1dddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\xlfllrr.exec:\xlfllrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\jjjjj.exec:\jjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\pdpjj.exec:\pdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\hthhbb.exec:\hthhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\lxflxrx.exec:\lxflxrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\nbhbtt.exec:\nbhbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\ppddd.exec:\ppddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\rlxlrrr.exec:\rlxlrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\xxxrfff.exec:\xxxrfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\jvddd.exec:\jvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jddvv.exec:\jddvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\fxxrfxl.exec:\fxxrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\fxlrlxr.exec:\fxlrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ddpjj.exec:\ddpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\rlfllll.exec:\rlfllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\5flxrlf.exec:\5flxrlf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\pjppj.exec:\pjppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\vpjvd.exec:\vpjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe23⤵
- Executes dropped EXE
PID:1896 -
\??\c:\tbnnnn.exec:\tbnnnn.exe24⤵
- Executes dropped EXE
PID:8 -
\??\c:\9vpjp.exec:\9vpjp.exe25⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rlrlllf.exec:\rlrlllf.exe26⤵
- Executes dropped EXE
PID:3468 -
\??\c:\7frlllf.exec:\7frlllf.exe27⤵
- Executes dropped EXE
PID:4864 -
\??\c:\bnthbb.exec:\bnthbb.exe28⤵
- Executes dropped EXE
PID:1360 -
\??\c:\jpvpj.exec:\jpvpj.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\lflfxrl.exec:\lflfxrl.exe30⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3bhbtt.exec:\3bhbtt.exe31⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jvdvp.exec:\jvdvp.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\xrxrllf.exec:\xrxrllf.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\thtbtt.exec:\thtbtt.exe34⤵
- Executes dropped EXE
PID:4400 -
\??\c:\7hnttb.exec:\7hnttb.exe35⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1dpjj.exec:\1dpjj.exe36⤵
- Executes dropped EXE
PID:4388 -
\??\c:\djdvp.exec:\djdvp.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ffffflf.exec:\ffffflf.exe38⤵
- Executes dropped EXE
PID:1068 -
\??\c:\bbhhhn.exec:\bbhhhn.exe39⤵
- Executes dropped EXE
PID:4536 -
\??\c:\9jvvp.exec:\9jvvp.exe40⤵
- Executes dropped EXE
PID:3576 -
\??\c:\rfrflfl.exec:\rfrflfl.exe41⤵
- Executes dropped EXE
PID:3324 -
\??\c:\fflfxxl.exec:\fflfxxl.exe42⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nhtbbh.exec:\nhtbbh.exe43⤵
- Executes dropped EXE
PID:4324 -
\??\c:\9vjdd.exec:\9vjdd.exe44⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jdppp.exec:\jdppp.exe45⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xfxllxx.exec:\xfxllxx.exe46⤵
- Executes dropped EXE
PID:5064 -
\??\c:\frrlfxr.exec:\frrlfxr.exe47⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bnbtnh.exec:\bnbtnh.exe48⤵
- Executes dropped EXE
PID:4396 -
\??\c:\jdjpp.exec:\jdjpp.exe49⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jpvvv.exec:\jpvvv.exe50⤵
- Executes dropped EXE
PID:4076 -
\??\c:\flrlfrr.exec:\flrlfrr.exe51⤵
- Executes dropped EXE
PID:4276 -
\??\c:\fxrllfl.exec:\fxrllfl.exe52⤵
- Executes dropped EXE
PID:4760 -
\??\c:\nbnnnt.exec:\nbnnnt.exe53⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jpjjj.exec:\jpjjj.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5jvjj.exec:\5jvjj.exe55⤵
- Executes dropped EXE
PID:3380 -
\??\c:\lxlxfxr.exec:\lxlxfxr.exe56⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7nnhbb.exec:\7nnhbb.exe57⤵
- Executes dropped EXE
PID:1256 -
\??\c:\tbnhbh.exec:\tbnhbh.exe58⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ddddd.exec:\ddddd.exe59⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7pvvv.exec:\7pvvv.exe60⤵
- Executes dropped EXE
PID:3944 -
\??\c:\7xxrfll.exec:\7xxrfll.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lrlllrr.exec:\lrlllrr.exe62⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bttnnn.exec:\bttnnn.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nbbttt.exec:\nbbttt.exe64⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jdjpp.exec:\jdjpp.exe65⤵
- Executes dropped EXE
PID:3304 -
\??\c:\jjvvv.exec:\jjvvv.exe66⤵PID:5104
-
\??\c:\lrrlrxx.exec:\lrrlrxx.exe67⤵PID:5032
-
\??\c:\tnnnnt.exec:\tnnnnt.exe68⤵PID:4640
-
\??\c:\dppdj.exec:\dppdj.exe69⤵PID:336
-
\??\c:\jdjjd.exec:\jdjjd.exe70⤵PID:1136
-
\??\c:\rrffflr.exec:\rrffflr.exe71⤵PID:4920
-
\??\c:\xxxxrxx.exec:\xxxxrxx.exe72⤵PID:2896
-
\??\c:\hhbbbb.exec:\hhbbbb.exe73⤵PID:4328
-
\??\c:\7tbbbh.exec:\7tbbbh.exe74⤵PID:2284
-
\??\c:\3dppp.exec:\3dppp.exe75⤵PID:2568
-
\??\c:\3vppp.exec:\3vppp.exe76⤵PID:3364
-
\??\c:\rxrrflf.exec:\rxrrflf.exe77⤵PID:4196
-
\??\c:\nhhhnh.exec:\nhhhnh.exe78⤵PID:4028
-
\??\c:\nhbbhh.exec:\nhbbhh.exe79⤵PID:2276
-
\??\c:\djpvj.exec:\djpvj.exe80⤵PID:2780
-
\??\c:\ddddj.exec:\ddddj.exe81⤵PID:2308
-
\??\c:\llfrrfx.exec:\llfrrfx.exe82⤵PID:392
-
\??\c:\lfrxllf.exec:\lfrxllf.exe83⤵PID:2008
-
\??\c:\nthnnt.exec:\nthnnt.exe84⤵PID:1696
-
\??\c:\jjppv.exec:\jjppv.exe85⤵PID:4388
-
\??\c:\9dvjp.exec:\9dvjp.exe86⤵PID:4164
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe87⤵PID:1068
-
\??\c:\xfxxlfx.exec:\xfxxlfx.exe88⤵PID:2356
-
\??\c:\bhnhbn.exec:\bhnhbn.exe89⤵PID:4548
-
\??\c:\bhtttb.exec:\bhtttb.exe90⤵PID:2820
-
\??\c:\pvpjj.exec:\pvpjj.exe91⤵PID:3576
-
\??\c:\rxxrxll.exec:\rxxrxll.exe92⤵PID:2196
-
\??\c:\flrxfll.exec:\flrxfll.exe93⤵PID:5068
-
\??\c:\fffflxf.exec:\fffflxf.exe94⤵PID:4308
-
\??\c:\ntntnt.exec:\ntntnt.exe95⤵PID:736
-
\??\c:\bbnnbh.exec:\bbnnbh.exe96⤵PID:3148
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:2740
-
\??\c:\lxrrxlr.exec:\lxrrxlr.exe98⤵PID:1840
-
\??\c:\rfllfrr.exec:\rfllfrr.exe99⤵PID:4344
-
\??\c:\tnnbbb.exec:\tnnbbb.exe100⤵PID:1084
-
\??\c:\bhttbh.exec:\bhttbh.exe101⤵PID:4100
-
\??\c:\jvddp.exec:\jvddp.exe102⤵PID:604
-
\??\c:\vvpdp.exec:\vvpdp.exe103⤵PID:3268
-
\??\c:\llxxrxl.exec:\llxxrxl.exe104⤵PID:4760
-
\??\c:\rfrflxf.exec:\rfrflxf.exe105⤵PID:3196
-
\??\c:\bbhhhn.exec:\bbhhhn.exe106⤵PID:1824
-
\??\c:\bbhhnn.exec:\bbhhnn.exe107⤵PID:3300
-
\??\c:\pjvpd.exec:\pjvpd.exe108⤵PID:916
-
\??\c:\dvjpp.exec:\dvjpp.exe109⤵PID:4724
-
\??\c:\lrfllrr.exec:\lrfllrr.exe110⤵PID:4436
-
\??\c:\xlxxrxx.exec:\xlxxrxx.exe111⤵PID:1936
-
\??\c:\bnbhht.exec:\bnbhht.exe112⤵PID:2032
-
\??\c:\nhttbh.exec:\nhttbh.exe113⤵PID:1760
-
\??\c:\dpvvv.exec:\dpvvv.exe114⤵PID:3040
-
\??\c:\dvjjj.exec:\dvjjj.exe115⤵PID:2692
-
\??\c:\lflllll.exec:\lflllll.exe116⤵PID:2716
-
\??\c:\xlxrfll.exec:\xlxrfll.exe117⤵PID:1076
-
\??\c:\btbtnb.exec:\btbtnb.exe118⤵PID:3348
-
\??\c:\nttttt.exec:\nttttt.exe119⤵PID:1520
-
\??\c:\dvjjj.exec:\dvjjj.exe120⤵PID:1988
-
\??\c:\btbbbh.exec:\btbbbh.exe121⤵PID:3244
-
\??\c:\jpvdj.exec:\jpvdj.exe122⤵PID:1892
-
\??\c:\vjvvj.exec:\vjvvj.exe123⤵PID:4864
-
\??\c:\jpddp.exec:\jpddp.exe124⤵PID:3364
-
\??\c:\xxxxxfl.exec:\xxxxxfl.exe125⤵PID:2660
-
\??\c:\hhhnnt.exec:\hhhnnt.exe126⤵PID:4144
-
\??\c:\btbbbb.exec:\btbbbb.exe127⤵PID:4824
-
\??\c:\dpvpd.exec:\dpvpd.exe128⤵PID:4612
-
\??\c:\vjddj.exec:\vjddj.exe129⤵PID:1696
-
\??\c:\lffffff.exec:\lffffff.exe130⤵PID:3708
-
\??\c:\9xffffl.exec:\9xffffl.exe131⤵PID:2228
-
\??\c:\frllllr.exec:\frllllr.exe132⤵PID:3960
-
\??\c:\bbbbhn.exec:\bbbbhn.exe133⤵PID:3556
-
\??\c:\nnttbb.exec:\nnttbb.exe134⤵PID:1576
-
\??\c:\jdjjj.exec:\jdjjj.exe135⤵PID:3012
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe136⤵PID:3324
-
\??\c:\fllllll.exec:\fllllll.exe137⤵PID:4588
-
\??\c:\nhtttb.exec:\nhtttb.exe138⤵PID:2200
-
\??\c:\thnnnn.exec:\thnnnn.exe139⤵PID:2272
-
\??\c:\1dvdv.exec:\1dvdv.exe140⤵PID:888
-
\??\c:\jvvpj.exec:\jvvpj.exe141⤵PID:2900
-
\??\c:\rxrxxrx.exec:\rxrxxrx.exe142⤵PID:1840
-
\??\c:\lrxxxff.exec:\lrxxxff.exe143⤵PID:4672
-
\??\c:\7nbhhh.exec:\7nbhhh.exe144⤵PID:1084
-
\??\c:\vvddp.exec:\vvddp.exe145⤵PID:4276
-
\??\c:\jvpjj.exec:\jvpjj.exe146⤵PID:3328
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe147⤵PID:3104
-
\??\c:\5rrrrxx.exec:\5rrrrxx.exe148⤵PID:2616
-
\??\c:\tbbbbh.exec:\tbbbbh.exe149⤵PID:3936
-
\??\c:\ppvdv.exec:\ppvdv.exe150⤵PID:1824
-
\??\c:\bhhhhh.exec:\bhhhhh.exe151⤵PID:3300
-
\??\c:\pdppp.exec:\pdppp.exe152⤵PID:916
-
\??\c:\ddjjj.exec:\ddjjj.exe153⤵PID:1556
-
\??\c:\7nhhbh.exec:\7nhhbh.exe154⤵PID:3312
-
\??\c:\pvdvv.exec:\pvdvv.exe155⤵PID:2004
-
\??\c:\9lrllrl.exec:\9lrllrl.exe156⤵PID:4024
-
\??\c:\7rxrflr.exec:\7rxrflr.exe157⤵PID:836
-
\??\c:\nhhbbh.exec:\nhhbbh.exe158⤵PID:2776
-
\??\c:\vpjjj.exec:\vpjjj.exe159⤵PID:1700
-
\??\c:\ppjjp.exec:\ppjjp.exe160⤵PID:4852
-
\??\c:\djdjd.exec:\djdjd.exe161⤵PID:5036
-
\??\c:\xxlxflx.exec:\xxlxflx.exe162⤵PID:336
-
\??\c:\jdppd.exec:\jdppd.exe163⤵PID:3916
-
\??\c:\rffxxff.exec:\rffxxff.exe164⤵PID:1088
-
\??\c:\frxfflr.exec:\frxfflr.exe165⤵PID:1828
-
\??\c:\bhbhbh.exec:\bhbhbh.exe166⤵PID:4328
-
\??\c:\vddvv.exec:\vddvv.exe167⤵PID:692
-
\??\c:\vvjpj.exec:\vvjpj.exe168⤵PID:4632
-
\??\c:\frlllrr.exec:\frlllrr.exe169⤵PID:2404
-
\??\c:\fffllrx.exec:\fffllrx.exe170⤵PID:2116
-
\??\c:\bhhbbb.exec:\bhhbbb.exe171⤵PID:2660
-
\??\c:\bhnttb.exec:\bhnttb.exe172⤵PID:3548
-
\??\c:\pjddp.exec:\pjddp.exe173⤵PID:2204
-
\??\c:\7jjjj.exec:\7jjjj.exe174⤵PID:3228
-
\??\c:\rrfrrff.exec:\rrfrrff.exe175⤵PID:4872
-
\??\c:\nnhhbh.exec:\nnhhbh.exe176⤵PID:5096
-
\??\c:\bntttb.exec:\bntttb.exe177⤵PID:1972
-
\??\c:\dpjdv.exec:\dpjdv.exe178⤵PID:2356
-
\??\c:\xrlllll.exec:\xrlllll.exe179⤵PID:4552
-
\??\c:\lxrxxfl.exec:\lxrxxfl.exe180⤵PID:932
-
\??\c:\hnhtbh.exec:\hnhtbh.exe181⤵PID:2360
-
\??\c:\7pvvp.exec:\7pvvp.exe182⤵PID:2344
-
\??\c:\jvvpv.exec:\jvvpv.exe183⤵PID:736
-
\??\c:\3xflfxl.exec:\3xflfxl.exe184⤵PID:3148
-
\??\c:\hhnhhh.exec:\hhnhhh.exe185⤵PID:2304
-
\??\c:\tbbbhn.exec:\tbbbhn.exe186⤵PID:4660
-
\??\c:\jjvdp.exec:\jjvdp.exe187⤵PID:2292
-
\??\c:\fflllll.exec:\fflllll.exe188⤵PID:4052
-
\??\c:\bbbttb.exec:\bbbttb.exe189⤵PID:3464
-
\??\c:\tbhbtb.exec:\tbhbtb.exe190⤵PID:2280
-
\??\c:\pddvp.exec:\pddvp.exe191⤵PID:3724
-
\??\c:\fflrxrx.exec:\fflrxrx.exe192⤵PID:2808
-
\??\c:\htnhtt.exec:\htnhtt.exe193⤵PID:744
-
\??\c:\ppdjd.exec:\ppdjd.exe194⤵PID:2100
-
\??\c:\vvvjd.exec:\vvvjd.exe195⤵PID:840
-
\??\c:\flfrfrf.exec:\flfrfrf.exe196⤵PID:3968
-
\??\c:\hnnntn.exec:\hnnntn.exe197⤵PID:2040
-
\??\c:\tthbhb.exec:\tthbhb.exe198⤵PID:1564
-
\??\c:\vjppj.exec:\vjppj.exe199⤵PID:5012
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe200⤵PID:2528
-
\??\c:\lrxrffr.exec:\lrxrffr.exe201⤵PID:4880
-
\??\c:\tbnnnn.exec:\tbnnnn.exe202⤵PID:2948
-
\??\c:\vvdpd.exec:\vvdpd.exe203⤵PID:1944
-
\??\c:\djvvv.exec:\djvvv.exe204⤵PID:1788
-
\??\c:\ffrrrlx.exec:\ffrrrlx.exe205⤵PID:4404
-
\??\c:\hhhnnt.exec:\hhhnnt.exe206⤵PID:2644
-
\??\c:\bhnnth.exec:\bhnnth.exe207⤵PID:4648
-
\??\c:\vppdj.exec:\vppdj.exe208⤵PID:1520
-
\??\c:\vvdpv.exec:\vvdpv.exe209⤵PID:3916
-
\??\c:\xrfxrrx.exec:\xrfxrrx.exe210⤵PID:1088
-
\??\c:\bbhhhh.exec:\bbhhhh.exe211⤵PID:3244
-
\??\c:\hbtthn.exec:\hbtthn.exe212⤵PID:4492
-
\??\c:\vpdvp.exec:\vpdvp.exe213⤵PID:4864
-
\??\c:\rxfrllf.exec:\rxfrllf.exe214⤵PID:4632
-
\??\c:\nntnnb.exec:\nntnnb.exe215⤵PID:2404
-
\??\c:\btbnbt.exec:\btbnbt.exe216⤵PID:2116
-
\??\c:\jddvv.exec:\jddvv.exe217⤵PID:848
-
\??\c:\lrlfxxl.exec:\lrlfxxl.exe218⤵PID:3548
-
\??\c:\llfflxf.exec:\llfflxf.exe219⤵PID:4612
-
\??\c:\bhnbth.exec:\bhnbth.exe220⤵PID:440
-
\??\c:\ddppd.exec:\ddppd.exe221⤵PID:3224
-
\??\c:\jppdd.exec:\jppdd.exe222⤵PID:3740
-
\??\c:\lrxxxxl.exec:\lrxxxxl.exe223⤵PID:760
-
\??\c:\hnnnnt.exec:\hnnnnt.exe224⤵PID:2820
-
\??\c:\hnbbhn.exec:\hnbbhn.exe225⤵PID:4656
-
\??\c:\ddddd.exec:\ddddd.exe226⤵PID:4020
-
\??\c:\lxfllrr.exec:\lxfllrr.exe227⤵PID:3336
-
\??\c:\9rfxllx.exec:\9rfxllx.exe228⤵PID:4444
-
\??\c:\hbnhhh.exec:\hbnhhh.exe229⤵PID:652
-
\??\c:\7vdvj.exec:\7vdvj.exe230⤵PID:5040
-
\??\c:\pppjd.exec:\pppjd.exe231⤵PID:3100
-
\??\c:\rlxxfll.exec:\rlxxfll.exe232⤵PID:4532
-
\??\c:\lrrrrxr.exec:\lrrrrxr.exe233⤵PID:3232
-
\??\c:\tnntnh.exec:\tnntnh.exe234⤵PID:4128
-
\??\c:\vppjd.exec:\vppjd.exe235⤵PID:376
-
\??\c:\7lrlflf.exec:\7lrlflf.exe236⤵PID:1092
-
\??\c:\5nbbhb.exec:\5nbbhb.exe237⤵PID:4276
-
\??\c:\jdvvd.exec:\jdvvd.exe238⤵PID:2400
-
\??\c:\pvddv.exec:\pvddv.exe239⤵PID:2420
-
\??\c:\rfffxff.exec:\rfffxff.exe240⤵PID:3720
-
\??\c:\3thttn.exec:\3thttn.exe241⤵PID:1368
-
\??\c:\hnntth.exec:\hnntth.exe242⤵PID:1824