Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 07:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe
-
Size
483KB
-
MD5
cad6a385a2d242ff1b36f61072404a63
-
SHA1
825e983c000a1bb6e8e63194f9745ac06a613af7
-
SHA256
19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb
-
SHA512
e5b02afa1dccd23984bf5cf89e0b51461c3708f7b867c2c02ecc2db222c91fcfd9826cac96370feb7649d13429c47b4f33bd934ac21f6e91905c316b6c94bef2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjhtSizjK:q7Tc2NYHUrAwqzcw
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2436-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-102-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3004-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-144-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2724-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-402-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2904-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-413-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1768-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-853-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-912-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/624-1026-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2524-1199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-1250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-1281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ntnbnb.exebththn.exexxrfrrl.exettnbnt.exepjvdv.exetnntnt.exelfxfrlf.exedvpvj.exe1llrffr.exevppdp.exebtthnt.exetbtbth.exenntnhn.exedvvjv.exe5bnhth.exentntnt.exefrrlflf.exe5dddv.exe5xflrfl.exehbntbh.exebbthbh.exetbbbth.exenbnhbn.exeddpjd.exevpvdp.exeffxlfrr.exepvdjv.exeffxlxfx.exennhbht.exepdvjv.exetnbbdd.exelrlfrrf.exetttbnn.exepvvjp.exerrrxflr.exebhnnnh.exe5pvdj.exefxrfxxf.exethbhtb.exehhnhtb.exe7dpvp.exeffrxllx.exettnbtb.exenhtbhn.exe7pjpp.exerlxlfxl.exehhbbtb.exepjvvd.exepvpdp.exe9fxflrl.exe3nhnbh.exe1pjvj.exerlxlxxl.exe5bnthn.exejjjvj.exexxfxrll.exehhbbhn.exetnbbnt.exepjvjp.exefxrrlrf.exennhnhn.exedjdvj.exejpjpj.exerlflflf.exepid process 2120 ntnbnb.exe 2372 bththn.exe 2136 xxrfrrl.exe 2760 ttnbnt.exe 2632 pjvdv.exe 2544 tnntnt.exe 3040 lfxfrlf.exe 2504 dvpvj.exe 2208 1llrffr.exe 3004 vppdp.exe 2728 btthnt.exe 2848 tbtbth.exe 1700 nntnhn.exe 1816 dvvjv.exe 1932 5bnhth.exe 2404 ntntnt.exe 2724 frrlflf.exe 308 5dddv.exe 768 5xflrfl.exe 1740 hbntbh.exe 2488 bbthbh.exe 2952 tbbbth.exe 668 nbnhbn.exe 2264 ddpjd.exe 2204 vpvdp.exe 764 ffxlfrr.exe 1972 pvdjv.exe 892 ffxlxfx.exe 1716 nnhbht.exe 2064 pdvjv.exe 2044 tnbbdd.exe 1728 lrlfrrf.exe 2416 tttbnn.exe 1592 pvvjp.exe 2344 rrrxflr.exe 2824 bhnnnh.exe 2924 5pvdj.exe 2788 fxrfxxf.exe 2636 thbhtb.exe 2752 hhnhtb.exe 2832 7dpvp.exe 2812 ffrxllx.exe 1964 ttnbtb.exe 2796 nhtbhn.exe 3000 7pjpp.exe 2388 rlxlfxl.exe 2160 hhbbtb.exe 2836 pjvvd.exe 2720 pvpdp.exe 2904 9fxflrl.exe 2996 3nhnbh.exe 1952 1pjvj.exe 2320 rlxlxxl.exe 1640 5bnthn.exe 1432 jjjvj.exe 1768 xxfxrll.exe 2496 hhbbhn.exe 804 tnbbnt.exe 2280 pjvjp.exe 2396 fxrrlrf.exe 1896 nnhnhn.exe 2040 djdvj.exe 2492 jpjpj.exe 784 rlflflf.exe -
Processes:
resource yara_rule behavioral1/memory/2436-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-42-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2632-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-402-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2904-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-413-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1952-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-1059-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-1148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-1186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-1199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exentnbnb.exebththn.exexxrfrrl.exettnbnt.exepjvdv.exetnntnt.exelfxfrlf.exedvpvj.exe1llrffr.exevppdp.exebtthnt.exetbtbth.exenntnhn.exedvvjv.exe5bnhth.exedescription pid process target process PID 2436 wrote to memory of 2120 2436 19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe ntnbnb.exe PID 2436 wrote to memory of 2120 2436 19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe ntnbnb.exe PID 2436 wrote to memory of 2120 2436 19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe ntnbnb.exe PID 2436 wrote to memory of 2120 2436 19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe ntnbnb.exe PID 2120 wrote to memory of 2372 2120 ntnbnb.exe bththn.exe PID 2120 wrote to memory of 2372 2120 ntnbnb.exe bththn.exe PID 2120 wrote to memory of 2372 2120 ntnbnb.exe bththn.exe PID 2120 wrote to memory of 2372 2120 ntnbnb.exe bththn.exe PID 2372 wrote to memory of 2136 2372 bththn.exe xxrfrrl.exe PID 2372 wrote to memory of 2136 2372 bththn.exe xxrfrrl.exe PID 2372 wrote to memory of 2136 2372 bththn.exe xxrfrrl.exe PID 2372 wrote to memory of 2136 2372 bththn.exe xxrfrrl.exe PID 2136 wrote to memory of 2760 2136 xxrfrrl.exe ttnbnt.exe PID 2136 wrote to memory of 2760 2136 xxrfrrl.exe ttnbnt.exe PID 2136 wrote to memory of 2760 2136 xxrfrrl.exe ttnbnt.exe PID 2136 wrote to memory of 2760 2136 xxrfrrl.exe ttnbnt.exe PID 2760 wrote to memory of 2632 2760 ttnbnt.exe pjvdv.exe PID 2760 wrote to memory of 2632 2760 ttnbnt.exe pjvdv.exe PID 2760 wrote to memory of 2632 2760 ttnbnt.exe pjvdv.exe PID 2760 wrote to memory of 2632 2760 ttnbnt.exe pjvdv.exe PID 2632 wrote to memory of 2544 2632 pjvdv.exe tnntnt.exe PID 2632 wrote to memory of 2544 2632 pjvdv.exe tnntnt.exe PID 2632 wrote to memory of 2544 2632 pjvdv.exe tnntnt.exe PID 2632 wrote to memory of 2544 2632 pjvdv.exe tnntnt.exe PID 2544 wrote to memory of 3040 2544 tnntnt.exe lfxfrlf.exe PID 2544 wrote to memory of 3040 2544 tnntnt.exe lfxfrlf.exe PID 2544 wrote to memory of 3040 2544 tnntnt.exe lfxfrlf.exe PID 2544 wrote to memory of 3040 2544 tnntnt.exe lfxfrlf.exe PID 3040 wrote to memory of 2504 3040 lfxfrlf.exe dvpvj.exe PID 3040 wrote to memory of 2504 3040 lfxfrlf.exe dvpvj.exe PID 3040 wrote to memory of 2504 3040 lfxfrlf.exe dvpvj.exe PID 3040 wrote to memory of 2504 3040 lfxfrlf.exe dvpvj.exe PID 2504 wrote to memory of 2208 2504 dvpvj.exe 1llrffr.exe PID 2504 wrote to memory of 2208 2504 dvpvj.exe 1llrffr.exe PID 2504 wrote to memory of 2208 2504 dvpvj.exe 1llrffr.exe PID 2504 wrote to memory of 2208 2504 dvpvj.exe 1llrffr.exe PID 2208 wrote to memory of 3004 2208 1llrffr.exe vppdp.exe PID 2208 wrote to memory of 3004 2208 1llrffr.exe vppdp.exe PID 2208 wrote to memory of 3004 2208 1llrffr.exe vppdp.exe PID 2208 wrote to memory of 3004 2208 1llrffr.exe vppdp.exe PID 3004 wrote to memory of 2728 3004 vppdp.exe btthnt.exe PID 3004 wrote to memory of 2728 3004 vppdp.exe btthnt.exe PID 3004 wrote to memory of 2728 3004 vppdp.exe btthnt.exe PID 3004 wrote to memory of 2728 3004 vppdp.exe btthnt.exe PID 2728 wrote to memory of 2848 2728 btthnt.exe tbtbth.exe PID 2728 wrote to memory of 2848 2728 btthnt.exe tbtbth.exe PID 2728 wrote to memory of 2848 2728 btthnt.exe tbtbth.exe PID 2728 wrote to memory of 2848 2728 btthnt.exe tbtbth.exe PID 2848 wrote to memory of 1700 2848 tbtbth.exe nntnhn.exe PID 2848 wrote to memory of 1700 2848 tbtbth.exe nntnhn.exe PID 2848 wrote to memory of 1700 2848 tbtbth.exe nntnhn.exe PID 2848 wrote to memory of 1700 2848 tbtbth.exe nntnhn.exe PID 1700 wrote to memory of 1816 1700 nntnhn.exe dvvjv.exe PID 1700 wrote to memory of 1816 1700 nntnhn.exe dvvjv.exe PID 1700 wrote to memory of 1816 1700 nntnhn.exe dvvjv.exe PID 1700 wrote to memory of 1816 1700 nntnhn.exe dvvjv.exe PID 1816 wrote to memory of 1932 1816 dvvjv.exe 5bnhth.exe PID 1816 wrote to memory of 1932 1816 dvvjv.exe 5bnhth.exe PID 1816 wrote to memory of 1932 1816 dvvjv.exe 5bnhth.exe PID 1816 wrote to memory of 1932 1816 dvvjv.exe 5bnhth.exe PID 1932 wrote to memory of 2404 1932 5bnhth.exe ntntnt.exe PID 1932 wrote to memory of 2404 1932 5bnhth.exe ntntnt.exe PID 1932 wrote to memory of 2404 1932 5bnhth.exe ntntnt.exe PID 1932 wrote to memory of 2404 1932 5bnhth.exe ntntnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\19af1a9ddd3074918572f396382a3fdbfc53a82b7e78d4a27a5e068ced074bfb_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\ntnbnb.exec:\ntnbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\bththn.exec:\bththn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xxrfrrl.exec:\xxrfrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\ttnbnt.exec:\ttnbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pjvdv.exec:\pjvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\tnntnt.exec:\tnntnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lfxfrlf.exec:\lfxfrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\dvpvj.exec:\dvpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\1llrffr.exec:\1llrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\vppdp.exec:\vppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\btthnt.exec:\btthnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\tbtbth.exec:\tbtbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nntnhn.exec:\nntnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\dvvjv.exec:\dvvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\5bnhth.exec:\5bnhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ntntnt.exec:\ntntnt.exe17⤵
- Executes dropped EXE
PID:2404 -
\??\c:\frrlflf.exec:\frrlflf.exe18⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5dddv.exec:\5dddv.exe19⤵
- Executes dropped EXE
PID:308 -
\??\c:\5xflrfl.exec:\5xflrfl.exe20⤵
- Executes dropped EXE
PID:768 -
\??\c:\hbntbh.exec:\hbntbh.exe21⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bbthbh.exec:\bbthbh.exe22⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tbbbth.exec:\tbbbth.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nbnhbn.exec:\nbnhbn.exe24⤵
- Executes dropped EXE
PID:668 -
\??\c:\ddpjd.exec:\ddpjd.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpvdp.exec:\vpvdp.exe26⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ffxlfrr.exec:\ffxlfrr.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\pvdjv.exec:\pvdjv.exe28⤵
- Executes dropped EXE
PID:1972 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe29⤵
- Executes dropped EXE
PID:892 -
\??\c:\nnhbht.exec:\nnhbht.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pdvjv.exec:\pdvjv.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tnbbdd.exec:\tnbbdd.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lrlfrrf.exec:\lrlfrrf.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\tttbnn.exec:\tttbnn.exe34⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pvvjp.exec:\pvvjp.exe35⤵
- Executes dropped EXE
PID:1592 -
\??\c:\rrrxflr.exec:\rrrxflr.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bhnnnh.exec:\bhnnnh.exe37⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5pvdj.exec:\5pvdj.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fxrfxxf.exec:\fxrfxxf.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\thbhtb.exec:\thbhtb.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hhnhtb.exec:\hhnhtb.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7dpvp.exec:\7dpvp.exe42⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ffrxllx.exec:\ffrxllx.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ttnbtb.exec:\ttnbtb.exe44⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhtbhn.exec:\nhtbhn.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7pjpp.exec:\7pjpp.exe46⤵
- Executes dropped EXE
PID:3000 -
\??\c:\rlxlfxl.exec:\rlxlfxl.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hhbbtb.exec:\hhbbtb.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pjvvd.exec:\pjvvd.exe49⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pvpdp.exec:\pvpdp.exe50⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9fxflrl.exec:\9fxflrl.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3nhnbh.exec:\3nhnbh.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1pjvj.exec:\1pjvj.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5bnthn.exec:\5bnthn.exe55⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jjjvj.exec:\jjjvj.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xxfxrll.exec:\xxfxrll.exe57⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hhbbhn.exec:\hhbbhn.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnbbnt.exec:\tnbbnt.exe59⤵
- Executes dropped EXE
PID:804 -
\??\c:\pjvjp.exec:\pjvjp.exe60⤵
- Executes dropped EXE
PID:2280 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nnhnhn.exec:\nnhnhn.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djdvj.exec:\djdvj.exe63⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jpjpj.exec:\jpjpj.exe64⤵
- Executes dropped EXE
PID:2492 -
\??\c:\rlflflf.exec:\rlflflf.exe65⤵
- Executes dropped EXE
PID:784 -
\??\c:\5tntbn.exec:\5tntbn.exe66⤵PID:2480
-
\??\c:\1dvdj.exec:\1dvdj.exe67⤵PID:1764
-
\??\c:\5rlxfrf.exec:\5rlxfrf.exe68⤵PID:2000
-
\??\c:\rrrrfrf.exec:\rrrrfrf.exe69⤵PID:1316
-
\??\c:\tbbtnb.exec:\tbbtnb.exe70⤵PID:1976
-
\??\c:\7jvdv.exec:\7jvdv.exe71⤵PID:2236
-
\??\c:\llfrlfx.exec:\llfrlfx.exe72⤵PID:1780
-
\??\c:\3lxxffr.exec:\3lxxffr.exe73⤵PID:1384
-
\??\c:\bhhbtn.exec:\bhhbtn.exe74⤵PID:1508
-
\??\c:\vvpdv.exec:\vvpdv.exe75⤵PID:2192
-
\??\c:\lxlxxfx.exec:\lxlxxfx.exe76⤵PID:876
-
\??\c:\lfrxllx.exec:\lfrxllx.exe77⤵PID:1232
-
\??\c:\tttbhn.exec:\tttbhn.exe78⤵PID:1560
-
\??\c:\dvpjv.exec:\dvpjv.exe79⤵PID:2332
-
\??\c:\rrllflx.exec:\rrllflx.exe80⤵PID:2688
-
\??\c:\ffxfxfr.exec:\ffxfxfr.exe81⤵PID:2612
-
\??\c:\3tnbhn.exec:\3tnbhn.exe82⤵PID:2772
-
\??\c:\vdvdv.exec:\vdvdv.exe83⤵PID:2656
-
\??\c:\xlxrxxl.exec:\xlxrxxl.exe84⤵PID:2768
-
\??\c:\xrfrflx.exec:\xrfrflx.exe85⤵PID:2080
-
\??\c:\tbthtt.exec:\tbthtt.exe86⤵PID:2532
-
\??\c:\pppjp.exec:\pppjp.exe87⤵PID:2800
-
\??\c:\rlflxfx.exec:\rlflxfx.exe88⤵PID:3040
-
\??\c:\tttnbh.exec:\tttnbh.exe89⤵PID:2796
-
\??\c:\pjvjp.exec:\pjvjp.exe90⤵PID:3024
-
\??\c:\vvvjv.exec:\vvvjv.exe91⤵PID:2388
-
\??\c:\lxrlfrl.exec:\lxrlfrl.exe92⤵PID:2700
-
\??\c:\hhbnbb.exec:\hhbnbb.exe93⤵PID:2836
-
\??\c:\vvpdj.exec:\vvpdj.exe94⤵PID:2484
-
\??\c:\xxfrlxr.exec:\xxfrlxr.exe95⤵PID:2992
-
\??\c:\3tnbtt.exec:\3tnbtt.exe96⤵PID:2424
-
\??\c:\9jdpd.exec:\9jdpd.exe97⤵PID:880
-
\??\c:\vppjj.exec:\vppjj.exe98⤵PID:1396
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe99⤵PID:1704
-
\??\c:\3ttbnn.exec:\3ttbnn.exe100⤵PID:1948
-
\??\c:\jpjdp.exec:\jpjdp.exe101⤵PID:2704
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe102⤵PID:2724
-
\??\c:\hnhbtb.exec:\hnhbtb.exe103⤵PID:1532
-
\??\c:\rxrxxfx.exec:\rxrxxfx.exe104⤵PID:2280
-
\??\c:\7rlrlrf.exec:\7rlrlrf.exe105⤵PID:2396
-
\??\c:\ttttbh.exec:\ttttbh.exe106⤵PID:2488
-
\??\c:\9vvvd.exec:\9vvvd.exe107⤵PID:332
-
\??\c:\5lfxllx.exec:\5lfxllx.exe108⤵PID:2196
-
\??\c:\7hnbbb.exec:\7hnbbb.exe109⤵PID:2376
-
\??\c:\jjvjv.exec:\jjvjv.exe110⤵PID:1792
-
\??\c:\lrrrxrx.exec:\lrrrxrx.exe111⤵PID:1852
-
\??\c:\9nbtnt.exec:\9nbtnt.exe112⤵PID:1940
-
\??\c:\tntbnt.exec:\tntbnt.exe113⤵PID:1316
-
\??\c:\5jjjj.exec:\5jjjj.exe114⤵PID:1980
-
\??\c:\rlrflrf.exec:\rlrflrf.exe115⤵PID:2236
-
\??\c:\tnhbbb.exec:\tnhbbb.exe116⤵PID:2456
-
\??\c:\dvpdp.exec:\dvpdp.exe117⤵PID:2828
-
\??\c:\3fflfrf.exec:\3fflfrf.exe118⤵PID:1508
-
\??\c:\3nhthh.exec:\3nhthh.exe119⤵PID:2172
-
\??\c:\ntnnbn.exec:\ntnnbn.exe120⤵PID:1588
-
\??\c:\3pdjd.exec:\3pdjd.exe121⤵PID:2128
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe122⤵PID:1592
-
\??\c:\nnbhtt.exec:\nnbhtt.exe123⤵PID:2332
-
\??\c:\jjvjv.exec:\jjvjv.exe124⤵PID:2652
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe125⤵PID:2612
-
\??\c:\nbtbhn.exec:\nbtbhn.exe126⤵PID:2772
-
\??\c:\bnhhbb.exec:\bnhhbb.exe127⤵PID:2748
-
\??\c:\1dpvp.exec:\1dpvp.exe128⤵PID:2640
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe129⤵PID:2080
-
\??\c:\nnhttb.exec:\nnhttb.exe130⤵PID:2532
-
\??\c:\bbhnth.exec:\bbhnth.exe131⤵PID:2580
-
\??\c:\vpjpd.exec:\vpjpd.exe132⤵PID:2584
-
\??\c:\ffxfxrl.exec:\ffxfxrl.exe133⤵PID:2676
-
\??\c:\3nbnth.exec:\3nbnth.exe134⤵PID:2740
-
\??\c:\hbthnt.exec:\hbthnt.exe135⤵PID:2160
-
\??\c:\jjddv.exec:\jjddv.exe136⤵PID:2884
-
\??\c:\3fxflxl.exec:\3fxflxl.exe137⤵PID:2876
-
\??\c:\1fxflrf.exec:\1fxflrf.exe138⤵PID:2856
-
\??\c:\9ntbnn.exec:\9ntbnn.exe139⤵PID:1856
-
\??\c:\ddpdv.exec:\ddpdv.exe140⤵PID:1944
-
\??\c:\rxxfflr.exec:\rxxfflr.exe141⤵PID:1952
-
\??\c:\xxrxxfr.exec:\xxrxxfr.exe142⤵PID:880
-
\??\c:\tthtnt.exec:\tthtnt.exe143⤵PID:1396
-
\??\c:\ddpjj.exec:\ddpjj.exe144⤵PID:1704
-
\??\c:\7pvjd.exec:\7pvjd.exe145⤵PID:1948
-
\??\c:\fxlxlxl.exec:\fxlxlxl.exe146⤵PID:2704
-
\??\c:\ttntbn.exec:\ttntbn.exe147⤵PID:624
-
\??\c:\vddjv.exec:\vddjv.exe148⤵PID:884
-
\??\c:\9xrxlrr.exec:\9xrxlrr.exe149⤵PID:1904
-
\??\c:\1btbhn.exec:\1btbhn.exe150⤵PID:2280
-
\??\c:\pjppd.exec:\pjppd.exe151⤵PID:2944
-
\??\c:\1jdjv.exec:\1jdjv.exe152⤵PID:1516
-
\??\c:\1rrflxr.exec:\1rrflxr.exe153⤵PID:484
-
\??\c:\nnnbnb.exec:\nnnbnb.exe154⤵PID:2196
-
\??\c:\5vjpd.exec:\5vjpd.exe155⤵PID:2264
-
\??\c:\xfflxlf.exec:\xfflxlf.exe156⤵PID:2028
-
\??\c:\nnhnhh.exec:\nnhnhh.exe157⤵PID:1652
-
\??\c:\nnnbnt.exec:\nnnbnt.exe158⤵PID:1992
-
\??\c:\ppjjv.exec:\ppjjv.exe159⤵PID:1804
-
\??\c:\xfxlffr.exec:\xfxlffr.exe160⤵PID:1980
-
\??\c:\7hbntb.exec:\7hbntb.exe161⤵PID:1716
-
\??\c:\jddvp.exec:\jddvp.exe162⤵PID:2456
-
\??\c:\pjdvj.exec:\pjdvj.exe163⤵PID:2828
-
\??\c:\fflxrlx.exec:\fflxrlx.exe164⤵PID:3060
-
\??\c:\9tbnnt.exec:\9tbnnt.exe165⤵PID:1092
-
\??\c:\httttn.exec:\httttn.exe166⤵PID:1232
-
\??\c:\jpdjj.exec:\jpdjj.exe167⤵PID:2128
-
\??\c:\xxxlxlx.exec:\xxxlxlx.exe168⤵PID:1656
-
\??\c:\hbbnhh.exec:\hbbnhh.exe169⤵PID:2332
-
\??\c:\ppdpd.exec:\ppdpd.exe170⤵PID:2652
-
\??\c:\djpjp.exec:\djpjp.exe171⤵PID:2240
-
\??\c:\rrxrflx.exec:\rrxrflx.exe172⤵PID:2668
-
\??\c:\thbthn.exec:\thbthn.exe173⤵PID:2748
-
\??\c:\pdpdd.exec:\pdpdd.exe174⤵PID:2672
-
\??\c:\lrlrxfx.exec:\lrlrxfx.exe175⤵PID:2524
-
\??\c:\rlxxflf.exec:\rlxxflf.exe176⤵PID:1964
-
\??\c:\bbtbth.exec:\bbtbth.exe177⤵PID:2336
-
\??\c:\pvjvp.exec:\pvjvp.exe178⤵PID:2796
-
\??\c:\djppd.exec:\djppd.exe179⤵PID:2556
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe180⤵PID:2388
-
\??\c:\ttnhhb.exec:\ttnhhb.exe181⤵PID:2888
-
\??\c:\vdvdv.exec:\vdvdv.exe182⤵PID:2872
-
\??\c:\lfrxxfr.exec:\lfrxxfr.exe183⤵PID:2728
-
\??\c:\hnnnbh.exec:\hnnnbh.exe184⤵PID:2992
-
\??\c:\ddppd.exec:\ddppd.exe185⤵PID:1920
-
\??\c:\jjddd.exec:\jjddd.exe186⤵PID:1932
-
\??\c:\7xfrlxf.exec:\7xfrlxf.exe187⤵PID:1052
-
\??\c:\nnbtnn.exec:\nnbtnn.exe188⤵PID:1432
-
\??\c:\ddvvj.exec:\ddvvj.exe189⤵PID:1308
-
\??\c:\rxfxxxf.exec:\rxfxxxf.exe190⤵PID:2248
-
\??\c:\rlfxllx.exec:\rlfxllx.exe191⤵PID:2068
-
\??\c:\5thhtb.exec:\5thhtb.exe192⤵PID:1796
-
\??\c:\vpvdv.exec:\vpvdv.exe193⤵PID:2008
-
\??\c:\vvpvd.exec:\vvpvd.exe194⤵PID:2012
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe195⤵PID:1612
-
\??\c:\nhtbht.exec:\nhtbht.exe196⤵PID:1576
-
\??\c:\hhhnhn.exec:\hhhnhn.exe197⤵PID:2952
-
\??\c:\3jdjp.exec:\3jdjp.exe198⤵PID:776
-
\??\c:\llrfrxf.exec:\llrfrxf.exe199⤵PID:2384
-
\??\c:\5nnnbh.exec:\5nnnbh.exe200⤵PID:2196
-
\??\c:\nhthtt.exec:\nhthtt.exe201⤵PID:2564
-
\??\c:\9jjvj.exec:\9jjvj.exe202⤵PID:2304
-
\??\c:\lrlxffr.exec:\lrlxffr.exe203⤵PID:1652
-
\??\c:\xrxlxxl.exec:\xrxlxxl.exe204⤵PID:1992
-
\??\c:\5thntt.exec:\5thntt.exe205⤵PID:912
-
\??\c:\vpdpd.exec:\vpdpd.exe206⤵PID:544
-
\??\c:\frllrrl.exec:\frllrrl.exe207⤵PID:888
-
\??\c:\nhhnbb.exec:\nhhnbb.exe208⤵PID:2044
-
\??\c:\hnhbnb.exec:\hnhbnb.exe209⤵PID:2828
-
\??\c:\9pjjj.exec:\9pjjj.exe210⤵PID:1736
-
\??\c:\rrfrflf.exec:\rrfrflf.exe211⤵PID:1092
-
\??\c:\5rrfflf.exec:\5rrfflf.exe212⤵PID:2416
-
\??\c:\hbnthb.exec:\hbnthb.exe213⤵PID:2364
-
\??\c:\jjvdp.exec:\jjvdp.exe214⤵PID:2072
-
\??\c:\ffxxllr.exec:\ffxxllr.exe215⤵PID:2908
-
\??\c:\tbntnb.exec:\tbntnb.exe216⤵PID:2920
-
\??\c:\3nhnhh.exec:\3nhnhh.exe217⤵PID:2636
-
\??\c:\jjvdp.exec:\jjvdp.exe218⤵PID:2624
-
\??\c:\rxxllfx.exec:\rxxllfx.exe219⤵PID:2816
-
\??\c:\1xlxxxr.exec:\1xlxxxr.exe220⤵PID:2620
-
\??\c:\7hthtt.exec:\7hthtt.exe221⤵PID:2800
-
\??\c:\vvpvv.exec:\vvpvv.exe222⤵PID:2212
-
\??\c:\pvdjv.exec:\pvdjv.exe223⤵PID:3000
-
\??\c:\fxrrfrl.exec:\fxrrfrl.exe224⤵PID:1348
-
\??\c:\nnntnt.exec:\nnntnt.exe225⤵PID:1936
-
\??\c:\ppvpp.exec:\ppvpp.exe226⤵PID:2556
-
\??\c:\jvjvv.exec:\jvjvv.exe227⤵PID:2696
-
\??\c:\rlrlllr.exec:\rlrlllr.exe228⤵PID:2888
-
\??\c:\3bnnbh.exec:\3bnnbh.exe229⤵PID:1060
-
\??\c:\7hhthb.exec:\7hhthb.exe230⤵PID:2876
-
\??\c:\djjvj.exec:\djjvj.exe231⤵PID:2992
-
\??\c:\rxlrrfr.exec:\rxlrrfr.exe232⤵PID:1920
-
\??\c:\lllflxr.exec:\lllflxr.exe233⤵PID:1628
-
\??\c:\tthnbh.exec:\tthnbh.exe234⤵PID:1052
-
\??\c:\ppjpp.exec:\ppjpp.exe235⤵PID:2568
-
\??\c:\fllxrff.exec:\fllxrff.exe236⤵PID:1704
-
\??\c:\rlflxfx.exec:\rlflxfx.exe237⤵PID:1156
-
\??\c:\bhnhbt.exec:\bhnhbt.exe238⤵PID:2472
-
\??\c:\3pjjv.exec:\3pjjv.exe239⤵PID:2900
-
\??\c:\rfxlflr.exec:\rfxlflr.exe240⤵PID:2228
-
\??\c:\frlrrxl.exec:\frlrrxl.exe241⤵PID:1712
-
\??\c:\tnhnhh.exec:\tnhnhh.exe242⤵PID:2040