Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 10:07
Behavioral task
behavioral1
Sample
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe
-
Size
441KB
-
MD5
15a3a1e3d0537ff0a2fa18e54f2c2640
-
SHA1
2a9f6b339a9820e2d8067160419ad5157b7f1dce
-
SHA256
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717
-
SHA512
c3bb391d66015a4ce997df167c9403497bb162063adf68f61d074b1f50b7d3e8343872224a04d46038d3dd70db99c07b2c5b2d445493e750bf2316c021403257
-
SSDEEP
12288:w4wFHoS9KxbNnidEhjEJd1kNpeUgI95yRoZHVaoJMOxFXnRV4PiGO0hUmHZ:kKxbNndhjEJd1kNpeUgI95yRoZHgoJMj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2060-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3780-6-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2972-16-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3508-22-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3004-25-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1968-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4556-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4156-48-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4856-50-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/976-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2160-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1848-79-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1556-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2820-91-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2364-101-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/428-107-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3256-108-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4420-120-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2320-125-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4824-141-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4552-152-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4932-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2740-169-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4440-175-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4412-179-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4500-182-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4136-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-198-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3000-203-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4664-209-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/668-213-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/628-229-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/764-236-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3688-249-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1456-262-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1076-266-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/60-268-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2028-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2632-287-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1732-302-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4292-303-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3220-307-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/780-320-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/968-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4680-341-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/596-345-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4492-364-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4572-384-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1688-394-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3740-410-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1416-455-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4616-458-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3776-471-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/948-481-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4896-497-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3252-549-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3252-553-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1264-578-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1732-585-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4072-587-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4176-640-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3980-666-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2576-682-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2672-767-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\rffllll.exe family_berbew C:\btbtnh.exe family_berbew C:\tbbbbb.exe family_berbew C:\rxrrrll.exe family_berbew C:\pvjjj.exe family_berbew C:\ddvvp.exe family_berbew C:\nthbhh.exe family_berbew C:\xllfxrx.exe family_berbew \??\c:\tnnbtn.exe family_berbew C:\pppjd.exe family_berbew \??\c:\1bhtnh.exe family_berbew C:\3lrlfxr.exe family_berbew C:\hhtbnt.exe family_berbew C:\pdvjd.exe family_berbew \??\c:\htnhtn.exe family_berbew \??\c:\5vjdv.exe family_berbew C:\btttnn.exe family_berbew C:\jpjjj.exe family_berbew C:\hthhbt.exe family_berbew C:\tnnhbt.exe family_berbew C:\fxxrrll.exe family_berbew \??\c:\bbtbtn.exe family_berbew C:\jjjjd.exe family_berbew \??\c:\llllxll.exe family_berbew C:\btnbnn.exe family_berbew C:\vpvvv.exe family_berbew C:\nnttnh.exe family_berbew \??\c:\9djdv.exe family_berbew \??\c:\fxxfxxx.exe family_berbew C:\nhbtnh.exe family_berbew C:\pjjjd.exe family_berbew \??\c:\fxfrllx.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rffllll.exebtbtnh.exetbbbbb.exerxrrrll.exepvjjj.exeddvvp.exenthbhh.exexllfxrx.exetnnbtn.exepppjd.exe1bhtnh.exe3lrlfxr.exehhtbnt.exepdvjd.exehtnhtn.exe5vjdv.exebtttnn.exejpjjj.exehthhbt.exetnnhbt.exefxxrrll.exebbtbtn.exejjjjd.exellllxll.exebtnbnn.exevpvvv.exennttnh.exe9djdv.exefxxfxxx.exepjjjd.exenhbtnh.exefxfrllx.exexffxrxr.exebnhbtt.exedvpdd.exelxrlfxr.exebhbhtt.exe7hhhnn.exeppppj.exexfrxrll.exenttnnt.exevjpjv.exerffxlfr.exethtnhh.exedppjj.exefrlxrlf.exentbtnt.exehbnnhh.exe5jjjd.exelrxrlff.exebbnhbb.exedjpjd.exeppppj.exe9xfxrll.exe3nhbnh.exenhtttt.exepvvpj.exe9rfxrrl.exelffxrrf.exe3tbthb.exepvddv.exedpvpj.exerfrllfx.exenbhhnn.exepid process 2060 rffllll.exe 2972 btbtnh.exe 3508 tbbbbb.exe 3004 rxrrrll.exe 1968 pvjjj.exe 4556 ddvvp.exe 4156 nthbhh.exe 4856 xllfxrx.exe 3688 tnnbtn.exe 976 pppjd.exe 2160 1bhtnh.exe 5056 3lrlfxr.exe 1848 hhtbnt.exe 1556 pdvjd.exe 2820 htnhtn.exe 2364 5vjdv.exe 428 btttnn.exe 3256 jpjjj.exe 1416 hthhbt.exe 4420 tnnhbt.exe 2320 fxxrrll.exe 3920 bbtbtn.exe 2324 jjjjd.exe 4824 llllxll.exe 4552 btnbnn.exe 4932 vpvvv.exe 4108 nnttnh.exe 2740 9djdv.exe 4440 fxxfxxx.exe 4412 pjjjd.exe 4500 nhbtnh.exe 4212 fxfrllx.exe 4136 xffxrxr.exe 2068 bnhbtt.exe 1204 dvpdd.exe 3000 lxrlfxr.exe 4664 bhbhtt.exe 668 7hhhnn.exe 3524 ppppj.exe 4056 xfrxrll.exe 4128 nttnnt.exe 3008 vjpjv.exe 628 rffxlfr.exe 868 thtnhh.exe 1272 dppjj.exe 764 frlxrlf.exe 3188 ntbtnt.exe 2200 hbnnhh.exe 3688 5jjjd.exe 2796 lrxrlff.exe 4996 bbnhbb.exe 3252 djpjd.exe 1456 ppppj.exe 1076 9xfxrll.exe 60 3nhbnh.exe 3240 nhtttt.exe 3244 pvvpj.exe 4012 9rfxrrl.exe 1960 lffxrrf.exe 2028 3tbthb.exe 2632 pvddv.exe 3760 dpvpj.exe 4504 rfrllfx.exe 1732 nbhhnn.exe -
Processes:
resource yara_rule behavioral2/memory/3780-0-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rffllll.exe upx behavioral2/memory/2060-8-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\btbtnh.exe upx behavioral2/memory/3780-6-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\tbbbbb.exe upx behavioral2/memory/2972-16-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3508-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3508-22-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rxrrrll.exe upx behavioral2/memory/3004-25-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pvjjj.exe upx behavioral2/memory/1968-31-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\ddvvp.exe upx behavioral2/memory/1968-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4556-38-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nthbhh.exe upx behavioral2/memory/4556-42-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xllfxrx.exe upx behavioral2/memory/4156-48-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4856-50-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\tnnbtn.exe upx C:\pppjd.exe upx behavioral2/memory/976-65-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\1bhtnh.exe upx behavioral2/memory/2160-67-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\3lrlfxr.exe upx C:\hhtbnt.exe upx behavioral2/memory/1848-79-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pdvjd.exe upx \??\c:\htnhtn.exe upx behavioral2/memory/1556-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2820-91-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\5vjdv.exe upx C:\btttnn.exe upx behavioral2/memory/2364-101-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jpjjj.exe upx behavioral2/memory/428-107-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3256-108-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\hthhbt.exe upx C:\tnnhbt.exe upx behavioral2/memory/4420-120-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\fxxrrll.exe upx behavioral2/memory/2320-125-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\bbtbtn.exe upx C:\jjjjd.exe upx \??\c:\llllxll.exe upx behavioral2/memory/4824-141-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\btnbnn.exe upx C:\vpvvv.exe upx behavioral2/memory/4552-152-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4932-153-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nnttnh.exe upx \??\c:\9djdv.exe upx \??\c:\fxxfxxx.exe upx behavioral2/memory/2740-169-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4440-175-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nhbtnh.exe upx behavioral2/memory/4412-179-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4500-182-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pjjjd.exe upx \??\c:\fxfrllx.exe upx behavioral2/memory/4136-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2068-198-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exerffllll.exebtbtnh.exetbbbbb.exerxrrrll.exepvjjj.exeddvvp.exenthbhh.exexllfxrx.exetnnbtn.exepppjd.exe1bhtnh.exe3lrlfxr.exehhtbnt.exepdvjd.exehtnhtn.exe5vjdv.exebtttnn.exejpjjj.exehthhbt.exetnnhbt.exefxxrrll.exedescription pid process target process PID 3780 wrote to memory of 2060 3780 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe rffllll.exe PID 3780 wrote to memory of 2060 3780 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe rffllll.exe PID 3780 wrote to memory of 2060 3780 32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe rffllll.exe PID 2060 wrote to memory of 2972 2060 rffllll.exe btbtnh.exe PID 2060 wrote to memory of 2972 2060 rffllll.exe btbtnh.exe PID 2060 wrote to memory of 2972 2060 rffllll.exe btbtnh.exe PID 2972 wrote to memory of 3508 2972 btbtnh.exe tbbbbb.exe PID 2972 wrote to memory of 3508 2972 btbtnh.exe tbbbbb.exe PID 2972 wrote to memory of 3508 2972 btbtnh.exe tbbbbb.exe PID 3508 wrote to memory of 3004 3508 tbbbbb.exe rxrrrll.exe PID 3508 wrote to memory of 3004 3508 tbbbbb.exe rxrrrll.exe PID 3508 wrote to memory of 3004 3508 tbbbbb.exe rxrrrll.exe PID 3004 wrote to memory of 1968 3004 rxrrrll.exe pvjjj.exe PID 3004 wrote to memory of 1968 3004 rxrrrll.exe pvjjj.exe PID 3004 wrote to memory of 1968 3004 rxrrrll.exe pvjjj.exe PID 1968 wrote to memory of 4556 1968 pvjjj.exe ddvvp.exe PID 1968 wrote to memory of 4556 1968 pvjjj.exe ddvvp.exe PID 1968 wrote to memory of 4556 1968 pvjjj.exe ddvvp.exe PID 4556 wrote to memory of 4156 4556 ddvvp.exe nthbhh.exe PID 4556 wrote to memory of 4156 4556 ddvvp.exe nthbhh.exe PID 4556 wrote to memory of 4156 4556 ddvvp.exe nthbhh.exe PID 4156 wrote to memory of 4856 4156 nthbhh.exe xllfxrx.exe PID 4156 wrote to memory of 4856 4156 nthbhh.exe xllfxrx.exe PID 4156 wrote to memory of 4856 4156 nthbhh.exe xllfxrx.exe PID 4856 wrote to memory of 3688 4856 xllfxrx.exe tnnbtn.exe PID 4856 wrote to memory of 3688 4856 xllfxrx.exe tnnbtn.exe PID 4856 wrote to memory of 3688 4856 xllfxrx.exe tnnbtn.exe PID 3688 wrote to memory of 976 3688 tnnbtn.exe pppjd.exe PID 3688 wrote to memory of 976 3688 tnnbtn.exe pppjd.exe PID 3688 wrote to memory of 976 3688 tnnbtn.exe pppjd.exe PID 976 wrote to memory of 2160 976 pppjd.exe 1bhtnh.exe PID 976 wrote to memory of 2160 976 pppjd.exe 1bhtnh.exe PID 976 wrote to memory of 2160 976 pppjd.exe 1bhtnh.exe PID 2160 wrote to memory of 5056 2160 1bhtnh.exe 3lrlfxr.exe PID 2160 wrote to memory of 5056 2160 1bhtnh.exe 3lrlfxr.exe PID 2160 wrote to memory of 5056 2160 1bhtnh.exe 3lrlfxr.exe PID 5056 wrote to memory of 1848 5056 3lrlfxr.exe hhtbnt.exe PID 5056 wrote to memory of 1848 5056 3lrlfxr.exe hhtbnt.exe PID 5056 wrote to memory of 1848 5056 3lrlfxr.exe hhtbnt.exe PID 1848 wrote to memory of 1556 1848 hhtbnt.exe pdvjd.exe PID 1848 wrote to memory of 1556 1848 hhtbnt.exe pdvjd.exe PID 1848 wrote to memory of 1556 1848 hhtbnt.exe pdvjd.exe PID 1556 wrote to memory of 2820 1556 pdvjd.exe htnhtn.exe PID 1556 wrote to memory of 2820 1556 pdvjd.exe htnhtn.exe PID 1556 wrote to memory of 2820 1556 pdvjd.exe htnhtn.exe PID 2820 wrote to memory of 2364 2820 htnhtn.exe 5vjdv.exe PID 2820 wrote to memory of 2364 2820 htnhtn.exe 5vjdv.exe PID 2820 wrote to memory of 2364 2820 htnhtn.exe 5vjdv.exe PID 2364 wrote to memory of 428 2364 5vjdv.exe btttnn.exe PID 2364 wrote to memory of 428 2364 5vjdv.exe btttnn.exe PID 2364 wrote to memory of 428 2364 5vjdv.exe btttnn.exe PID 428 wrote to memory of 3256 428 btttnn.exe jpjjj.exe PID 428 wrote to memory of 3256 428 btttnn.exe jpjjj.exe PID 428 wrote to memory of 3256 428 btttnn.exe jpjjj.exe PID 3256 wrote to memory of 1416 3256 jpjjj.exe hthhbt.exe PID 3256 wrote to memory of 1416 3256 jpjjj.exe hthhbt.exe PID 3256 wrote to memory of 1416 3256 jpjjj.exe hthhbt.exe PID 1416 wrote to memory of 4420 1416 hthhbt.exe tnnhbt.exe PID 1416 wrote to memory of 4420 1416 hthhbt.exe tnnhbt.exe PID 1416 wrote to memory of 4420 1416 hthhbt.exe tnnhbt.exe PID 4420 wrote to memory of 2320 4420 tnnhbt.exe fxxrrll.exe PID 4420 wrote to memory of 2320 4420 tnnhbt.exe fxxrrll.exe PID 4420 wrote to memory of 2320 4420 tnnhbt.exe fxxrrll.exe PID 2320 wrote to memory of 3920 2320 fxxrrll.exe bbtbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\32e4aaa8afe3d607a87bb3ebfccb79a64df788b14de7082c989d2ca908f60717_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\rffllll.exec:\rffllll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btbtnh.exec:\btbtnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbbbb.exec:\tbbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrrrll.exec:\rxrrrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvjjj.exec:\pvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ddvvp.exec:\ddvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nthbhh.exec:\nthbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xllfxrx.exec:\xllfxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnbtn.exec:\tnnbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pppjd.exec:\pppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\1bhtnh.exec:\1bhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3lrlfxr.exec:\3lrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhtbnt.exec:\hhtbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdvjd.exec:\pdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\htnhtn.exec:\htnhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5vjdv.exec:\5vjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\btttnn.exec:\btttnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjjj.exec:\jpjjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hthhbt.exec:\hthhbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tnnhbt.exec:\tnnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\fxxrrll.exec:\fxxrrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bbtbtn.exec:\bbtbtn.exe23⤵
- Executes dropped EXE
-
\??\c:\jjjjd.exec:\jjjjd.exe24⤵
- Executes dropped EXE
-
\??\c:\llllxll.exec:\llllxll.exe25⤵
- Executes dropped EXE
-
\??\c:\btnbnn.exec:\btnbnn.exe26⤵
- Executes dropped EXE
-
\??\c:\vpvvv.exec:\vpvvv.exe27⤵
- Executes dropped EXE
-
\??\c:\nnttnh.exec:\nnttnh.exe28⤵
- Executes dropped EXE
-
\??\c:\9djdv.exec:\9djdv.exe29⤵
- Executes dropped EXE
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe30⤵
- Executes dropped EXE
-
\??\c:\pjjjd.exec:\pjjjd.exe31⤵
- Executes dropped EXE
-
\??\c:\nhbtnh.exec:\nhbtnh.exe32⤵
- Executes dropped EXE
-
\??\c:\fxfrllx.exec:\fxfrllx.exe33⤵
- Executes dropped EXE
-
\??\c:\xffxrxr.exec:\xffxrxr.exe34⤵
- Executes dropped EXE
-
\??\c:\bnhbtt.exec:\bnhbtt.exe35⤵
- Executes dropped EXE
-
\??\c:\dvpdd.exec:\dvpdd.exe36⤵
- Executes dropped EXE
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe37⤵
- Executes dropped EXE
-
\??\c:\bhbhtt.exec:\bhbhtt.exe38⤵
- Executes dropped EXE
-
\??\c:\7hhhnn.exec:\7hhhnn.exe39⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe40⤵
- Executes dropped EXE
-
\??\c:\xfrxrll.exec:\xfrxrll.exe41⤵
- Executes dropped EXE
-
\??\c:\nttnnt.exec:\nttnnt.exe42⤵
- Executes dropped EXE
-
\??\c:\vjpjv.exec:\vjpjv.exe43⤵
- Executes dropped EXE
-
\??\c:\rffxlfr.exec:\rffxlfr.exe44⤵
- Executes dropped EXE
-
\??\c:\thtnhh.exec:\thtnhh.exe45⤵
- Executes dropped EXE
-
\??\c:\dppjj.exec:\dppjj.exe46⤵
- Executes dropped EXE
-
\??\c:\frlxrlf.exec:\frlxrlf.exe47⤵
- Executes dropped EXE
-
\??\c:\ntbtnt.exec:\ntbtnt.exe48⤵
- Executes dropped EXE
-
\??\c:\hbnnhh.exec:\hbnnhh.exe49⤵
- Executes dropped EXE
-
\??\c:\5jjjd.exec:\5jjjd.exe50⤵
- Executes dropped EXE
-
\??\c:\lrxrlff.exec:\lrxrlff.exe51⤵
- Executes dropped EXE
-
\??\c:\bbnhbb.exec:\bbnhbb.exe52⤵
- Executes dropped EXE
-
\??\c:\djpjd.exec:\djpjd.exe53⤵
- Executes dropped EXE
-
\??\c:\ppppj.exec:\ppppj.exe54⤵
- Executes dropped EXE
-
\??\c:\9xfxrll.exec:\9xfxrll.exe55⤵
- Executes dropped EXE
-
\??\c:\3nhbnh.exec:\3nhbnh.exe56⤵
- Executes dropped EXE
-
\??\c:\nhtttt.exec:\nhtttt.exe57⤵
- Executes dropped EXE
-
\??\c:\pvvpj.exec:\pvvpj.exe58⤵
- Executes dropped EXE
-
\??\c:\9rfxrrl.exec:\9rfxrrl.exe59⤵
- Executes dropped EXE
-
\??\c:\lffxrrf.exec:\lffxrrf.exe60⤵
- Executes dropped EXE
-
\??\c:\3tbthb.exec:\3tbthb.exe61⤵
- Executes dropped EXE
-
\??\c:\pvddv.exec:\pvddv.exe62⤵
- Executes dropped EXE
-
\??\c:\dpvpj.exec:\dpvpj.exe63⤵
- Executes dropped EXE
-
\??\c:\rfrllfx.exec:\rfrllfx.exe64⤵
- Executes dropped EXE
-
\??\c:\nbhhnn.exec:\nbhhnn.exe65⤵
- Executes dropped EXE
-
\??\c:\ddppp.exec:\ddppp.exe66⤵
-
\??\c:\frxrlfx.exec:\frxrlfx.exe67⤵
-
\??\c:\3tnnhh.exec:\3tnnhh.exe68⤵
-
\??\c:\bbnntt.exec:\bbnntt.exe69⤵
-
\??\c:\dppjv.exec:\dppjv.exe70⤵
-
\??\c:\frxrrrr.exec:\frxrrrr.exe71⤵
-
\??\c:\xrxffrr.exec:\xrxffrr.exe72⤵
-
\??\c:\tbhbhh.exec:\tbhbhh.exe73⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe74⤵
-
\??\c:\rflfxrl.exec:\rflfxrl.exe75⤵
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe76⤵
-
\??\c:\tbbtnn.exec:\tbbtnn.exe77⤵
-
\??\c:\bhhbtn.exec:\bhhbtn.exe78⤵
-
\??\c:\pvddd.exec:\pvddd.exe79⤵
-
\??\c:\lfffxxr.exec:\lfffxxr.exe80⤵
-
\??\c:\xrfxrxr.exec:\xrfxrxr.exe81⤵
-
\??\c:\nbbbtt.exec:\nbbbtt.exe82⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe83⤵
-
\??\c:\dpvpj.exec:\dpvpj.exe84⤵
-
\??\c:\7lfffll.exec:\7lfffll.exe85⤵
-
\??\c:\nhnhtt.exec:\nhnhtt.exe86⤵
-
\??\c:\djddv.exec:\djddv.exe87⤵
-
\??\c:\xrrlllf.exec:\xrrlllf.exe88⤵
-
\??\c:\nhnnhh.exec:\nhnnhh.exe89⤵
-
\??\c:\hbbbtt.exec:\hbbbtt.exe90⤵
-
\??\c:\jdpjv.exec:\jdpjv.exe91⤵
-
\??\c:\rrrrflf.exec:\rrrrflf.exe92⤵
-
\??\c:\xlrrllf.exec:\xlrrllf.exe93⤵
-
\??\c:\bbhnhh.exec:\bbhnhh.exe94⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe95⤵
-
\??\c:\lrffflf.exec:\lrffflf.exe96⤵
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe97⤵
-
\??\c:\1tbthh.exec:\1tbthh.exe98⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe99⤵
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe100⤵
-
\??\c:\flxxrxr.exec:\flxxrxr.exe101⤵
-
\??\c:\nntnnn.exec:\nntnnn.exe102⤵
-
\??\c:\pjpjp.exec:\pjpjp.exe103⤵
-
\??\c:\1xxxffr.exec:\1xxxffr.exe104⤵
-
\??\c:\rllffff.exec:\rllffff.exe105⤵
-
\??\c:\hhtnhh.exec:\hhtnhh.exe106⤵
-
\??\c:\9ddvj.exec:\9ddvj.exe107⤵
-
\??\c:\rlfrlfr.exec:\rlfrlfr.exe108⤵
-
\??\c:\nhbbhh.exec:\nhbbhh.exe109⤵
-
\??\c:\bnbtbb.exec:\bnbtbb.exe110⤵
-
\??\c:\dvvjp.exec:\dvvjp.exe111⤵
-
\??\c:\rrxlffx.exec:\rrxlffx.exe112⤵
-
\??\c:\lffxrrr.exec:\lffxrrr.exe113⤵
-
\??\c:\nnbhnt.exec:\nnbhnt.exe114⤵
-
\??\c:\5pdpp.exec:\5pdpp.exe115⤵
-
\??\c:\ddpdd.exec:\ddpdd.exe116⤵
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe117⤵
-
\??\c:\9bbbnn.exec:\9bbbnn.exe118⤵
-
\??\c:\hthbtt.exec:\hthbtt.exe119⤵
-
\??\c:\jddvv.exec:\jddvv.exe120⤵
-
\??\c:\lfffffr.exec:\lfffffr.exe121⤵
-
\??\c:\tnnnnh.exec:\tnnnnh.exe122⤵
-
\??\c:\jdjjv.exec:\jdjjv.exe123⤵
-
\??\c:\vvvdd.exec:\vvvdd.exe124⤵
-
\??\c:\rflfxxx.exec:\rflfxxx.exe125⤵
-
\??\c:\xlrrrll.exec:\xlrrrll.exe126⤵
-
\??\c:\hhtnnb.exec:\hhtnnb.exe127⤵
-
\??\c:\vpvpp.exec:\vpvpp.exe128⤵
-
\??\c:\jjjdp.exec:\jjjdp.exe129⤵
-
\??\c:\7rxrrxx.exec:\7rxrrxx.exe130⤵
-
\??\c:\9ntnhb.exec:\9ntnhb.exe131⤵
-
\??\c:\jjdpd.exec:\jjdpd.exe132⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe133⤵
-
\??\c:\xlrllff.exec:\xlrllff.exe134⤵
-
\??\c:\frfxrrl.exec:\frfxrrl.exe135⤵
-
\??\c:\bbtttt.exec:\bbtttt.exe136⤵
-
\??\c:\9ddvd.exec:\9ddvd.exe137⤵
-
\??\c:\rrrxrfx.exec:\rrrxrfx.exe138⤵
-
\??\c:\lflffxr.exec:\lflffxr.exe139⤵
-
\??\c:\htbhhh.exec:\htbhhh.exe140⤵
-
\??\c:\pvvvv.exec:\pvvvv.exe141⤵
-
\??\c:\jdvvp.exec:\jdvvp.exe142⤵
-
\??\c:\xrlxlxr.exec:\xrlxlxr.exe143⤵
-
\??\c:\3nhtnn.exec:\3nhtnn.exe144⤵
-
\??\c:\btbtnh.exec:\btbtnh.exe145⤵
-
\??\c:\jdpjj.exec:\jdpjj.exe146⤵
-
\??\c:\lxfxllx.exec:\lxfxllx.exe147⤵
-
\??\c:\nbnnhn.exec:\nbnnhn.exe148⤵
-
\??\c:\tbbbbh.exec:\tbbbbh.exe149⤵
-
\??\c:\9jdjd.exec:\9jdjd.exe150⤵
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe151⤵
-
\??\c:\hbhtnh.exec:\hbhtnh.exe152⤵
-
\??\c:\bhnnhh.exec:\bhnnhh.exe153⤵
-
\??\c:\dvvdv.exec:\dvvdv.exe154⤵
-
\??\c:\lrlllrr.exec:\lrlllrr.exe155⤵
-
\??\c:\rlrlllf.exec:\rlrlllf.exe156⤵
-
\??\c:\7nhhhh.exec:\7nhhhh.exe157⤵
-
\??\c:\tbttnh.exec:\tbttnh.exe158⤵
-
\??\c:\dvvpj.exec:\dvvpj.exe159⤵
-
\??\c:\fflfxxr.exec:\fflfxxr.exe160⤵
-
\??\c:\hbttnn.exec:\hbttnn.exe161⤵
-
\??\c:\tbnnht.exec:\tbnnht.exe162⤵
-
\??\c:\vdvpj.exec:\vdvpj.exe163⤵
-
\??\c:\rlxxffl.exec:\rlxxffl.exe164⤵
-
\??\c:\5bhbhn.exec:\5bhbhn.exe165⤵
-
\??\c:\3bnhtt.exec:\3bnhtt.exe166⤵
-
\??\c:\pvdvp.exec:\pvdvp.exe167⤵
-
\??\c:\5ffxrrf.exec:\5ffxrrf.exe168⤵
-
\??\c:\thhnhn.exec:\thhnhn.exe169⤵
-
\??\c:\pjppj.exec:\pjppj.exe170⤵
-
\??\c:\pjvpp.exec:\pjvpp.exe171⤵
-
\??\c:\rrxxllx.exec:\rrxxllx.exe172⤵
-
\??\c:\bbbnhn.exec:\bbbnhn.exe173⤵
-
\??\c:\9ntnhh.exec:\9ntnhh.exe174⤵
-
\??\c:\dvpjj.exec:\dvpjj.exe175⤵
-
\??\c:\lxlfffx.exec:\lxlfffx.exe176⤵
-
\??\c:\xfxrllf.exec:\xfxrllf.exe177⤵
-
\??\c:\nbnhnn.exec:\nbnhnn.exe178⤵
-
\??\c:\djddv.exec:\djddv.exe179⤵
-
\??\c:\vvdvp.exec:\vvdvp.exe180⤵
-
\??\c:\xflfxrl.exec:\xflfxrl.exe181⤵
-
\??\c:\tnnnhn.exec:\tnnnhn.exe182⤵
-
\??\c:\3bnhtn.exec:\3bnhtn.exe183⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe184⤵
-
\??\c:\lxlffxf.exec:\lxlffxf.exe185⤵
-
\??\c:\nnttnt.exec:\nnttnt.exe186⤵
-
\??\c:\7htnhh.exec:\7htnhh.exe187⤵
-
\??\c:\pdjdv.exec:\pdjdv.exe188⤵
-
\??\c:\xlllllf.exec:\xlllllf.exe189⤵
-
\??\c:\nbhhhn.exec:\nbhhhn.exe190⤵
-
\??\c:\jpjvp.exec:\jpjvp.exe191⤵
-
\??\c:\jjppj.exec:\jjppj.exe192⤵
-
\??\c:\lxxflrr.exec:\lxxflrr.exe193⤵
-
\??\c:\hbhbtn.exec:\hbhbtn.exe194⤵
-
\??\c:\hntnhh.exec:\hntnhh.exe195⤵
-
\??\c:\vdjjj.exec:\vdjjj.exe196⤵
-
\??\c:\llrlfxr.exec:\llrlfxr.exe197⤵
-
\??\c:\xxrllfx.exec:\xxrllfx.exe198⤵
-
\??\c:\ththnt.exec:\ththnt.exe199⤵
-
\??\c:\jvddj.exec:\jvddj.exe200⤵
-
\??\c:\ddjdd.exec:\ddjdd.exe201⤵
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe202⤵
-
\??\c:\btbthb.exec:\btbthb.exe203⤵
-
\??\c:\vvpjp.exec:\vvpjp.exe204⤵
-
\??\c:\lrxlxxr.exec:\lrxlxxr.exe205⤵
-
\??\c:\llrllll.exec:\llrllll.exe206⤵
-
\??\c:\nbhnhh.exec:\nbhnhh.exe207⤵
-
\??\c:\pjdvd.exec:\pjdvd.exe208⤵
-
\??\c:\jpddv.exec:\jpddv.exe209⤵
-
\??\c:\tbhtnh.exec:\tbhtnh.exe210⤵
-
\??\c:\7bbbbb.exec:\7bbbbb.exe211⤵
-
\??\c:\dvddv.exec:\dvddv.exe212⤵
-
\??\c:\3frfxrl.exec:\3frfxrl.exe213⤵
-
\??\c:\5thbtn.exec:\5thbtn.exe214⤵
-
\??\c:\9bhbbb.exec:\9bhbbb.exe215⤵
-
\??\c:\jddvp.exec:\jddvp.exe216⤵
-
\??\c:\rfffxlf.exec:\rfffxlf.exe217⤵
-
\??\c:\lflfxxx.exec:\lflfxxx.exe218⤵
-
\??\c:\jjjjp.exec:\jjjjp.exe219⤵
-
\??\c:\fxxlffx.exec:\fxxlffx.exe220⤵
-
\??\c:\nnnhbt.exec:\nnnhbt.exe221⤵
-
\??\c:\9nhthh.exec:\9nhthh.exe222⤵
-
\??\c:\9vjpd.exec:\9vjpd.exe223⤵
-
\??\c:\frrxrlf.exec:\frrxrlf.exe224⤵
-
\??\c:\bbnnhb.exec:\bbnnhb.exe225⤵
-
\??\c:\jpvpj.exec:\jpvpj.exe226⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe227⤵
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe228⤵
-
\??\c:\bnbtht.exec:\bnbtht.exe229⤵
-
\??\c:\jjvpj.exec:\jjvpj.exe230⤵
-
\??\c:\9ppjv.exec:\9ppjv.exe231⤵
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe232⤵
-
\??\c:\3tnnhh.exec:\3tnnhh.exe233⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe234⤵
-
\??\c:\rxxlflf.exec:\rxxlflf.exe235⤵
-
\??\c:\5nnhtt.exec:\5nnhtt.exe236⤵
-
\??\c:\vvjdd.exec:\vvjdd.exe237⤵
-
\??\c:\xrrrllf.exec:\xrrrllf.exe238⤵
-
\??\c:\nbhtth.exec:\nbhtth.exe239⤵
-
\??\c:\1tbtbt.exec:\1tbtbt.exe240⤵
-
\??\c:\pvjdp.exec:\pvjdp.exe241⤵