Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 19:09
Behavioral task
behavioral1
Sample
029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
-
Target
029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe
-
Size
191KB
-
MD5
029914de3b6fbd90144bb1287f886f20
-
SHA1
d18f363f208937df827f99c192398ee61a5c8664
-
SHA256
2e8d7512e73267199efc6c9db4cb8d89f687f292bb053d14206a0e9b2743502e
-
SHA512
217fd21325328f3a8f5a0f92b35cd5bd98016c7bdecde2afbafeccecffb073d36be646355af524021addc3817787b5ce38df2a71c0f2d66a820f894255083f1e
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSak:Fcm4FmowdHoS8fMoSVAHubPtyYxfPk
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/540-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/6084-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/6060-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3828-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/816-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3232-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1128-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1972-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5140-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3332-68-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4032-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5028-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5364-105-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5824-111-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4736-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3464-123-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5568-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1280-145-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2376-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/532-166-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3700-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5740-179-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5060-187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/912-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2432-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3472-206-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1288-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4136-224-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5416-230-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2472-232-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1612-241-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3452-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1220-249-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4656-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2932-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4168-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2688-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2036-296-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5536-308-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3336-319-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5764-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4416-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/540-350-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1128-361-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5360-380-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-386-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5256-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1424-413-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5696-446-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5708-453-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/6004-488-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1800-490-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4636-516-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1220-520-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/876-530-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3508-535-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5168-545-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4624-591-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-598-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/924-608-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3596-612-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3596-616-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4312-666-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0007000000023298-4.dat family_berbew behavioral2/files/0x0007000000023403-10.dat family_berbew behavioral2/files/0x0007000000023404-12.dat family_berbew behavioral2/files/0x0007000000023405-23.dat family_berbew behavioral2/files/0x0007000000023406-28.dat family_berbew behavioral2/files/0x0007000000023407-35.dat family_berbew behavioral2/files/0x0007000000023408-40.dat family_berbew behavioral2/files/0x0007000000023409-48.dat family_berbew behavioral2/files/0x000700000002340a-53.dat family_berbew behavioral2/files/0x000700000002340b-61.dat family_berbew behavioral2/files/0x000700000002340c-65.dat family_berbew behavioral2/files/0x000700000002340d-71.dat family_berbew behavioral2/files/0x000700000002340e-76.dat family_berbew behavioral2/files/0x000700000002340f-81.dat family_berbew behavioral2/files/0x0007000000023410-87.dat family_berbew behavioral2/files/0x0007000000023411-92.dat family_berbew behavioral2/files/0x0007000000023412-97.dat family_berbew behavioral2/files/0x0007000000023413-103.dat family_berbew behavioral2/files/0x0007000000023414-109.dat family_berbew behavioral2/files/0x0007000000023415-115.dat family_berbew behavioral2/files/0x0007000000023416-121.dat family_berbew behavioral2/files/0x0007000000023417-128.dat family_berbew behavioral2/files/0x0007000000023418-132.dat family_berbew behavioral2/files/0x0007000000023419-139.dat family_berbew behavioral2/files/0x000700000002341a-143.dat family_berbew behavioral2/files/0x000700000002341b-150.dat family_berbew behavioral2/files/0x000700000002341c-156.dat family_berbew behavioral2/files/0x000700000002341d-161.dat family_berbew behavioral2/files/0x000700000002341e-167.dat family_berbew behavioral2/files/0x000700000002341f-172.dat family_berbew behavioral2/files/0x0007000000023420-181.dat family_berbew behavioral2/files/0x0007000000023421-185.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 816 9fllffr.exe 3828 1nhntn.exe 6060 htbbtt.exe 6084 vvvpj.exe 540 3rxrfll.exe 3232 1frrrxx.exe 1128 3djdd.exe 1972 frfxffl.exe 5140 bnbbtt.exe 5744 pppdj.exe 3332 frlrrrr.exe 3624 bnbtnn.exe 4032 pdjvj.exe 4972 llrfrlx.exe 4696 nhhbhh.exe 5028 dvpjj.exe 5364 frrlllf.exe 5824 1hbtnn.exe 4736 9vdvp.exe 3464 xxlrlll.exe 3272 dppjj.exe 8 frfxrrl.exe 5568 htnbnh.exe 1280 tbnhbh.exe 5484 3jppv.exe 2376 tttnbb.exe 5736 pvddv.exe 532 lrrlfxl.exe 3700 hbnttt.exe 5740 pjvpv.exe 2248 1ffxrlf.exe 5060 htbhbb.exe 3976 ppdvj.exe 3800 9ppjd.exe 912 3xrlxfx.exe 2432 hbbtnn.exe 3472 hnbthh.exe 4732 pvvvj.exe 1732 fxllxxx.exe 1288 hbbtnn.exe 3004 3btnnn.exe 4136 dppjd.exe 5416 7jjvp.exe 2472 hnnhtt.exe 2768 1tbbnn.exe 1612 pvdvp.exe 2320 lxxllrl.exe 3452 tnnhhh.exe 1220 9ddvv.exe 5312 rxxfxxx.exe 5796 3thbbb.exe 4656 nthhnn.exe 4108 ddddv.exe 6128 lrlfxrl.exe 2932 3rxlffx.exe 4168 tnnbbb.exe 2424 ppvjv.exe 2688 5xxfxxr.exe 1348 tbbttt.exe 628 3nhhbb.exe 5768 pdjjv.exe 2036 lffxrll.exe 2112 rffxrlr.exe 3668 3tttnh.exe -
resource yara_rule behavioral2/memory/4496-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023298-4.dat upx behavioral2/files/0x0007000000023403-10.dat upx behavioral2/files/0x0007000000023404-12.dat upx behavioral2/files/0x0007000000023405-23.dat upx behavioral2/files/0x0007000000023406-28.dat upx behavioral2/memory/540-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023407-35.dat upx behavioral2/memory/3232-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/6084-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/6060-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3828-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/816-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4496-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023408-40.dat upx behavioral2/memory/3232-43-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1128-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1972-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023409-48.dat upx behavioral2/files/0x000700000002340a-53.dat upx behavioral2/memory/1972-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340b-61.dat upx behavioral2/memory/5140-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340c-65.dat upx behavioral2/memory/3332-68-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002340d-71.dat upx behavioral2/files/0x000700000002340e-76.dat upx behavioral2/files/0x000700000002340f-81.dat upx behavioral2/memory/4032-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023410-87.dat upx behavioral2/memory/4696-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023411-92.dat upx behavioral2/files/0x0007000000023412-97.dat upx behavioral2/memory/5028-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023413-103.dat upx behavioral2/memory/5364-105-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023414-109.dat upx behavioral2/memory/5824-111-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023415-115.dat upx behavioral2/memory/4736-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023416-121.dat upx behavioral2/memory/3464-123-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023417-128.dat upx behavioral2/files/0x0007000000023418-132.dat upx behavioral2/memory/5568-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023419-139.dat upx behavioral2/files/0x000700000002341a-143.dat upx behavioral2/memory/1280-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341b-150.dat upx behavioral2/files/0x000700000002341c-156.dat upx behavioral2/memory/2376-155-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-161.dat upx behavioral2/memory/532-166-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-167.dat upx behavioral2/files/0x000700000002341f-172.dat upx behavioral2/memory/3700-175-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5740-173-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/5740-179-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023420-181.dat upx behavioral2/files/0x0007000000023421-185.dat upx behavioral2/memory/5060-187-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/912-200-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2432-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3472-206-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4496 wrote to memory of 816 4496 029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe 82 PID 4496 wrote to memory of 816 4496 029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe 82 PID 4496 wrote to memory of 816 4496 029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe 82 PID 816 wrote to memory of 3828 816 9fllffr.exe 83 PID 816 wrote to memory of 3828 816 9fllffr.exe 83 PID 816 wrote to memory of 3828 816 9fllffr.exe 83 PID 3828 wrote to memory of 6060 3828 1nhntn.exe 84 PID 3828 wrote to memory of 6060 3828 1nhntn.exe 84 PID 3828 wrote to memory of 6060 3828 1nhntn.exe 84 PID 6060 wrote to memory of 6084 6060 htbbtt.exe 85 PID 6060 wrote to memory of 6084 6060 htbbtt.exe 85 PID 6060 wrote to memory of 6084 6060 htbbtt.exe 85 PID 6084 wrote to memory of 540 6084 vvvpj.exe 86 PID 6084 wrote to memory of 540 6084 vvvpj.exe 86 PID 6084 wrote to memory of 540 6084 vvvpj.exe 86 PID 540 wrote to memory of 3232 540 3rxrfll.exe 87 PID 540 wrote to memory of 3232 540 3rxrfll.exe 87 PID 540 wrote to memory of 3232 540 3rxrfll.exe 87 PID 3232 wrote to memory of 1128 3232 1frrrxx.exe 88 PID 3232 wrote to memory of 1128 3232 1frrrxx.exe 88 PID 3232 wrote to memory of 1128 3232 1frrrxx.exe 88 PID 1128 wrote to memory of 1972 1128 3djdd.exe 89 PID 1128 wrote to memory of 1972 1128 3djdd.exe 89 PID 1128 wrote to memory of 1972 1128 3djdd.exe 89 PID 1972 wrote to memory of 5140 1972 frfxffl.exe 90 PID 1972 wrote to memory of 5140 1972 frfxffl.exe 90 PID 1972 wrote to memory of 5140 1972 frfxffl.exe 90 PID 5140 wrote to memory of 5744 5140 bnbbtt.exe 91 PID 5140 wrote to memory of 5744 5140 bnbbtt.exe 91 PID 5140 wrote to memory of 5744 5140 bnbbtt.exe 91 PID 5744 wrote to memory of 3332 5744 pppdj.exe 92 PID 5744 wrote to memory of 3332 5744 pppdj.exe 92 PID 5744 wrote to memory of 3332 5744 pppdj.exe 92 PID 3332 wrote to memory of 3624 3332 frlrrrr.exe 93 PID 3332 wrote to memory of 3624 3332 frlrrrr.exe 93 PID 3332 wrote to memory of 3624 3332 frlrrrr.exe 93 PID 3624 wrote to memory of 4032 3624 bnbtnn.exe 94 PID 3624 wrote to memory of 4032 3624 bnbtnn.exe 94 PID 3624 wrote to memory of 4032 3624 bnbtnn.exe 94 PID 4032 wrote to memory of 4972 4032 pdjvj.exe 95 PID 4032 wrote to memory of 4972 4032 pdjvj.exe 95 PID 4032 wrote to memory of 4972 4032 pdjvj.exe 95 PID 4972 wrote to memory of 4696 4972 llrfrlx.exe 96 PID 4972 wrote to memory of 4696 4972 llrfrlx.exe 96 PID 4972 wrote to memory of 4696 4972 llrfrlx.exe 96 PID 4696 wrote to memory of 5028 4696 nhhbhh.exe 97 PID 4696 wrote to memory of 5028 4696 nhhbhh.exe 97 PID 4696 wrote to memory of 5028 4696 nhhbhh.exe 97 PID 5028 wrote to memory of 5364 5028 dvpjj.exe 98 PID 5028 wrote to memory of 5364 5028 dvpjj.exe 98 PID 5028 wrote to memory of 5364 5028 dvpjj.exe 98 PID 5364 wrote to memory of 5824 5364 frrlllf.exe 99 PID 5364 wrote to memory of 5824 5364 frrlllf.exe 99 PID 5364 wrote to memory of 5824 5364 frrlllf.exe 99 PID 5824 wrote to memory of 4736 5824 1hbtnn.exe 100 PID 5824 wrote to memory of 4736 5824 1hbtnn.exe 100 PID 5824 wrote to memory of 4736 5824 1hbtnn.exe 100 PID 4736 wrote to memory of 3464 4736 9vdvp.exe 101 PID 4736 wrote to memory of 3464 4736 9vdvp.exe 101 PID 4736 wrote to memory of 3464 4736 9vdvp.exe 101 PID 3464 wrote to memory of 3272 3464 xxlrlll.exe 102 PID 3464 wrote to memory of 3272 3464 xxlrlll.exe 102 PID 3464 wrote to memory of 3272 3464 xxlrlll.exe 102 PID 3272 wrote to memory of 8 3272 dppjj.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\029914de3b6fbd90144bb1287f886f20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\9fllffr.exec:\9fllffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\1nhntn.exec:\1nhntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\htbbtt.exec:\htbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6060 -
\??\c:\vvvpj.exec:\vvvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6084 -
\??\c:\3rxrfll.exec:\3rxrfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\1frrrxx.exec:\1frrrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\3djdd.exec:\3djdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\frfxffl.exec:\frfxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\bnbbtt.exec:\bnbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5140 -
\??\c:\pppdj.exec:\pppdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5744 -
\??\c:\frlrrrr.exec:\frlrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\bnbtnn.exec:\bnbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\pdjvj.exec:\pdjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\llrfrlx.exec:\llrfrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\nhhbhh.exec:\nhhbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\dvpjj.exec:\dvpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\frrlllf.exec:\frrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
\??\c:\1hbtnn.exec:\1hbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
\??\c:\9vdvp.exec:\9vdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\xxlrlll.exec:\xxlrlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\dppjj.exec:\dppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\frfxrrl.exec:\frfxrrl.exe23⤵
- Executes dropped EXE
PID:8 -
\??\c:\htnbnh.exec:\htnbnh.exe24⤵
- Executes dropped EXE
PID:5568 -
\??\c:\tbnhbh.exec:\tbnhbh.exe25⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3jppv.exec:\3jppv.exe26⤵
- Executes dropped EXE
PID:5484 -
\??\c:\tttnbb.exec:\tttnbb.exe27⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pvddv.exec:\pvddv.exe28⤵
- Executes dropped EXE
PID:5736 -
\??\c:\lrrlfxl.exec:\lrrlfxl.exe29⤵
- Executes dropped EXE
PID:532 -
\??\c:\hbnttt.exec:\hbnttt.exe30⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pjvpv.exec:\pjvpv.exe31⤵
- Executes dropped EXE
PID:5740 -
\??\c:\1ffxrlf.exec:\1ffxrlf.exe32⤵
- Executes dropped EXE
PID:2248 -
\??\c:\htbhbb.exec:\htbhbb.exe33⤵
- Executes dropped EXE
PID:5060 -
\??\c:\ppdvj.exec:\ppdvj.exe34⤵
- Executes dropped EXE
PID:3976 -
\??\c:\9ppjd.exec:\9ppjd.exe35⤵
- Executes dropped EXE
PID:3800 -
\??\c:\3xrlxfx.exec:\3xrlxfx.exe36⤵
- Executes dropped EXE
PID:912 -
\??\c:\hbbtnn.exec:\hbbtnn.exe37⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hnbthh.exec:\hnbthh.exe38⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pvvvj.exec:\pvvvj.exe39⤵
- Executes dropped EXE
PID:4732 -
\??\c:\fxllxxx.exec:\fxllxxx.exe40⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hbbtnn.exec:\hbbtnn.exe41⤵
- Executes dropped EXE
PID:1288 -
\??\c:\3btnnn.exec:\3btnnn.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dppjd.exec:\dppjd.exe43⤵
- Executes dropped EXE
PID:4136 -
\??\c:\7jjvp.exec:\7jjvp.exe44⤵
- Executes dropped EXE
PID:5416 -
\??\c:\hnnhtt.exec:\hnnhtt.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1tbbnn.exec:\1tbbnn.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pvdvp.exec:\pvdvp.exe47⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxxllrl.exec:\lxxllrl.exe48⤵
- Executes dropped EXE
PID:2320 -
\??\c:\tnnhhh.exec:\tnnhhh.exe49⤵
- Executes dropped EXE
PID:3452 -
\??\c:\9ddvv.exec:\9ddvv.exe50⤵
- Executes dropped EXE
PID:1220 -
\??\c:\rxxfxxx.exec:\rxxfxxx.exe51⤵
- Executes dropped EXE
PID:5312 -
\??\c:\3thbbb.exec:\3thbbb.exe52⤵
- Executes dropped EXE
PID:5796 -
\??\c:\nthhnn.exec:\nthhnn.exe53⤵
- Executes dropped EXE
PID:4656 -
\??\c:\ddddv.exec:\ddddv.exe54⤵
- Executes dropped EXE
PID:4108 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe55⤵
- Executes dropped EXE
PID:6128 -
\??\c:\3rxlffx.exec:\3rxlffx.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tnnbbb.exec:\tnnbbb.exe57⤵
- Executes dropped EXE
PID:4168 -
\??\c:\ppvjv.exec:\ppvjv.exe58⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5xxfxxr.exec:\5xxfxxr.exe59⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tbbttt.exec:\tbbttt.exe60⤵
- Executes dropped EXE
PID:1348 -
\??\c:\3nhhbb.exec:\3nhhbb.exe61⤵
- Executes dropped EXE
PID:628 -
\??\c:\pdjjv.exec:\pdjjv.exe62⤵
- Executes dropped EXE
PID:5768 -
\??\c:\lffxrll.exec:\lffxrll.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rffxrlr.exec:\rffxrlr.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3tttnh.exec:\3tttnh.exe65⤵
- Executes dropped EXE
PID:3668 -
\??\c:\5hthhh.exec:\5hthhh.exe66⤵PID:4012
-
\??\c:\vvjdd.exec:\vvjdd.exe67⤵PID:5536
-
\??\c:\vdvvd.exec:\vdvvd.exe68⤵PID:408
-
\??\c:\flflxrr.exec:\flflxrr.exe69⤵PID:1796
-
\??\c:\xffxrrl.exec:\xffxrrl.exe70⤵PID:3336
-
\??\c:\httbtt.exec:\httbtt.exe71⤵PID:2064
-
\??\c:\vdjdp.exec:\vdjdp.exe72⤵PID:452
-
\??\c:\vjdjd.exec:\vjdjd.exe73⤵PID:5764
-
\??\c:\5rxlffx.exec:\5rxlffx.exe74⤵PID:4416
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe75⤵PID:2708
-
\??\c:\bttnht.exec:\bttnht.exe76⤵PID:1992
-
\??\c:\1ttnhh.exec:\1ttnhh.exe77⤵PID:2616
-
\??\c:\pjjjd.exec:\pjjjd.exe78⤵PID:3680
-
\??\c:\jddvj.exec:\jddvj.exe79⤵PID:540
-
\??\c:\9rrrlll.exec:\9rrrlll.exe80⤵PID:332
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe81⤵PID:4688
-
\??\c:\5tnnnn.exec:\5tnnnn.exe82⤵PID:3232
-
\??\c:\ttnhbb.exec:\ttnhbb.exe83⤵PID:1128
-
\??\c:\ddpjp.exec:\ddpjp.exe84⤵PID:1972
-
\??\c:\pdjjj.exec:\pdjjj.exe85⤵PID:3012
-
\??\c:\rllfxxr.exec:\rllfxxr.exe86⤵PID:4288
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe87⤵PID:2988
-
\??\c:\7bhbbh.exec:\7bhbbh.exe88⤵PID:4584
-
\??\c:\hhtnhh.exec:\hhtnhh.exe89⤵PID:5360
-
\??\c:\dppjd.exec:\dppjd.exe90⤵PID:1252
-
\??\c:\dddvp.exec:\dddvp.exe91⤵PID:2644
-
\??\c:\fxrrlff.exec:\fxrrlff.exe92⤵PID:5256
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe93⤵PID:4972
-
\??\c:\hbtntt.exec:\hbtntt.exe94⤵PID:4968
-
\??\c:\pjpdj.exec:\pjpdj.exe95⤵PID:5248
-
\??\c:\jjddj.exec:\jjddj.exe96⤵PID:5232
-
\??\c:\lffxllf.exec:\lffxllf.exe97⤵PID:4404
-
\??\c:\rlxrlxx.exec:\rlxrlxx.exe98⤵PID:5032
-
\??\c:\hnntnn.exec:\hnntnn.exe99⤵PID:1424
-
\??\c:\nhnhbb.exec:\nhnhbb.exe100⤵PID:3848
-
\??\c:\vvjjp.exec:\vvjjp.exe101⤵PID:4736
-
\??\c:\rffxrrr.exec:\rffxrrr.exe102⤵PID:5276
-
\??\c:\xllrlll.exec:\xllrlll.exe103⤵PID:5012
-
\??\c:\nhnnhh.exec:\nhnnhh.exe104⤵PID:2752
-
\??\c:\ddddv.exec:\ddddv.exe105⤵PID:1300
-
\??\c:\5vpdv.exec:\5vpdv.exe106⤵PID:4880
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe107⤵PID:1280
-
\??\c:\rxllllf.exec:\rxllllf.exe108⤵PID:4316
-
\??\c:\lfffxxr.exec:\lfffxxr.exe109⤵PID:5100
-
\??\c:\nnbtnb.exec:\nnbtnb.exe110⤵PID:5696
-
\??\c:\1dpvp.exec:\1dpvp.exe111⤵PID:5708
-
\??\c:\7jppj.exec:\7jppj.exe112⤵PID:5148
-
\??\c:\lxlffxx.exec:\lxlffxx.exe113⤵PID:6068
-
\??\c:\7fxffrl.exec:\7fxffrl.exe114⤵PID:3440
-
\??\c:\tnhbbt.exec:\tnhbbt.exe115⤵PID:5504
-
\??\c:\7htthh.exec:\7htthh.exe116⤵PID:5388
-
\??\c:\vpvvp.exec:\vpvvp.exe117⤵PID:4980
-
\??\c:\1pjdv.exec:\1pjdv.exe118⤵PID:4516
-
\??\c:\1rrffxl.exec:\1rrffxl.exe119⤵PID:3328
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe120⤵PID:4532
-
\??\c:\htnnhh.exec:\htnnhh.exe121⤵PID:2484
-
\??\c:\hnnhbb.exec:\hnnhbb.exe122⤵PID:6004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-