Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:56
Behavioral task
behavioral1
Sample
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe
-
Size
233KB
-
MD5
45ad003da58b4f8ecd9d574443dce020
-
SHA1
79feaf9f95cd5f35bc5e6378445f9db73154edf5
-
SHA256
4e8bf1c7e1ec9cbf4ab3fc8ad5d508ead2bfd791a797e33ba9372dc34b5bc8c9
-
SHA512
0c325c4ea53f063ab08ae5d06a0475a95c4d44d896980ff197a75b9ae12bfc9d0f49045a750553c7f683c6be6ddf636bf7d9c831b6686251e0ccf2c8685db387
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a9E:y4wFHoSSGpJwGeeFmFTNAp2AE
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/2392-5-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2440-7-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4956-19-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2360-15-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1748-26-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3032-38-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1584-43-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2180-49-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4868-51-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1980-61-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4796-72-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1552-77-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2344-83-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4904-86-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2756-92-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4356-97-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2356-107-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4948-116-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1488-126-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/452-139-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2948-144-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2336-149-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1600-155-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4932-133-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3112-179-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3504-193-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5088-200-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5112-201-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4084-206-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2160-218-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2136-225-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3460-235-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2924-242-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3960-255-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4160-259-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2184-269-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3080-282-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3420-287-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2152-309-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2696-317-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3616-323-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/452-327-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/708-334-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4992-341-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1252-357-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2888-370-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1200-384-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3984-421-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3752-428-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2612-432-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2068-449-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2668-462-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4052-469-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3684-481-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4804-497-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2340-499-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/464-524-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2116-544-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/840-563-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/5080-582-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/436-601-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4484-664-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2160-677-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2888-800-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrfxllf.exexfxlxlf.exenbhhbb.exebnttht.exe9pdjj.exerlffrxf.exexxfrxxr.exebthnnt.exedjjjj.exefxxlrll.exenhnnth.exevjjdj.exebhntbn.exejpjvv.exexrlrxll.exehbttht.exepppdd.exetthbbh.exevjjvv.exe5rrxrxr.exettnttn.exepvjpv.exefrxxxxx.exebtnbtt.exejvddp.exerrlfxfx.exe1xffllf.exebbttbb.exe3pjpj.exe3rfrfrf.exebhnnhb.exepdpjj.exevpjjj.exe1xfxrrl.exethnhbb.exedvpjp.exerlfflrf.exebhbbnh.exebbbtnn.exepjvvp.exevvvjd.exe5rfxxxx.exebhhhht.exedvdpd.exelfxlxrf.exentbbtt.exejvvpj.exelrlffll.exettnhbb.exehhnnbb.exevjjjd.exerfrxflr.exethnhbb.exe3bbbtt.exejpjdv.exe7frxrrr.exehtnhht.exe3ntnbb.exe1ddvv.exelflxrrr.exexlfxxrl.exe3thbtt.exepjpjv.exedjvpp.exepid process 2440 rrfxllf.exe 2360 xfxlxlf.exe 4956 nbhhbb.exe 1748 bnttht.exe 3032 9pdjj.exe 1584 rlffrxf.exe 2180 xxfrxxr.exe 4868 bthnnt.exe 1980 djjjj.exe 3456 fxxlrll.exe 4796 nhnnth.exe 1552 vjjdj.exe 2344 bhntbn.exe 4904 jpjvv.exe 2756 xrlrxll.exe 4356 hbttht.exe 2356 pppdd.exe 4948 tthbbh.exe 2152 vjjvv.exe 4476 5rrxrxr.exe 1488 ttnttn.exe 4932 pvjpv.exe 452 frxxxxx.exe 2948 btnbtt.exe 2336 jvddp.exe 1600 rrlfxfx.exe 5100 1xffllf.exe 3708 bbttbb.exe 3740 3pjpj.exe 3112 3rfrfrf.exe 3248 bhnnhb.exe 4344 pdpjj.exe 3504 vpjjj.exe 5088 1xfxrrl.exe 5112 thnhbb.exe 4084 dvpjp.exe 3284 rlfflrf.exe 1656 bhbbnh.exe 2160 bbbtnn.exe 4036 pjvvp.exe 2136 vvvjd.exe 2552 5rfxxxx.exe 2556 bhhhht.exe 3460 dvdpd.exe 2536 lfxlxrf.exe 2924 ntbbtt.exe 512 jvvpj.exe 4120 lrlffll.exe 3256 ttnhbb.exe 3960 hhnnbb.exe 4160 vjjjd.exe 1012 rfrxflr.exe 1548 thnhbb.exe 2184 3bbbtt.exe 4796 jpjdv.exe 2364 7frxrrr.exe 2692 htnhht.exe 3080 3ntnbb.exe 816 1ddvv.exe 3420 lflxrrr.exe 3584 xlfxxrl.exe 3180 3thbtt.exe 2356 pjpjv.exe 2616 djvpp.exe -
Processes:
resource yara_rule behavioral2/memory/2392-0-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\rrfxllf.exe upx behavioral2/memory/2392-5-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2440-7-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\xfxlxlf.exe upx C:\nbhhbb.exe upx behavioral2/memory/4956-19-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2360-15-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\bnttht.exe upx C:\9pdjj.exe upx behavioral2/memory/3032-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1748-26-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\rlffrxf.exe upx behavioral2/memory/3032-38-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1584-36-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\xxfrxxr.exe upx behavioral2/memory/1584-43-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\bthnnt.exe upx behavioral2/memory/2180-49-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4868-51-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\djjjj.exe upx C:\fxxlrll.exe upx behavioral2/memory/1980-61-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\nhnnth.exe upx behavioral2/memory/4796-72-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\vjjdj.exe upx behavioral2/memory/1552-77-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\bhntbn.exe upx C:\jpjvv.exe upx behavioral2/memory/2344-83-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4904-86-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\xrlrxll.exe upx behavioral2/memory/2756-92-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\hbttht.exe upx behavioral2/memory/4356-97-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\pppdd.exe upx C:\tthbbh.exe upx behavioral2/memory/2356-107-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4948-109-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\vjjvv.exe upx behavioral2/memory/4948-116-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\5rrxrxr.exe upx C:\ttnttn.exe upx behavioral2/memory/1488-126-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\pvjpv.exe upx C:\frxxxxx.exe upx behavioral2/memory/452-139-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\btnbtt.exe upx behavioral2/memory/2948-144-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\jvddp.exe upx behavioral2/memory/2336-149-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1600-155-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\rrlfxfx.exe upx behavioral2/memory/4932-133-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\1xffllf.exe upx C:\bbttbb.exe upx C:\3pjpj.exe upx behavioral2/memory/3740-172-0x0000000000400000-0x0000000000437000-memory.dmp upx C:\3rfrfrf.exe upx behavioral2/memory/3112-179-0x0000000000400000-0x0000000000437000-memory.dmp upx \??\c:\bhnnhb.exe upx C:\pdpjj.exe upx behavioral2/memory/3504-193-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5088-196-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exerrfxllf.exexfxlxlf.exenbhhbb.exebnttht.exe9pdjj.exerlffrxf.exexxfrxxr.exebthnnt.exedjjjj.exefxxlrll.exenhnnth.exevjjdj.exebhntbn.exejpjvv.exexrlrxll.exehbttht.exepppdd.exetthbbh.exevjjvv.exe5rrxrxr.exettnttn.exedescription pid process target process PID 2392 wrote to memory of 2440 2392 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe rrfxllf.exe PID 2392 wrote to memory of 2440 2392 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe rrfxllf.exe PID 2392 wrote to memory of 2440 2392 45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe rrfxllf.exe PID 2440 wrote to memory of 2360 2440 rrfxllf.exe xfxlxlf.exe PID 2440 wrote to memory of 2360 2440 rrfxllf.exe xfxlxlf.exe PID 2440 wrote to memory of 2360 2440 rrfxllf.exe xfxlxlf.exe PID 2360 wrote to memory of 4956 2360 xfxlxlf.exe nbhhbb.exe PID 2360 wrote to memory of 4956 2360 xfxlxlf.exe nbhhbb.exe PID 2360 wrote to memory of 4956 2360 xfxlxlf.exe nbhhbb.exe PID 4956 wrote to memory of 1748 4956 nbhhbb.exe bnttht.exe PID 4956 wrote to memory of 1748 4956 nbhhbb.exe bnttht.exe PID 4956 wrote to memory of 1748 4956 nbhhbb.exe bnttht.exe PID 1748 wrote to memory of 3032 1748 bnttht.exe 9pdjj.exe PID 1748 wrote to memory of 3032 1748 bnttht.exe 9pdjj.exe PID 1748 wrote to memory of 3032 1748 bnttht.exe 9pdjj.exe PID 3032 wrote to memory of 1584 3032 9pdjj.exe rlffrxf.exe PID 3032 wrote to memory of 1584 3032 9pdjj.exe rlffrxf.exe PID 3032 wrote to memory of 1584 3032 9pdjj.exe rlffrxf.exe PID 1584 wrote to memory of 2180 1584 rlffrxf.exe xxfrxxr.exe PID 1584 wrote to memory of 2180 1584 rlffrxf.exe xxfrxxr.exe PID 1584 wrote to memory of 2180 1584 rlffrxf.exe xxfrxxr.exe PID 2180 wrote to memory of 4868 2180 xxfrxxr.exe bthnnt.exe PID 2180 wrote to memory of 4868 2180 xxfrxxr.exe bthnnt.exe PID 2180 wrote to memory of 4868 2180 xxfrxxr.exe bthnnt.exe PID 4868 wrote to memory of 1980 4868 bthnnt.exe djjjj.exe PID 4868 wrote to memory of 1980 4868 bthnnt.exe djjjj.exe PID 4868 wrote to memory of 1980 4868 bthnnt.exe djjjj.exe PID 1980 wrote to memory of 3456 1980 djjjj.exe fxxlrll.exe PID 1980 wrote to memory of 3456 1980 djjjj.exe fxxlrll.exe PID 1980 wrote to memory of 3456 1980 djjjj.exe fxxlrll.exe PID 3456 wrote to memory of 4796 3456 fxxlrll.exe nhnnth.exe PID 3456 wrote to memory of 4796 3456 fxxlrll.exe nhnnth.exe PID 3456 wrote to memory of 4796 3456 fxxlrll.exe nhnnth.exe PID 4796 wrote to memory of 1552 4796 nhnnth.exe vjjdj.exe PID 4796 wrote to memory of 1552 4796 nhnnth.exe vjjdj.exe PID 4796 wrote to memory of 1552 4796 nhnnth.exe vjjdj.exe PID 1552 wrote to memory of 2344 1552 vjjdj.exe bhntbn.exe PID 1552 wrote to memory of 2344 1552 vjjdj.exe bhntbn.exe PID 1552 wrote to memory of 2344 1552 vjjdj.exe bhntbn.exe PID 2344 wrote to memory of 4904 2344 bhntbn.exe jpjvv.exe PID 2344 wrote to memory of 4904 2344 bhntbn.exe jpjvv.exe PID 2344 wrote to memory of 4904 2344 bhntbn.exe jpjvv.exe PID 4904 wrote to memory of 2756 4904 jpjvv.exe xrlrxll.exe PID 4904 wrote to memory of 2756 4904 jpjvv.exe xrlrxll.exe PID 4904 wrote to memory of 2756 4904 jpjvv.exe xrlrxll.exe PID 2756 wrote to memory of 4356 2756 xrlrxll.exe hbttht.exe PID 2756 wrote to memory of 4356 2756 xrlrxll.exe hbttht.exe PID 2756 wrote to memory of 4356 2756 xrlrxll.exe hbttht.exe PID 4356 wrote to memory of 2356 4356 hbttht.exe pppdd.exe PID 4356 wrote to memory of 2356 4356 hbttht.exe pppdd.exe PID 4356 wrote to memory of 2356 4356 hbttht.exe pppdd.exe PID 2356 wrote to memory of 4948 2356 pppdd.exe tthbbh.exe PID 2356 wrote to memory of 4948 2356 pppdd.exe tthbbh.exe PID 2356 wrote to memory of 4948 2356 pppdd.exe tthbbh.exe PID 4948 wrote to memory of 2152 4948 tthbbh.exe vjjvv.exe PID 4948 wrote to memory of 2152 4948 tthbbh.exe vjjvv.exe PID 4948 wrote to memory of 2152 4948 tthbbh.exe vjjvv.exe PID 2152 wrote to memory of 4476 2152 vjjvv.exe 5rrxrxr.exe PID 2152 wrote to memory of 4476 2152 vjjvv.exe 5rrxrxr.exe PID 2152 wrote to memory of 4476 2152 vjjvv.exe 5rrxrxr.exe PID 4476 wrote to memory of 1488 4476 5rrxrxr.exe ttnttn.exe PID 4476 wrote to memory of 1488 4476 5rrxrxr.exe ttnttn.exe PID 4476 wrote to memory of 1488 4476 5rrxrxr.exe ttnttn.exe PID 1488 wrote to memory of 4932 1488 ttnttn.exe pvjpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\45ad003da58b4f8ecd9d574443dce020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\rrfxllf.exec:\rrfxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\nbhhbb.exec:\nbhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\bnttht.exec:\bnttht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\9pdjj.exec:\9pdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rlffrxf.exec:\rlffrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\xxfrxxr.exec:\xxfrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bthnnt.exec:\bthnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\djjjj.exec:\djjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\fxxlrll.exec:\fxxlrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\nhnnth.exec:\nhnnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\vjjdj.exec:\vjjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\bhntbn.exec:\bhntbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jpjvv.exec:\jpjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\xrlrxll.exec:\xrlrxll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hbttht.exec:\hbttht.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\pppdd.exec:\pppdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\tthbbh.exec:\tthbbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vjjvv.exec:\vjjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\5rrxrxr.exec:\5rrxrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\ttnttn.exec:\ttnttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pvjpv.exec:\pvjpv.exe23⤵
- Executes dropped EXE
PID:4932 -
\??\c:\frxxxxx.exec:\frxxxxx.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\btnbtt.exec:\btnbtt.exe25⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jvddp.exec:\jvddp.exe26⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rrlfxfx.exec:\rrlfxfx.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\1xffllf.exec:\1xffllf.exe28⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bbttbb.exec:\bbttbb.exe29⤵
- Executes dropped EXE
PID:3708 -
\??\c:\3pjpj.exec:\3pjpj.exe30⤵
- Executes dropped EXE
PID:3740 -
\??\c:\3rfrfrf.exec:\3rfrfrf.exe31⤵
- Executes dropped EXE
PID:3112 -
\??\c:\bhnnhb.exec:\bhnnhb.exe32⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pdpjj.exec:\pdpjj.exe33⤵
- Executes dropped EXE
PID:4344 -
\??\c:\vpjjj.exec:\vpjjj.exe34⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe35⤵
- Executes dropped EXE
PID:5088 -
\??\c:\thnhbb.exec:\thnhbb.exe36⤵
- Executes dropped EXE
PID:5112 -
\??\c:\dvpjp.exec:\dvpjp.exe37⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rlfflrf.exec:\rlfflrf.exe38⤵
- Executes dropped EXE
PID:3284 -
\??\c:\bhbbnh.exec:\bhbbnh.exe39⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbbtnn.exec:\bbbtnn.exe40⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pjvvp.exec:\pjvvp.exe41⤵
- Executes dropped EXE
PID:4036 -
\??\c:\vvvjd.exec:\vvvjd.exe42⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5rfxxxx.exec:\5rfxxxx.exe43⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bhhhht.exec:\bhhhht.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\dvdpd.exec:\dvdpd.exe45⤵
- Executes dropped EXE
PID:3460 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe46⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ntbbtt.exec:\ntbbtt.exe47⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jvvpj.exec:\jvvpj.exe48⤵
- Executes dropped EXE
PID:512 -
\??\c:\lrlffll.exec:\lrlffll.exe49⤵
- Executes dropped EXE
PID:4120 -
\??\c:\ttnhbb.exec:\ttnhbb.exe50⤵
- Executes dropped EXE
PID:3256 -
\??\c:\hhnnbb.exec:\hhnnbb.exe51⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vjjjd.exec:\vjjjd.exe52⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rfrxflr.exec:\rfrxflr.exe53⤵
- Executes dropped EXE
PID:1012 -
\??\c:\thnhbb.exec:\thnhbb.exe54⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3bbbtt.exec:\3bbbtt.exe55⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jpjdv.exec:\jpjdv.exe56⤵
- Executes dropped EXE
PID:4796 -
\??\c:\7frxrrr.exec:\7frxrrr.exe57⤵
- Executes dropped EXE
PID:2364 -
\??\c:\htnhht.exec:\htnhht.exe58⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3ntnbb.exec:\3ntnbb.exe59⤵
- Executes dropped EXE
PID:3080 -
\??\c:\1ddvv.exec:\1ddvv.exe60⤵
- Executes dropped EXE
PID:816 -
\??\c:\lflxrrr.exec:\lflxrrr.exe61⤵
- Executes dropped EXE
PID:3420 -
\??\c:\xlfxxrl.exec:\xlfxxrl.exe62⤵
- Executes dropped EXE
PID:3584 -
\??\c:\3thbtt.exec:\3thbtt.exe63⤵
- Executes dropped EXE
PID:3180 -
\??\c:\pjpjv.exec:\pjpjv.exe64⤵
- Executes dropped EXE
PID:2356 -
\??\c:\djvpp.exec:\djvpp.exe65⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rffxxll.exec:\rffxxll.exe66⤵PID:4392
-
\??\c:\nhtnhh.exec:\nhtnhh.exe67⤵PID:2152
-
\??\c:\jdddd.exec:\jdddd.exe68⤵PID:516
-
\??\c:\7xrlrxf.exec:\7xrlrxf.exe69⤵PID:376
-
\??\c:\9ffffff.exec:\9ffffff.exe70⤵PID:2696
-
\??\c:\nntttn.exec:\nntttn.exe71⤵PID:3616
-
\??\c:\9jjdv.exec:\9jjdv.exe72⤵PID:452
-
\??\c:\dvjjv.exec:\dvjjv.exe73⤵PID:3580
-
\??\c:\flrlxxf.exec:\flrlxxf.exe74⤵PID:708
-
\??\c:\1rxffxr.exec:\1rxffxr.exe75⤵PID:4228
-
\??\c:\nttnhh.exec:\nttnhh.exe76⤵PID:4992
-
\??\c:\djvpp.exec:\djvpp.exe77⤵PID:4716
-
\??\c:\flfrlxx.exec:\flfrlxx.exe78⤵PID:1040
-
\??\c:\7bbbhh.exec:\7bbbhh.exe79⤵PID:4044
-
\??\c:\bthbnn.exec:\bthbnn.exe80⤵PID:3416
-
\??\c:\pvpdv.exec:\pvpdv.exe81⤵PID:1252
-
\??\c:\rrrlfll.exec:\rrrlfll.exe82⤵PID:3928
-
\??\c:\lrrffxx.exec:\lrrffxx.exe83⤵PID:2276
-
\??\c:\tbbhhh.exec:\tbbhhh.exe84⤵PID:3248
-
\??\c:\vdvdj.exec:\vdvdj.exe85⤵PID:2888
-
\??\c:\fxffxxx.exec:\fxffxxx.exe86⤵PID:1680
-
\??\c:\btbthh.exec:\btbthh.exe87⤵PID:1616
-
\??\c:\jvpjd.exec:\jvpjd.exe88⤵PID:2472
-
\??\c:\lfffllf.exec:\lfffllf.exe89⤵PID:1200
-
\??\c:\pvjpj.exec:\pvjpj.exe90⤵PID:1212
-
\??\c:\1jpjd.exec:\1jpjd.exe91⤵PID:4332
-
\??\c:\rxffxrr.exec:\rxffxrr.exe92⤵PID:2392
-
\??\c:\hbbttt.exec:\hbbttt.exe93⤵PID:1424
-
\??\c:\pvdvv.exec:\pvdvv.exe94⤵PID:2876
-
\??\c:\xrflfll.exec:\xrflfll.exe95⤵PID:2552
-
\??\c:\hhbttt.exec:\hhbttt.exe96⤵PID:2128
-
\??\c:\ntnbbh.exec:\ntnbbh.exe97⤵PID:4424
-
\??\c:\jvvpj.exec:\jvvpj.exe98⤵PID:4428
-
\??\c:\bbnnnn.exec:\bbnnnn.exe99⤵PID:856
-
\??\c:\ddvjp.exec:\ddvjp.exe100⤵PID:1736
-
\??\c:\5xfffxl.exec:\5xfffxl.exe101⤵PID:2720
-
\??\c:\fflxrrx.exec:\fflxrrx.exe102⤵PID:3984
-
\??\c:\1bbttt.exec:\1bbttt.exe103⤵PID:3752
-
\??\c:\pdjjd.exec:\pdjjd.exe104⤵PID:2612
-
\??\c:\rrrfxll.exec:\rrrfxll.exe105⤵PID:560
-
\??\c:\bbbhhh.exec:\bbbhhh.exe106⤵PID:4840
-
\??\c:\pdvpp.exec:\pdvpp.exe107⤵PID:1552
-
\??\c:\lrrlffx.exec:\lrrlffx.exe108⤵PID:4684
-
\??\c:\nhtbbh.exec:\nhtbbh.exe109⤵PID:3140
-
\??\c:\dpvvd.exec:\dpvvd.exe110⤵PID:2068
-
\??\c:\dvdvd.exec:\dvdvd.exe111⤵PID:2756
-
\??\c:\1flllrr.exec:\1flllrr.exe112⤵PID:3216
-
\??\c:\bttttt.exec:\bttttt.exe113⤵PID:4396
-
\??\c:\ttnhhn.exec:\ttnhhn.exe114⤵PID:2668
-
\??\c:\jdpvd.exec:\jdpvd.exe115⤵PID:1520
-
\??\c:\llrfllr.exec:\llrfllr.exe116⤵PID:4052
-
\??\c:\bbhnnn.exec:\bbhnnn.exe117⤵PID:116
-
\??\c:\pjdjd.exec:\pjdjd.exe118⤵PID:652
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe119⤵PID:3684
-
\??\c:\frfxrlx.exec:\frfxrlx.exe120⤵PID:1384
-
\??\c:\hthhbb.exec:\hthhbb.exe121⤵PID:4912
-
\??\c:\9jpdv.exec:\9jpdv.exe122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-