Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:03
Behavioral task
behavioral1
Sample
12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe
-
Size
441KB
-
MD5
12fe4659700f67a4d6813a77feeb3ed0
-
SHA1
5f4daa79699e0861a2c93ddb9113edcc4609cc1b
-
SHA256
a1b9907c04cfc85c546b3678e93a9045c19268aa60502284f3512a1afa2de094
-
SHA512
8aefa8907d3583e9cf8c5f57858c7decb92c0ea114a58e9f29b8bc3d8e386b3687338960700bceb59004cfa69d29e158b162365bd4b10926ee4edd59d89cbe55
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluw:UrR/nPV
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
Processes:
resource yara_rule behavioral2/memory/224-6-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3852-18-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/736-14-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4660-27-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1252-28-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1252-34-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1200-40-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/64-42-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1200-47-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1960-53-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/656-60-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4956-67-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2264-88-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4080-97-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4848-94-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2532-92-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/632-74-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4080-102-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2972-104-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2972-110-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5028-118-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2392-124-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4264-125-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4264-129-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3968-132-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3968-138-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2780-139-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3632-144-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2780-146-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3632-153-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1556-159-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4340-165-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4984-166-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4984-174-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2380-180-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5072-188-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5012-194-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4856-196-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4856-201-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3600-206-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3212-208-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3212-213-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4412-223-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2732-220-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4412-230-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1980-232-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2884-237-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5040-242-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1328-247-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2128-252-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2132-257-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1144-262-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3624-268-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/324-266-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/324-272-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/916-277-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2100-282-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2000-293-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2000-289-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4344-288-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2016-297-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3256-302-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjdvp.exeppvpp.exerxfxxrx.exelrfrlfx.exedvpdv.exe7ttnhb.exethtnnn.exepjpdv.exe7flrrlf.exe7lrllfl.exennbbhh.exepvvpp.exehbbnht.exehtbttn.exerflfxrl.exevjjdv.exefffxrxr.exedppjd.exe7vvvp.exexlxrrrx.exenhnnhb.exenbhnnn.exebbtthn.exebnbttb.exe3dpvd.exe5vjdv.exebhhhbh.exejdvvv.exedvjjv.exellrlfxl.exehnbhnh.exevvvpp.exeffllllx.exevpdvd.exerrlllxx.exehhhtnb.exetnnhnn.exejppjj.exedpppp.exefrxrrxr.exe5nnnnt.exebbbbbb.exelffxrfx.exehbnntb.exe9djjj.exe3djdd.exelxllffx.exejddvp.exehhtbhn.exe1lxrlfl.exejdvpj.exebhnhhb.exenthbtt.exepvjjv.exerllxxrl.exehhhbbb.exe5hnhbb.exepdpjj.exefxfxllr.exelxfffll.exehbbhnt.exe5jvvd.exerxfffff.exe1thbnn.exepid process 736 vjdvp.exe 3852 ppvpp.exe 4660 rxfxxrx.exe 1252 lrfrlfx.exe 64 dvpdv.exe 1200 7ttnhb.exe 1960 thtnnn.exe 656 pjpdv.exe 4956 7flrrlf.exe 632 7lrllfl.exe 2264 nnbbhh.exe 4848 pvvpp.exe 2532 hbbnht.exe 4080 htbttn.exe 2972 rflfxrl.exe 5028 vjjdv.exe 2392 fffxrxr.exe 4264 dppjd.exe 3968 7vvvp.exe 2780 xlxrrrx.exe 3632 nhnnhb.exe 1556 nbhnnn.exe 4340 bbtthn.exe 4984 bnbttb.exe 2380 3dpvd.exe 5072 5vjdv.exe 5012 bhhhbh.exe 4856 jdvvv.exe 3600 dvjjv.exe 3212 llrlfxl.exe 2732 hnbhnh.exe 4412 vvvpp.exe 1980 ffllllx.exe 2884 vpdvd.exe 5040 rrlllxx.exe 1328 hhhtnb.exe 2128 tnnhnn.exe 2132 jppjj.exe 1144 dpppp.exe 3624 frxrrxr.exe 324 5nnnnt.exe 916 bbbbbb.exe 2100 lffxrfx.exe 4344 hbnntb.exe 2000 9djjj.exe 2016 3djdd.exe 3256 lxllffx.exe 2888 jddvp.exe 4036 hhtbhn.exe 2972 1lxrlfl.exe 1920 jdvpj.exe 3960 bhnhhb.exe 2160 nthbtt.exe 2140 pvjjv.exe 4420 rllxxrl.exe 2720 hhhbbb.exe 3972 5hnhbb.exe 3908 pdpjj.exe 4924 fxfxllr.exe 4064 lxfffll.exe 4612 hbbhnt.exe 1148 5jvvd.exe 848 rxfffff.exe 3832 1thbnn.exe -
Processes:
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\vjdvp.exe upx behavioral2/memory/224-6-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\ppvpp.exe upx behavioral2/memory/3852-15-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3852-18-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\rxfxxrx.exe upx behavioral2/memory/736-14-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/736-8-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4660-20-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\lrfrlfx.exe upx behavioral2/memory/4660-27-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1252-28-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\dvpdv.exe upx behavioral2/memory/1252-34-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/64-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1200-40-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/64-42-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\7ttnhb.exe upx C:\thtnnn.exe upx behavioral2/memory/1200-47-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1960-49-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\pjpdv.exe upx behavioral2/memory/1960-53-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/656-57-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/656-60-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\7flrrlf.exe upx behavioral2/memory/4956-63-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4956-67-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\7lrllfl.exe upx behavioral2/memory/632-71-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\nnbbhh.exe upx behavioral2/memory/2264-77-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\pvvpp.exe upx behavioral2/memory/2264-88-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\htbttn.exe upx behavioral2/memory/4080-97-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4848-94-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2532-92-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\hbbnht.exe upx behavioral2/memory/4848-84-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/632-74-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\rflfxrl.exe upx behavioral2/memory/4080-102-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2972-104-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\vjjdv.exe upx behavioral2/memory/5028-112-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2972-110-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2392-116-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5028-118-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\fffxrxr.exe upx C:\dppjd.exe upx behavioral2/memory/2392-124-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4264-125-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4264-129-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\7vvvp.exe upx behavioral2/memory/3968-132-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\xlxrrrx.exe upx behavioral2/memory/3968-138-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2780-139-0x0000000000400000-0x000000000048C000-memory.dmp upx \??\c:\nhnnhb.exe upx behavioral2/memory/3632-144-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2780-146-0x0000000000400000-0x000000000048C000-memory.dmp upx C:\nbhnnn.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exevjdvp.exeppvpp.exerxfxxrx.exelrfrlfx.exedvpdv.exe7ttnhb.exethtnnn.exepjpdv.exe7flrrlf.exe7lrllfl.exennbbhh.exepvvpp.exehbbnht.exehtbttn.exerflfxrl.exevjjdv.exefffxrxr.exedppjd.exe7vvvp.exexlxrrrx.exenhnnhb.exedescription pid process target process PID 224 wrote to memory of 736 224 12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe vjdvp.exe PID 224 wrote to memory of 736 224 12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe vjdvp.exe PID 224 wrote to memory of 736 224 12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe vjdvp.exe PID 736 wrote to memory of 3852 736 vjdvp.exe ppvpp.exe PID 736 wrote to memory of 3852 736 vjdvp.exe ppvpp.exe PID 736 wrote to memory of 3852 736 vjdvp.exe ppvpp.exe PID 3852 wrote to memory of 4660 3852 ppvpp.exe rxfxxrx.exe PID 3852 wrote to memory of 4660 3852 ppvpp.exe rxfxxrx.exe PID 3852 wrote to memory of 4660 3852 ppvpp.exe rxfxxrx.exe PID 4660 wrote to memory of 1252 4660 rxfxxrx.exe lrfrlfx.exe PID 4660 wrote to memory of 1252 4660 rxfxxrx.exe lrfrlfx.exe PID 4660 wrote to memory of 1252 4660 rxfxxrx.exe lrfrlfx.exe PID 1252 wrote to memory of 64 1252 lrfrlfx.exe dvpdv.exe PID 1252 wrote to memory of 64 1252 lrfrlfx.exe dvpdv.exe PID 1252 wrote to memory of 64 1252 lrfrlfx.exe dvpdv.exe PID 64 wrote to memory of 1200 64 dvpdv.exe 7ttnhb.exe PID 64 wrote to memory of 1200 64 dvpdv.exe 7ttnhb.exe PID 64 wrote to memory of 1200 64 dvpdv.exe 7ttnhb.exe PID 1200 wrote to memory of 1960 1200 7ttnhb.exe thtnnn.exe PID 1200 wrote to memory of 1960 1200 7ttnhb.exe thtnnn.exe PID 1200 wrote to memory of 1960 1200 7ttnhb.exe thtnnn.exe PID 1960 wrote to memory of 656 1960 thtnnn.exe pjpdv.exe PID 1960 wrote to memory of 656 1960 thtnnn.exe pjpdv.exe PID 1960 wrote to memory of 656 1960 thtnnn.exe pjpdv.exe PID 656 wrote to memory of 4956 656 pjpdv.exe 7flrrlf.exe PID 656 wrote to memory of 4956 656 pjpdv.exe 7flrrlf.exe PID 656 wrote to memory of 4956 656 pjpdv.exe 7flrrlf.exe PID 4956 wrote to memory of 632 4956 7flrrlf.exe 7lrllfl.exe PID 4956 wrote to memory of 632 4956 7flrrlf.exe 7lrllfl.exe PID 4956 wrote to memory of 632 4956 7flrrlf.exe 7lrllfl.exe PID 632 wrote to memory of 2264 632 7lrllfl.exe nnbbhh.exe PID 632 wrote to memory of 2264 632 7lrllfl.exe nnbbhh.exe PID 632 wrote to memory of 2264 632 7lrllfl.exe nnbbhh.exe PID 2264 wrote to memory of 4848 2264 nnbbhh.exe pvvpp.exe PID 2264 wrote to memory of 4848 2264 nnbbhh.exe pvvpp.exe PID 2264 wrote to memory of 4848 2264 nnbbhh.exe pvvpp.exe PID 4848 wrote to memory of 2532 4848 pvvpp.exe hbbnht.exe PID 4848 wrote to memory of 2532 4848 pvvpp.exe hbbnht.exe PID 4848 wrote to memory of 2532 4848 pvvpp.exe hbbnht.exe PID 2532 wrote to memory of 4080 2532 hbbnht.exe htbttn.exe PID 2532 wrote to memory of 4080 2532 hbbnht.exe htbttn.exe PID 2532 wrote to memory of 4080 2532 hbbnht.exe htbttn.exe PID 4080 wrote to memory of 2972 4080 htbttn.exe rflfxrl.exe PID 4080 wrote to memory of 2972 4080 htbttn.exe rflfxrl.exe PID 4080 wrote to memory of 2972 4080 htbttn.exe rflfxrl.exe PID 2972 wrote to memory of 5028 2972 rflfxrl.exe vjjdv.exe PID 2972 wrote to memory of 5028 2972 rflfxrl.exe vjjdv.exe PID 2972 wrote to memory of 5028 2972 rflfxrl.exe vjjdv.exe PID 5028 wrote to memory of 2392 5028 vjjdv.exe fffxrxr.exe PID 5028 wrote to memory of 2392 5028 vjjdv.exe fffxrxr.exe PID 5028 wrote to memory of 2392 5028 vjjdv.exe fffxrxr.exe PID 2392 wrote to memory of 4264 2392 fffxrxr.exe dppjd.exe PID 2392 wrote to memory of 4264 2392 fffxrxr.exe dppjd.exe PID 2392 wrote to memory of 4264 2392 fffxrxr.exe dppjd.exe PID 4264 wrote to memory of 3968 4264 dppjd.exe 7vvvp.exe PID 4264 wrote to memory of 3968 4264 dppjd.exe 7vvvp.exe PID 4264 wrote to memory of 3968 4264 dppjd.exe 7vvvp.exe PID 3968 wrote to memory of 2780 3968 7vvvp.exe xlxrrrx.exe PID 3968 wrote to memory of 2780 3968 7vvvp.exe xlxrrrx.exe PID 3968 wrote to memory of 2780 3968 7vvvp.exe xlxrrrx.exe PID 2780 wrote to memory of 3632 2780 xlxrrrx.exe nhnnhb.exe PID 2780 wrote to memory of 3632 2780 xlxrrrx.exe nhnnhb.exe PID 2780 wrote to memory of 3632 2780 xlxrrrx.exe nhnnhb.exe PID 3632 wrote to memory of 1556 3632 nhnnhb.exe nbhnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\12fe4659700f67a4d6813a77feeb3ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\vjdvp.exec:\vjdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\ppvpp.exec:\ppvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\rxfxxrx.exec:\rxfxxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\lrfrlfx.exec:\lrfrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\dvpdv.exec:\dvpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\7ttnhb.exec:\7ttnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\thtnnn.exec:\thtnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\pjpdv.exec:\pjpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\7flrrlf.exec:\7flrrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\7lrllfl.exec:\7lrllfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\nnbbhh.exec:\nnbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\pvvpp.exec:\pvvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\hbbnht.exec:\hbbnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\htbttn.exec:\htbttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\rflfxrl.exec:\rflfxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vjjdv.exec:\vjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\fffxrxr.exec:\fffxrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\dppjd.exec:\dppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\7vvvp.exec:\7vvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nhnnhb.exec:\nhnnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\nbhnnn.exec:\nbhnnn.exe23⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bbtthn.exec:\bbtthn.exe24⤵
- Executes dropped EXE
PID:4340 -
\??\c:\bnbttb.exec:\bnbttb.exe25⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3dpvd.exec:\3dpvd.exe26⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5vjdv.exec:\5vjdv.exe27⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bhhhbh.exec:\bhhhbh.exe28⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jdvvv.exec:\jdvvv.exe29⤵
- Executes dropped EXE
PID:4856 -
\??\c:\dvjjv.exec:\dvjjv.exe30⤵
- Executes dropped EXE
PID:3600 -
\??\c:\llrlfxl.exec:\llrlfxl.exe31⤵
- Executes dropped EXE
PID:3212 -
\??\c:\hnbhnh.exec:\hnbhnh.exe32⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvvpp.exec:\vvvpp.exe33⤵
- Executes dropped EXE
PID:4412 -
\??\c:\ffllllx.exec:\ffllllx.exe34⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vpdvd.exec:\vpdvd.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rrlllxx.exec:\rrlllxx.exe36⤵
- Executes dropped EXE
PID:5040 -
\??\c:\hhhtnb.exec:\hhhtnb.exe37⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tnnhnn.exec:\tnnhnn.exe38⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jppjj.exec:\jppjj.exe39⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dpppp.exec:\dpppp.exe40⤵
- Executes dropped EXE
PID:1144 -
\??\c:\frxrrxr.exec:\frxrrxr.exe41⤵
- Executes dropped EXE
PID:3624 -
\??\c:\5nnnnt.exec:\5nnnnt.exe42⤵
- Executes dropped EXE
PID:324 -
\??\c:\bbbbbb.exec:\bbbbbb.exe43⤵
- Executes dropped EXE
PID:916 -
\??\c:\lffxrfx.exec:\lffxrfx.exe44⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbnntb.exec:\hbnntb.exe45⤵
- Executes dropped EXE
PID:4344 -
\??\c:\9djjj.exec:\9djjj.exe46⤵
- Executes dropped EXE
PID:2000 -
\??\c:\3djdd.exec:\3djdd.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lxllffx.exec:\lxllffx.exe48⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jddvp.exec:\jddvp.exe49⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hhtbhn.exec:\hhtbhn.exe50⤵
- Executes dropped EXE
PID:4036 -
\??\c:\1lxrlfl.exec:\1lxrlfl.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jdvpj.exec:\jdvpj.exe52⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bhnhhb.exec:\bhnhhb.exe53⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nthbtt.exec:\nthbtt.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\pvjjv.exec:\pvjjv.exe55⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rllxxrl.exec:\rllxxrl.exe56⤵
- Executes dropped EXE
PID:4420 -
\??\c:\hhhbbb.exec:\hhhbbb.exe57⤵
- Executes dropped EXE
PID:2720 -
\??\c:\5hnhbb.exec:\5hnhbb.exe58⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pdpjj.exec:\pdpjj.exe59⤵
- Executes dropped EXE
PID:3908 -
\??\c:\fxfxllr.exec:\fxfxllr.exe60⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lxfffll.exec:\lxfffll.exe61⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hbbhnt.exec:\hbbhnt.exe62⤵
- Executes dropped EXE
PID:4612 -
\??\c:\5jvvd.exec:\5jvvd.exe63⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rxfffff.exec:\rxfffff.exe64⤵
- Executes dropped EXE
PID:848 -
\??\c:\1thbnn.exec:\1thbnn.exe65⤵
- Executes dropped EXE
PID:3832 -
\??\c:\ppdvv.exec:\ppdvv.exe66⤵PID:4296
-
\??\c:\xxfflrf.exec:\xxfflrf.exe67⤵PID:1304
-
\??\c:\bnbttt.exec:\bnbttt.exe68⤵PID:4412
-
\??\c:\bhnnnn.exec:\bhnnnn.exe69⤵PID:1728
-
\??\c:\1jvpd.exec:\1jvpd.exe70⤵PID:4860
-
\??\c:\frfxrrr.exec:\frfxrrr.exe71⤵PID:5040
-
\??\c:\bbbhht.exec:\bbbhht.exe72⤵PID:1328
-
\??\c:\dpddd.exec:\dpddd.exe73⤵PID:3916
-
\??\c:\rrlffff.exec:\rrlffff.exe74⤵PID:868
-
\??\c:\xrfxxxl.exec:\xrfxxxl.exe75⤵PID:3624
-
\??\c:\5nnhnt.exec:\5nnhnt.exe76⤵PID:2900
-
\??\c:\pddvp.exec:\pddvp.exe77⤵PID:2376
-
\??\c:\9flfxxr.exec:\9flfxxr.exe78⤵PID:4188
-
\??\c:\hhtttn.exec:\hhtttn.exe79⤵PID:2028
-
\??\c:\vddvp.exec:\vddvp.exe80⤵PID:2000
-
\??\c:\nntbbt.exec:\nntbbt.exe81⤵PID:2424
-
\??\c:\hthhhb.exec:\hthhhb.exe82⤵PID:2396
-
\??\c:\jjpvd.exec:\jjpvd.exe83⤵PID:780
-
\??\c:\9lllffx.exec:\9lllffx.exe84⤵PID:640
-
\??\c:\bthhnn.exec:\bthhnn.exe85⤵PID:952
-
\??\c:\htbbbb.exec:\htbbbb.exe86⤵PID:1920
-
\??\c:\vjvvv.exec:\vjvvv.exe87⤵PID:3960
-
\??\c:\3llrrll.exec:\3llrrll.exe88⤵PID:2160
-
\??\c:\ntntnt.exec:\ntntnt.exe89⤵PID:2780
-
\??\c:\jvvdd.exec:\jvvdd.exe90⤵PID:4180
-
\??\c:\fxllflr.exec:\fxllflr.exe91⤵PID:844
-
\??\c:\nnnntn.exec:\nnnntn.exe92⤵PID:1616
-
\??\c:\pjpjv.exec:\pjpjv.exe93⤵PID:1564
-
\??\c:\fllffff.exec:\fllffff.exe94⤵PID:2368
-
\??\c:\jvjdv.exec:\jvjdv.exe95⤵PID:2400
-
\??\c:\9xfxxxr.exec:\9xfxxxr.exe96⤵PID:2528
-
\??\c:\ttnttn.exec:\ttnttn.exe97⤵PID:2148
-
\??\c:\vpvpd.exec:\vpvpd.exe98⤵PID:1220
-
\??\c:\llrlfff.exec:\llrlfff.exe99⤵PID:4492
-
\??\c:\fxrllrr.exec:\fxrllrr.exe100⤵PID:2184
-
\??\c:\nnhhhh.exec:\nnhhhh.exe101⤵PID:2920
-
\??\c:\3jppp.exec:\3jppp.exe102⤵PID:1272
-
\??\c:\jpdvv.exec:\jpdvv.exe103⤵PID:1420
-
\??\c:\rxrxxxx.exec:\rxrxxxx.exe104⤵PID:1432
-
\??\c:\bhhhtb.exec:\bhhhtb.exe105⤵PID:2948
-
\??\c:\bhnhhn.exec:\bhnhhn.exe106⤵PID:2768
-
\??\c:\ddddj.exec:\ddddj.exe107⤵PID:3616
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe108⤵PID:3984
-
\??\c:\tnttbb.exec:\tnttbb.exe109⤵PID:4548
-
\??\c:\9vvvp.exec:\9vvvp.exe110⤵PID:4680
-
\??\c:\lxllxlx.exec:\lxllxlx.exe111⤵PID:4848
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe112⤵PID:3784
-
\??\c:\tnthtn.exec:\tnthtn.exe113⤵PID:5100
-
\??\c:\vvvpj.exec:\vvvpj.exe114⤵PID:1784
-
\??\c:\3llfxxr.exec:\3llfxxr.exe115⤵PID:2624
-
\??\c:\lxllflf.exec:\lxllflf.exe116⤵PID:4852
-
\??\c:\bbtnhh.exec:\bbtnhh.exe117⤵PID:4036
-
\??\c:\5jvpv.exec:\5jvpv.exe118⤵PID:4764
-
\??\c:\5rfffff.exec:\5rfffff.exe119⤵PID:4676
-
\??\c:\7hnnnn.exec:\7hnnnn.exe120⤵PID:4452
-
\??\c:\nbhhbb.exec:\nbhhbb.exe121⤵PID:2984
-
\??\c:\pjddp.exec:\pjddp.exe122⤵PID:1824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-