Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 20:43
Behavioral task
behavioral1
Sample
370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
General
-
Target
370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe
-
Size
169KB
-
MD5
370f737a254c94fdb1a72175e0a36610
-
SHA1
f0f3abc88d55243d4f335d099cffbd86fe62386f
-
SHA256
51a6a8ed7a57f71d1578876e4d3451eff9d3dfe9e283a2843ea836ae46b7acd4
-
SHA512
effb3194f60ef932c4f7af82ed7f71ac8ec67ff63ee931db867525468fc741787fad174a91f6b913fb00e0e39cfc545ca931e724afa43cbc500d28ae42d13c36
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2R:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8Vc
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 43 IoCs
Processes:
resource yara_rule behavioral1/memory/2704-4-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2996-12-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2544-29-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2976-21-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2864-49-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2812-67-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2412-78-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2256-146-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2440-171-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3044-207-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1624-225-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2244-242-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/348-253-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2448-320-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2416-378-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2972-404-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2016-552-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2016-558-0x00000000001B0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/1520-574-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2656-600-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2656-599-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2016-597-0x00000000001B0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/2156-642-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/360-641-0x00000000002D0000-0x0000000000316000-memory.dmp family_blackmoon behavioral1/memory/360-640-0x00000000002D0000-0x0000000000316000-memory.dmp family_blackmoon behavioral1/memory/2156-649-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/360-688-0x00000000002D0000-0x0000000000316000-memory.dmp family_blackmoon behavioral1/memory/660-632-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2364-619-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1912-519-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2236-456-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1652-448-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1736-423-0x0000000000260000-0x00000000002A6000-memory.dmp family_blackmoon behavioral1/memory/2416-377-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1628-313-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1432-268-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2224-251-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2524-182-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2688-180-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2060-87-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2628-76-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2484-46-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1520-866-0x00000000003A0000-0x00000000003E6000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpvv.exefrxxrfr.exexxfrxxf.exenbnhnn.exe9dpvj.exexxllxxx.exebbnthn.exevjpvv.exedvppd.exellxlrfx.exe5bhtbh.exebtntbn.exevppvp.exerlflrrx.exetttnbh.exejjpdj.exepjpjp.exellrxxxf.exetnbnhn.exe3jvdd.exejvdpv.exelxllrxf.exelflrlrl.exedpddj.exexlrxxff.exelxxxxxf.exebtthbh.exe5dvvv.exefxrxlrf.exehbtbnt.exebbthth.exellrfxrx.exerrflrlx.exennhntb.exetnhtnn.exedjdpj.exelxrrfxl.exexrlrflx.exetnttnn.exevvdvj.exevpjvd.exe1rffrrf.exexxrxflr.exebthhhh.exenhbnbb.exeppdjp.exerrflffr.exe9bnbht.exevpdvp.exevvpdj.exe5xrfxxl.exehhntbh.exetbnbbt.exevjjpd.exe5dppv.exe5lfrflx.exebnnnnn.exethnhnh.exepdpvj.exe7pdjp.exefxxxlfl.exe9tntbb.exe7nhbnt.exevjdvd.exepid process 2996 vvpvv.exe 2976 frxxrfr.exe 2544 xxfrxxf.exe 2484 nbnhnn.exe 2864 9dpvj.exe 2812 xxllxxx.exe 2628 bbnthn.exe 2412 vjpvv.exe 2060 dvppd.exe 2228 llxlrfx.exe 1464 5bhtbh.exe 1260 btntbn.exe 2304 vppvp.exe 1744 rlflrrx.exe 2256 tttnbh.exe 1780 jjpdj.exe 1652 pjpjp.exe 2440 llrxxxf.exe 2688 tnbnhn.exe 2524 3jvdd.exe 1732 jvdpv.exe 3044 lxllrxf.exe 692 lflrlrl.exe 1624 dpddj.exe 1708 xlrxxff.exe 2244 lxxxxxf.exe 2224 btthbh.exe 348 5dvvv.exe 1432 fxrxlrf.exe 2196 hbtbnt.exe 2908 bbthth.exe 992 llrfxrx.exe 1592 rrflrlx.exe 2984 nnhntb.exe 1628 tnhtnn.exe 2448 djdpj.exe 2976 lxrrfxl.exe 3048 xrlrflx.exe 2472 tnttnn.exe 2532 vvdvj.exe 2220 vpjvd.exe 2612 1rffrrf.exe 2360 xxrxflr.exe 2800 bthhhh.exe 2416 nhbnbb.exe 296 ppdjp.exe 2072 rrflffr.exe 2316 9bnbht.exe 2328 vpdvp.exe 2972 vvpdj.exe 1016 5xrfxxl.exe 1736 hhntbh.exe 1784 tbnbbt.exe 1648 vjjpd.exe 2816 5dppv.exe 1652 5lfrflx.exe 2236 bnnnnn.exe 2684 thnhnh.exe 2152 pdpvj.exe 1924 7pdjp.exe 324 fxxxlfl.exe 3044 9tntbb.exe 1396 7nhbnt.exe 1292 vjdvd.exe -
Processes:
resource yara_rule behavioral1/memory/2704-4-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2912-0-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vvpvv.exe upx behavioral1/memory/2996-12-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2544-29-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\xxfrxxf.exe upx behavioral1/memory/2544-32-0x0000000000220000-0x0000000000266000-memory.dmp upx behavioral1/memory/2976-21-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\frxxrfr.exe upx \??\c:\nbnhnn.exe upx behavioral1/memory/2484-38-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bbnthn.exe upx behavioral1/memory/2812-67-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2412-78-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\llxlrfx.exe upx behavioral1/memory/1464-104-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2304-120-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\rlflrrx.exe upx C:\tttnbh.exe upx behavioral1/memory/2256-146-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\jjpdj.exe upx behavioral1/memory/2440-171-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jvdpv.exe upx behavioral1/memory/3044-207-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lflrlrl.exe upx \??\c:\dpddj.exe upx behavioral1/memory/1624-225-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2244-242-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\btthbh.exe upx behavioral1/memory/348-253-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bbthth.exe upx behavioral1/memory/2984-299-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1628-306-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2448-320-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2976-321-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2416-378-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/296-379-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2972-404-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/320-500-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2016-552-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/992-566-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1520-574-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2656-600-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2656-599-0x0000000000220000-0x0000000000266000-memory.dmp upx behavioral1/memory/348-532-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2156-642-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1792-650-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/360-633-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1544-681-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/660-632-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2364-619-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1912-519-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1768-707-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/324-475-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2236-456-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1652-448-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1628-313-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\llrfxrx.exe upx \??\c:\hbtbnt.exe upx behavioral1/memory/1432-268-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\fxrxlrf.exe upx \??\c:\5dvvv.exe upx behavioral1/memory/2224-251-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exevvpvv.exefrxxrfr.exexxfrxxf.exenbnhnn.exe9dpvj.exexxllxxx.exebbnthn.exevjpvv.exedvppd.exellxlrfx.exe5bhtbh.exebtntbn.exevppvp.exerlflrrx.exedescription pid process target process PID 2912 wrote to memory of 2704 2912 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe PID 2912 wrote to memory of 2704 2912 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe PID 2912 wrote to memory of 2704 2912 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe PID 2912 wrote to memory of 2704 2912 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe PID 2704 wrote to memory of 2996 2704 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe vvpvv.exe PID 2704 wrote to memory of 2996 2704 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe vvpvv.exe PID 2704 wrote to memory of 2996 2704 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe vvpvv.exe PID 2704 wrote to memory of 2996 2704 370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe vvpvv.exe PID 2996 wrote to memory of 2976 2996 vvpvv.exe lxrrfxl.exe PID 2996 wrote to memory of 2976 2996 vvpvv.exe lxrrfxl.exe PID 2996 wrote to memory of 2976 2996 vvpvv.exe lxrrfxl.exe PID 2996 wrote to memory of 2976 2996 vvpvv.exe lxrrfxl.exe PID 2976 wrote to memory of 2544 2976 frxxrfr.exe xxfrxxf.exe PID 2976 wrote to memory of 2544 2976 frxxrfr.exe xxfrxxf.exe PID 2976 wrote to memory of 2544 2976 frxxrfr.exe xxfrxxf.exe PID 2976 wrote to memory of 2544 2976 frxxrfr.exe xxfrxxf.exe PID 2544 wrote to memory of 2484 2544 xxfrxxf.exe nbnhnn.exe PID 2544 wrote to memory of 2484 2544 xxfrxxf.exe nbnhnn.exe PID 2544 wrote to memory of 2484 2544 xxfrxxf.exe nbnhnn.exe PID 2544 wrote to memory of 2484 2544 xxfrxxf.exe nbnhnn.exe PID 2484 wrote to memory of 2864 2484 nbnhnn.exe 9dpvj.exe PID 2484 wrote to memory of 2864 2484 nbnhnn.exe 9dpvj.exe PID 2484 wrote to memory of 2864 2484 nbnhnn.exe 9dpvj.exe PID 2484 wrote to memory of 2864 2484 nbnhnn.exe 9dpvj.exe PID 2864 wrote to memory of 2812 2864 9dpvj.exe xxllxxx.exe PID 2864 wrote to memory of 2812 2864 9dpvj.exe xxllxxx.exe PID 2864 wrote to memory of 2812 2864 9dpvj.exe xxllxxx.exe PID 2864 wrote to memory of 2812 2864 9dpvj.exe xxllxxx.exe PID 2812 wrote to memory of 2628 2812 xxllxxx.exe bbnthn.exe PID 2812 wrote to memory of 2628 2812 xxllxxx.exe bbnthn.exe PID 2812 wrote to memory of 2628 2812 xxllxxx.exe bbnthn.exe PID 2812 wrote to memory of 2628 2812 xxllxxx.exe bbnthn.exe PID 2628 wrote to memory of 2412 2628 bbnthn.exe vjpvv.exe PID 2628 wrote to memory of 2412 2628 bbnthn.exe vjpvv.exe PID 2628 wrote to memory of 2412 2628 bbnthn.exe vjpvv.exe PID 2628 wrote to memory of 2412 2628 bbnthn.exe vjpvv.exe PID 2412 wrote to memory of 2060 2412 vjpvv.exe dvppd.exe PID 2412 wrote to memory of 2060 2412 vjpvv.exe dvppd.exe PID 2412 wrote to memory of 2060 2412 vjpvv.exe dvppd.exe PID 2412 wrote to memory of 2060 2412 vjpvv.exe dvppd.exe PID 2060 wrote to memory of 2228 2060 dvppd.exe llxlrfx.exe PID 2060 wrote to memory of 2228 2060 dvppd.exe llxlrfx.exe PID 2060 wrote to memory of 2228 2060 dvppd.exe llxlrfx.exe PID 2060 wrote to memory of 2228 2060 dvppd.exe llxlrfx.exe PID 2228 wrote to memory of 1464 2228 llxlrfx.exe 5bhtbh.exe PID 2228 wrote to memory of 1464 2228 llxlrfx.exe 5bhtbh.exe PID 2228 wrote to memory of 1464 2228 llxlrfx.exe 5bhtbh.exe PID 2228 wrote to memory of 1464 2228 llxlrfx.exe 5bhtbh.exe PID 1464 wrote to memory of 1260 1464 5bhtbh.exe btntbn.exe PID 1464 wrote to memory of 1260 1464 5bhtbh.exe btntbn.exe PID 1464 wrote to memory of 1260 1464 5bhtbh.exe btntbn.exe PID 1464 wrote to memory of 1260 1464 5bhtbh.exe btntbn.exe PID 1260 wrote to memory of 2304 1260 btntbn.exe vppvp.exe PID 1260 wrote to memory of 2304 1260 btntbn.exe vppvp.exe PID 1260 wrote to memory of 2304 1260 btntbn.exe vppvp.exe PID 1260 wrote to memory of 2304 1260 btntbn.exe vppvp.exe PID 2304 wrote to memory of 1744 2304 vppvp.exe rlflrrx.exe PID 2304 wrote to memory of 1744 2304 vppvp.exe rlflrrx.exe PID 2304 wrote to memory of 1744 2304 vppvp.exe rlflrrx.exe PID 2304 wrote to memory of 1744 2304 vppvp.exe rlflrrx.exe PID 1744 wrote to memory of 2256 1744 rlflrrx.exe tttnbh.exe PID 1744 wrote to memory of 2256 1744 rlflrrx.exe tttnbh.exe PID 1744 wrote to memory of 2256 1744 rlflrrx.exe tttnbh.exe PID 1744 wrote to memory of 2256 1744 rlflrrx.exe tttnbh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\370f737a254c94fdb1a72175e0a36610_NeikiAnalytics.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vvpvv.exec:\vvpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\frxxrfr.exec:\frxxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xxfrxxf.exec:\xxfrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\nbnhnn.exec:\nbnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9dpvj.exec:\9dpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xxllxxx.exec:\xxllxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\bbnthn.exec:\bbnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vjpvv.exec:\vjpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\dvppd.exec:\dvppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\llxlrfx.exec:\llxlrfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\5bhtbh.exec:\5bhtbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\btntbn.exec:\btntbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\vppvp.exec:\vppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rlflrrx.exec:\rlflrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\tttnbh.exec:\tttnbh.exe18⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jjpdj.exec:\jjpdj.exe19⤵
- Executes dropped EXE
PID:1780 -
\??\c:\pjpjp.exec:\pjpjp.exe20⤵
- Executes dropped EXE
PID:1652 -
\??\c:\llrxxxf.exec:\llrxxxf.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\tnbnhn.exec:\tnbnhn.exe22⤵
- Executes dropped EXE
PID:2688 -
\??\c:\3jvdd.exec:\3jvdd.exe23⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jvdpv.exec:\jvdpv.exe24⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxllrxf.exec:\lxllrxf.exe25⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lflrlrl.exec:\lflrlrl.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\dpddj.exec:\dpddj.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlrxxff.exec:\xlrxxff.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lxxxxxf.exec:\lxxxxxf.exe29⤵
- Executes dropped EXE
PID:2244 -
\??\c:\btthbh.exec:\btthbh.exe30⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5dvvv.exec:\5dvvv.exe31⤵
- Executes dropped EXE
PID:348 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hbtbnt.exec:\hbtbnt.exe33⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bbthth.exec:\bbthth.exe34⤵
- Executes dropped EXE
PID:2908 -
\??\c:\llrfxrx.exec:\llrfxrx.exe35⤵
- Executes dropped EXE
PID:992 -
\??\c:\rrflrlx.exec:\rrflrlx.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nnhntb.exec:\nnhntb.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\tnhtnn.exec:\tnhtnn.exe38⤵
- Executes dropped EXE
PID:1628 -
\??\c:\djdpj.exec:\djdpj.exe39⤵
- Executes dropped EXE
PID:2448 -
\??\c:\lxrrfxl.exec:\lxrrfxl.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xrlrflx.exec:\xrlrflx.exe41⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tnttnn.exec:\tnttnn.exe42⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvdvj.exec:\vvdvj.exe43⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpjvd.exec:\vpjvd.exe44⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1rffrrf.exec:\1rffrrf.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xxrxflr.exec:\xxrxflr.exe46⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bthhhh.exec:\bthhhh.exe47⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhbnbb.exec:\nhbnbb.exe48⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppdjp.exec:\ppdjp.exe49⤵
- Executes dropped EXE
PID:296 -
\??\c:\rrflffr.exec:\rrflffr.exe50⤵
- Executes dropped EXE
PID:2072 -
\??\c:\9bnbht.exec:\9bnbht.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vpdvp.exec:\vpdvp.exe52⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvpdj.exec:\vvpdj.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\5xrfxxl.exec:\5xrfxxl.exe54⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hhntbh.exec:\hhntbh.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tbnbbt.exec:\tbnbbt.exe56⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vjjpd.exec:\vjjpd.exe57⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5dppv.exec:\5dppv.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5lfrflx.exec:\5lfrflx.exe59⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnnnnn.exec:\bnnnnn.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\thnhnh.exec:\thnhnh.exe61⤵
- Executes dropped EXE
PID:2684 -
\??\c:\pdpvj.exec:\pdpvj.exe62⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7pdjp.exec:\7pdjp.exe63⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fxxxlfl.exec:\fxxxlfl.exe64⤵
- Executes dropped EXE
PID:324 -
\??\c:\9tntbb.exec:\9tntbb.exe65⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7nhbnt.exec:\7nhbnt.exe66⤵
- Executes dropped EXE
PID:1396 -
\??\c:\vjdvd.exec:\vjdvd.exe67⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7vvdp.exec:\7vvdp.exe68⤵PID:320
-
\??\c:\xlxfrlf.exec:\xlxfrlf.exe69⤵PID:952
-
\??\c:\rflrxff.exec:\rflrxff.exe70⤵PID:1912
-
\??\c:\bnhhtt.exec:\bnhhtt.exe71⤵PID:2192
-
\??\c:\pvddj.exec:\pvddj.exe72⤵PID:2932
-
\??\c:\pjvvp.exec:\pjvvp.exe73⤵PID:348
-
\??\c:\xrflxrx.exec:\xrflxrx.exe74⤵PID:2772
-
\??\c:\xxrlflx.exec:\xxrlflx.exe75⤵PID:2176
-
\??\c:\btbbnn.exec:\btbbnn.exe76⤵PID:2016
-
\??\c:\dpvpv.exec:\dpvpv.exe77⤵PID:816
-
\??\c:\jddjp.exec:\jddjp.exe78⤵PID:992
-
\??\c:\rlrxfll.exec:\rlrxfll.exe79⤵PID:1520
-
\??\c:\nnnnnt.exec:\nnnnnt.exe80⤵PID:2852
-
\??\c:\9djjj.exec:\9djjj.exe81⤵PID:2952
-
\??\c:\7pjdv.exec:\7pjdv.exe82⤵PID:2656
-
\??\c:\lflflfl.exec:\lflflfl.exe83⤵PID:2320
-
\??\c:\rfxlxlr.exec:\rfxlxlr.exe84⤵PID:2456
-
\??\c:\tnhnbn.exec:\tnhnbn.exe85⤵PID:2376
-
\??\c:\vpjvj.exec:\vpjvj.exe86⤵PID:2364
-
\??\c:\llfrxfl.exec:\llfrxfl.exe87⤵PID:660
-
\??\c:\7xxfxxl.exec:\7xxfxxl.exe88⤵PID:360
-
\??\c:\hbnthh.exec:\hbnthh.exe89⤵PID:2156
-
\??\c:\ddvpj.exec:\ddvpj.exe90⤵PID:1792
-
\??\c:\xrfflrx.exec:\xrfflrx.exe91⤵PID:2064
-
\??\c:\lfxfflx.exec:\lfxfflx.exe92⤵PID:1516
-
\??\c:\thnhbb.exec:\thnhbb.exe93⤵PID:2404
-
\??\c:\5vvjv.exec:\5vvjv.exe94⤵PID:2400
-
\??\c:\vjvvp.exec:\vjvvp.exe95⤵PID:1544
-
\??\c:\xrxfllr.exec:\xrxfllr.exe96⤵PID:2304
-
\??\c:\rxflxxl.exec:\rxflxxl.exe97⤵PID:1744
-
\??\c:\hbtbtb.exec:\hbtbtb.exe98⤵PID:2356
-
\??\c:\jpvvv.exec:\jpvvv.exe99⤵PID:1768
-
\??\c:\jjvdv.exec:\jjvdv.exe100⤵PID:1268
-
\??\c:\vvvjp.exec:\vvvjp.exe101⤵PID:1572
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe102⤵PID:1616
-
\??\c:\tnbnth.exec:\tnbnth.exe103⤵PID:2080
-
\??\c:\9bnhht.exec:\9bnhht.exe104⤵PID:2556
-
\??\c:\1pdpp.exec:\1pdpp.exe105⤵PID:2580
-
\??\c:\ddppf.exec:\ddppf.exe106⤵PID:2152
-
\??\c:\9hthnt.exec:\9hthnt.exe107⤵PID:2528
-
\??\c:\1xxflfl.exec:\1xxflfl.exe108⤵PID:980
-
\??\c:\bnbhtt.exec:\bnbhtt.exe109⤵PID:1100
-
\??\c:\5vjjp.exec:\5vjjp.exe110⤵PID:1712
-
\??\c:\vjddj.exec:\vjddj.exe111⤵PID:336
-
\??\c:\rflfllf.exec:\rflfllf.exe112⤵PID:1236
-
\??\c:\bhnnbb.exec:\bhnnbb.exe113⤵PID:1408
-
\??\c:\vdppv.exec:\vdppv.exe114⤵PID:1532
-
\??\c:\rxrlrrx.exec:\rxrlrrx.exe115⤵PID:948
-
\??\c:\5jvvj.exec:\5jvvj.exe116⤵PID:2584
-
\??\c:\dppvd.exec:\dppvd.exe117⤵PID:2000
-
\??\c:\3xflrxf.exec:\3xflrxf.exe118⤵PID:348
-
\??\c:\btnthh.exec:\btnthh.exe119⤵PID:1608
-
\??\c:\vjvvd.exec:\vjvvd.exe120⤵PID:1012
-
\??\c:\rfrxfff.exec:\rfrxfff.exe121⤵PID:2172
-
\??\c:\hnbbnt.exec:\hnbbnt.exe122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-