Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:50
Behavioral task
behavioral1
Sample
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe
-
Size
365KB
-
MD5
7172126158ab77902e0f68a0eadba970
-
SHA1
0c935d475865024cfc7541a6472eccbb85e68e6a
-
SHA256
0754ec5a288c358ddd09cb7d9bac10492a38f649aca7e20ca24ed2e795661caf
-
SHA512
3a89f25de3f5c569ace4d9010a9dde7f741a9396fbea5d9b05cd3d18a3bbdd9da9fe7a8e5712bcf799f0ddd181583b14f6e7021baac8cbfe7a2076de45fada22
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjdgyPPBR:R4wFHoSHYHUrAwqzQ7PPr
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/1776-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/696-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3004-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4120-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/724-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/472-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-529-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-556-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-763-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-876-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrrlll.exe9bttth.exedvjjv.exevddvp.exexlrlrlf.exevdvvd.exevjjdv.exelxfflff.exebtbthn.exejdjjj.exehnnnhb.exevpvjj.exelxlllll.exepjppj.exefflxxlf.exevpddd.exerxlfxxx.exe9rxrllf.exebbtntn.exe5rfxrrl.exenntbtn.exeddjdd.exe9bthbh.exerllflfx.exelrxrfff.exedjvjd.exepjvpd.exexlfrfxr.exefrfflrr.exenthbth.exejvdvd.exe7flfxxr.exeddddp.exellrrfxl.exetntnnh.exevpjvv.exefffflfl.exerxxxxxr.exebhnhbn.exeddddd.exexxfffrx.exehbhhnn.exedjjdd.exefxlfffl.exe5ntbtb.exepjpjd.exerxfffxr.exetnnhht.exe9lllfff.exevpvvp.exexfrlffx.exehnhhbn.exepppvv.exebtbbbt.exebnhbbb.exevpppv.exelfffrrf.exenttnhh.exe7bhbtt.exedpddd.exelflllll.exetbttnh.exehnnthh.exe5ppjd.exepid process 4600 ffrrlll.exe 1560 9bttth.exe 2436 dvjjv.exe 2700 vddvp.exe 2528 xlrlrlf.exe 1120 vdvvd.exe 696 vjjdv.exe 928 lxfflff.exe 1860 btbthn.exe 4276 jdjjj.exe 2792 hnnnhb.exe 3692 vpvjj.exe 4892 lxlllll.exe 3392 pjppj.exe 5080 fflxxlf.exe 4688 vpddd.exe 2080 rxlfxxx.exe 4196 9rxrllf.exe 3976 bbtntn.exe 1408 5rfxrrl.exe 2960 nntbtn.exe 4540 ddjdd.exe 2292 9bthbh.exe 1044 rllflfx.exe 3004 lrxrfff.exe 5048 djvjd.exe 216 pjvpd.exe 1596 xlfrfxr.exe 1296 frfflrr.exe 4256 nthbth.exe 2044 jvdvd.exe 4832 7flfxxr.exe 1212 ddddp.exe 2216 llrrfxl.exe 2584 tntnnh.exe 3308 vpjvv.exe 3384 fffflfl.exe 3164 rxxxxxr.exe 968 bhnhbn.exe 2944 ddddd.exe 908 xxfffrx.exe 2424 hbhhnn.exe 4336 djjdd.exe 4300 fxlfffl.exe 1400 5ntbtb.exe 2068 pjpjd.exe 1068 rxfffxr.exe 2704 tnnhht.exe 4452 9lllfff.exe 1660 vpvvp.exe 2912 xfrlffx.exe 336 hnhhbn.exe 1388 pppvv.exe 4120 btbbbt.exe 1160 bnhbbb.exe 3924 vpppv.exe 4356 lfffrrf.exe 4276 nttnhh.exe 4400 7bhbtt.exe 4416 dpddd.exe 3180 lflllll.exe 4412 tbttnh.exe 3996 hnnthh.exe 3392 5ppjd.exe -
Processes:
resource yara_rule behavioral2/memory/1776-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffrrlll.exe upx behavioral2/memory/4600-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1776-5-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjjv.exe upx behavioral2/memory/2436-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2700-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1560-12-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9bttth.exe upx \??\c:\vddvp.exe upx C:\xlrlrlf.exe upx C:\vdvvd.exe upx behavioral2/memory/1120-32-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjjdv.exe upx behavioral2/memory/696-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2528-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxfflff.exe upx behavioral2/memory/928-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/928-47-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btbthn.exe upx behavioral2/memory/1860-49-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjjj.exe upx C:\hnnnhb.exe upx behavioral2/memory/4276-57-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpvjj.exe upx behavioral2/memory/2792-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3692-64-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlllll.exe upx C:\pjppj.exe upx C:\fflxxlf.exe upx behavioral2/memory/5080-78-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vpddd.exe upx behavioral2/memory/4688-82-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rxlfxxx.exe upx C:\9rxrllf.exe upx C:\bbtntn.exe upx behavioral2/memory/3976-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rfxrrl.exe upx behavioral2/memory/3976-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntbtn.exe upx \??\c:\ddjdd.exe upx behavioral2/memory/1408-106-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bthbh.exe upx C:\rllflfx.exe upx C:\lrxrfff.exe upx C:\djvjd.exe upx behavioral2/memory/3004-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5048-125-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pjvpd.exe upx behavioral2/memory/216-132-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xlfrfxr.exe upx C:\frfflrr.exe upx behavioral2/memory/1296-141-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthbth.exe upx C:\jvdvd.exe upx behavioral2/memory/4256-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2044-150-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7flfxxr.exe upx behavioral2/memory/1212-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2216-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3164-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exeffrrlll.exe9bttth.exedvjjv.exevddvp.exexlrlrlf.exevdvvd.exevjjdv.exelxfflff.exebtbthn.exejdjjj.exehnnnhb.exevpvjj.exelxlllll.exepjppj.exefflxxlf.exevpddd.exerxlfxxx.exe9rxrllf.exebbtntn.exe5rfxrrl.exenntbtn.exedescription pid process target process PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe ffrrlll.exe PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe ffrrlll.exe PID 1776 wrote to memory of 4600 1776 7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe ffrrlll.exe PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 9bttth.exe PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 9bttth.exe PID 4600 wrote to memory of 1560 4600 ffrrlll.exe 9bttth.exe PID 1560 wrote to memory of 2436 1560 9bttth.exe dvjjv.exe PID 1560 wrote to memory of 2436 1560 9bttth.exe dvjjv.exe PID 1560 wrote to memory of 2436 1560 9bttth.exe dvjjv.exe PID 2436 wrote to memory of 2700 2436 dvjjv.exe vddvp.exe PID 2436 wrote to memory of 2700 2436 dvjjv.exe vddvp.exe PID 2436 wrote to memory of 2700 2436 dvjjv.exe vddvp.exe PID 2700 wrote to memory of 2528 2700 vddvp.exe xlrlrlf.exe PID 2700 wrote to memory of 2528 2700 vddvp.exe xlrlrlf.exe PID 2700 wrote to memory of 2528 2700 vddvp.exe xlrlrlf.exe PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe vdvvd.exe PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe vdvvd.exe PID 2528 wrote to memory of 1120 2528 xlrlrlf.exe vdvvd.exe PID 1120 wrote to memory of 696 1120 vdvvd.exe vjjdv.exe PID 1120 wrote to memory of 696 1120 vdvvd.exe vjjdv.exe PID 1120 wrote to memory of 696 1120 vdvvd.exe vjjdv.exe PID 696 wrote to memory of 928 696 vjjdv.exe lxfflff.exe PID 696 wrote to memory of 928 696 vjjdv.exe lxfflff.exe PID 696 wrote to memory of 928 696 vjjdv.exe lxfflff.exe PID 928 wrote to memory of 1860 928 lxfflff.exe btbthn.exe PID 928 wrote to memory of 1860 928 lxfflff.exe btbthn.exe PID 928 wrote to memory of 1860 928 lxfflff.exe btbthn.exe PID 1860 wrote to memory of 4276 1860 btbthn.exe jdjjj.exe PID 1860 wrote to memory of 4276 1860 btbthn.exe jdjjj.exe PID 1860 wrote to memory of 4276 1860 btbthn.exe jdjjj.exe PID 4276 wrote to memory of 2792 4276 jdjjj.exe hnnnhb.exe PID 4276 wrote to memory of 2792 4276 jdjjj.exe hnnnhb.exe PID 4276 wrote to memory of 2792 4276 jdjjj.exe hnnnhb.exe PID 2792 wrote to memory of 3692 2792 hnnnhb.exe vpvjj.exe PID 2792 wrote to memory of 3692 2792 hnnnhb.exe vpvjj.exe PID 2792 wrote to memory of 3692 2792 hnnnhb.exe vpvjj.exe PID 3692 wrote to memory of 4892 3692 vpvjj.exe lxlllll.exe PID 3692 wrote to memory of 4892 3692 vpvjj.exe lxlllll.exe PID 3692 wrote to memory of 4892 3692 vpvjj.exe lxlllll.exe PID 4892 wrote to memory of 3392 4892 lxlllll.exe pjppj.exe PID 4892 wrote to memory of 3392 4892 lxlllll.exe pjppj.exe PID 4892 wrote to memory of 3392 4892 lxlllll.exe pjppj.exe PID 3392 wrote to memory of 5080 3392 pjppj.exe fflxxlf.exe PID 3392 wrote to memory of 5080 3392 pjppj.exe fflxxlf.exe PID 3392 wrote to memory of 5080 3392 pjppj.exe fflxxlf.exe PID 5080 wrote to memory of 4688 5080 fflxxlf.exe vpddd.exe PID 5080 wrote to memory of 4688 5080 fflxxlf.exe vpddd.exe PID 5080 wrote to memory of 4688 5080 fflxxlf.exe vpddd.exe PID 4688 wrote to memory of 2080 4688 vpddd.exe rxlfxxx.exe PID 4688 wrote to memory of 2080 4688 vpddd.exe rxlfxxx.exe PID 4688 wrote to memory of 2080 4688 vpddd.exe rxlfxxx.exe PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 9rxrllf.exe PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 9rxrllf.exe PID 2080 wrote to memory of 4196 2080 rxlfxxx.exe 9rxrllf.exe PID 4196 wrote to memory of 3976 4196 9rxrllf.exe bbtntn.exe PID 4196 wrote to memory of 3976 4196 9rxrllf.exe bbtntn.exe PID 4196 wrote to memory of 3976 4196 9rxrllf.exe bbtntn.exe PID 3976 wrote to memory of 1408 3976 bbtntn.exe 5rfxrrl.exe PID 3976 wrote to memory of 1408 3976 bbtntn.exe 5rfxrrl.exe PID 3976 wrote to memory of 1408 3976 bbtntn.exe 5rfxrrl.exe PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe nntbtn.exe PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe nntbtn.exe PID 1408 wrote to memory of 2960 1408 5rfxrrl.exe nntbtn.exe PID 2960 wrote to memory of 4540 2960 nntbtn.exe ddjdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7172126158ab77902e0f68a0eadba970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ffrrlll.exec:\ffrrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\9bttth.exec:\9bttth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dvjjv.exec:\dvjjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vddvp.exec:\vddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xlrlrlf.exec:\xlrlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vdvvd.exec:\vdvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\vjjdv.exec:\vjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\lxfflff.exec:\lxfflff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\btbthn.exec:\btbthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jdjjj.exec:\jdjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hnnnhb.exec:\hnnnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vpvjj.exec:\vpvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lxlllll.exec:\lxlllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pjppj.exec:\pjppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\fflxxlf.exec:\fflxxlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vpddd.exec:\vpddd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\9rxrllf.exec:\9rxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\bbtntn.exec:\bbtntn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\5rfxrrl.exec:\5rfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\nntbtn.exec:\nntbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ddjdd.exec:\ddjdd.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\9bthbh.exec:\9bthbh.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rllflfx.exec:\rllflfx.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrxrfff.exec:\lrxrfff.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\djvjd.exec:\djvjd.exe27⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pjvpd.exec:\pjvpd.exe28⤵
- Executes dropped EXE
PID:216 -
\??\c:\xlfrfxr.exec:\xlfrfxr.exe29⤵
- Executes dropped EXE
PID:1596 -
\??\c:\frfflrr.exec:\frfflrr.exe30⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nthbth.exec:\nthbth.exe31⤵
- Executes dropped EXE
PID:4256 -
\??\c:\jvdvd.exec:\jvdvd.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7flfxxr.exec:\7flfxxr.exe33⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ddddp.exec:\ddddp.exe34⤵
- Executes dropped EXE
PID:1212 -
\??\c:\llrrfxl.exec:\llrrfxl.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\tntnnh.exec:\tntnnh.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\vpjvv.exec:\vpjvv.exe37⤵
- Executes dropped EXE
PID:3308 -
\??\c:\fffflfl.exec:\fffflfl.exe38⤵
- Executes dropped EXE
PID:3384 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe39⤵
- Executes dropped EXE
PID:3164 -
\??\c:\bhnhbn.exec:\bhnhbn.exe40⤵
- Executes dropped EXE
PID:968 -
\??\c:\ddddd.exec:\ddddd.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxfffrx.exec:\xxfffrx.exe42⤵
- Executes dropped EXE
PID:908 -
\??\c:\hbhhnn.exec:\hbhhnn.exe43⤵
- Executes dropped EXE
PID:2424 -
\??\c:\djjdd.exec:\djjdd.exe44⤵
- Executes dropped EXE
PID:4336 -
\??\c:\fxlfffl.exec:\fxlfffl.exe45⤵
- Executes dropped EXE
PID:4300 -
\??\c:\5ntbtb.exec:\5ntbtb.exe46⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjpjd.exec:\pjpjd.exe47⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxfffxr.exec:\rxfffxr.exe48⤵
- Executes dropped EXE
PID:1068 -
\??\c:\tnnhht.exec:\tnnhht.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9lllfff.exec:\9lllfff.exe50⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vpvvp.exec:\vpvvp.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xfrlffx.exec:\xfrlffx.exe52⤵
- Executes dropped EXE
PID:2912 -
\??\c:\hnhhbn.exec:\hnhhbn.exe53⤵
- Executes dropped EXE
PID:336 -
\??\c:\pppvv.exec:\pppvv.exe54⤵
- Executes dropped EXE
PID:1388 -
\??\c:\btbbbt.exec:\btbbbt.exe55⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bnhbbb.exec:\bnhbbb.exe56⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vpppv.exec:\vpppv.exe57⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lfffrrf.exec:\lfffrrf.exe58⤵
- Executes dropped EXE
PID:4356 -
\??\c:\nttnhh.exec:\nttnhh.exe59⤵
- Executes dropped EXE
PID:4276 -
\??\c:\7bhbtt.exec:\7bhbtt.exe60⤵
- Executes dropped EXE
PID:4400 -
\??\c:\dpddd.exec:\dpddd.exe61⤵
- Executes dropped EXE
PID:4416 -
\??\c:\lflllll.exec:\lflllll.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\tbttnh.exec:\tbttnh.exe63⤵
- Executes dropped EXE
PID:4412 -
\??\c:\hnnthh.exec:\hnnthh.exe64⤵
- Executes dropped EXE
PID:3996 -
\??\c:\5ppjd.exec:\5ppjd.exe65⤵
- Executes dropped EXE
PID:3392 -
\??\c:\lllrxxl.exec:\lllrxxl.exe66⤵PID:2380
-
\??\c:\htbbbn.exec:\htbbbn.exe67⤵PID:2220
-
\??\c:\ttnnbh.exec:\ttnnbh.exe68⤵PID:4028
-
\??\c:\ddppv.exec:\ddppv.exe69⤵PID:2412
-
\??\c:\rlrxxxr.exec:\rlrxxxr.exe70⤵PID:1436
-
\??\c:\hnbbtt.exec:\hnbbtt.exe71⤵PID:868
-
\??\c:\jdvvd.exec:\jdvvd.exe72⤵PID:4512
-
\??\c:\7lrllll.exec:\7lrllll.exe73⤵PID:2864
-
\??\c:\hbhbtn.exec:\hbhbtn.exe74⤵PID:2644
-
\??\c:\pjpjj.exec:\pjpjj.exe75⤵PID:2300
-
\??\c:\1rxfxxf.exec:\1rxfxxf.exe76⤵PID:2292
-
\??\c:\tnnbtn.exec:\tnnbtn.exe77⤵PID:724
-
\??\c:\nnbbbb.exec:\nnbbbb.exe78⤵PID:1240
-
\??\c:\jpvdd.exec:\jpvdd.exe79⤵PID:5036
-
\??\c:\fxrlrfl.exec:\fxrlrfl.exe80⤵PID:4468
-
\??\c:\nthhbb.exec:\nthhbb.exe81⤵PID:4156
-
\??\c:\9nhnhn.exec:\9nhnhn.exe82⤵PID:4588
-
\??\c:\pdvpd.exec:\pdvpd.exe83⤵PID:2296
-
\??\c:\rxrlffl.exec:\rxrlffl.exe84⤵PID:1284
-
\??\c:\hbbtnt.exec:\hbbtnt.exe85⤵PID:1556
-
\??\c:\vjvvp.exec:\vjvvp.exe86⤵PID:472
-
\??\c:\pjddj.exec:\pjddj.exe87⤵PID:628
-
\??\c:\lflfxxr.exec:\lflfxxr.exe88⤵PID:2640
-
\??\c:\bhttnn.exec:\bhttnn.exe89⤵PID:4352
-
\??\c:\tthtnn.exec:\tthtnn.exe90⤵PID:4948
-
\??\c:\jdjjj.exec:\jdjjj.exe91⤵PID:1692
-
\??\c:\xfffllf.exec:\xfffllf.exe92⤵PID:4940
-
\??\c:\xlxrlll.exec:\xlxrlll.exe93⤵PID:1004
-
\??\c:\5tbbbb.exec:\5tbbbb.exe94⤵PID:3788
-
\??\c:\7bhhtt.exec:\7bhhtt.exe95⤵PID:4364
-
\??\c:\vdppv.exec:\vdppv.exe96⤵PID:4904
-
\??\c:\xrlfrll.exec:\xrlfrll.exe97⤵PID:4300
-
\??\c:\hbtttt.exec:\hbtttt.exe98⤵PID:1824
-
\??\c:\jvdpj.exec:\jvdpj.exe99⤵PID:2068
-
\??\c:\tnbtbb.exec:\tnbtbb.exe100⤵PID:1068
-
\??\c:\nbhhbb.exec:\nbhhbb.exe101⤵PID:2704
-
\??\c:\dvvjp.exec:\dvvjp.exe102⤵PID:2700
-
\??\c:\9flfflf.exec:\9flfflf.exe103⤵PID:2440
-
\??\c:\bbnbtt.exec:\bbnbtt.exe104⤵PID:1392
-
\??\c:\ntbtnn.exec:\ntbtnn.exe105⤵PID:2688
-
\??\c:\djvpj.exec:\djvpj.exe106⤵PID:2364
-
\??\c:\rllfrlf.exec:\rllfrlf.exe107⤵PID:928
-
\??\c:\7hhhbb.exec:\7hhhbb.exe108⤵PID:5020
-
\??\c:\3hhhbb.exec:\3hhhbb.exe109⤵PID:3588
-
\??\c:\djppj.exec:\djppj.exe110⤵PID:5060
-
\??\c:\9xfrflf.exec:\9xfrflf.exe111⤵PID:2896
-
\??\c:\1fxrrxr.exec:\1fxrrxr.exe112⤵PID:2792
-
\??\c:\bnnbtn.exec:\bnnbtn.exe113⤵PID:2828
-
\??\c:\pjjdd.exec:\pjjdd.exe114⤵PID:3248
-
\??\c:\flllfff.exec:\flllfff.exe115⤵PID:4644
-
\??\c:\bhhhbt.exec:\bhhhbt.exe116⤵PID:1032
-
\??\c:\pddvj.exec:\pddvj.exe117⤵PID:1060
-
\??\c:\7xrxrfx.exec:\7xrxrfx.exe118⤵PID:4848
-
\??\c:\bhtnnb.exec:\bhtnnb.exe119⤵PID:4104
-
\??\c:\3jjjd.exec:\3jjjd.exe120⤵PID:4772
-
\??\c:\dvvjd.exec:\dvvjd.exe121⤵PID:5108
-
\??\c:\xflrrxr.exec:\xflrrxr.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-