Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26-05-2024 17:54
Behavioral task
behavioral1
Sample
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe
-
Size
192KB
-
MD5
1a5b21e0e0271c3a1f63c5234395fcf0
-
SHA1
f37fbbacbf931f335f6bfbe5233546ee6bcae76a
-
SHA256
3957371af7b8d003c018b1a7d71df6f2ad86175d0b363395a136e27465fe80f2
-
SHA512
2313f84727884a7f7b06ac835c30d1d6c1835e55118ac5a8d4674b0cd753a20ac4be58f9b05bed4c85aebd772a7cf70b407b62009fa012fad2a5f63b8e843f37
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSaF:Fcm4FmowdHoS8fMoSVAHubPtyYxfPF
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/3440-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3320-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3012-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4536-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4640-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1452-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4908-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/336-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1660-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4156-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/648-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2568-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1132-89-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2464-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3736-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2876-119-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3928-123-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4704-130-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1460-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1836-151-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1112-155-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4384-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4412-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4944-190-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4720-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/400-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1956-207-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1408-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1588-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5060-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4364-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1152-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2168-237-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2424-241-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4104-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5100-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4056-269-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2716-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4556-289-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3008-292-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5036-299-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2944-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4472-307-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2652-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4032-339-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1640-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1956-367-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1028-376-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4764-390-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2208-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1648-415-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3636-419-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4108-474-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3700-475-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2508-482-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-489-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4736-510-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-516-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3700-727-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4492-740-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4496-824-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2876-924-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\1pddp.exe family_berbew C:\lrlllll.exe family_berbew C:\btbtnh.exe family_berbew \??\c:\hhnhht.exe family_berbew C:\ppvvd.exe family_berbew C:\nthttb.exe family_berbew \??\c:\dpddv.exe family_berbew C:\nttnnb.exe family_berbew C:\3dpvp.exe family_berbew C:\flffffx.exe family_berbew C:\htbtbb.exe family_berbew C:\frrfxrl.exe family_berbew C:\tbhhbn.exe family_berbew C:\pjjdv.exe family_berbew C:\flxxrxr.exe family_berbew C:\bbbbtb.exe family_berbew C:\dddvv.exe family_berbew C:\bnbbtb.exe family_berbew \??\c:\1pvvj.exe family_berbew C:\rrlllll.exe family_berbew C:\nbhtnn.exe family_berbew C:\jvjdv.exe family_berbew C:\rfrlllr.exe family_berbew \??\c:\9nhbhn.exe family_berbew \??\c:\rxrflrx.exe family_berbew C:\tnbthh.exe family_berbew \??\c:\pdpjd.exe family_berbew \??\c:\lllllll.exe family_berbew C:\9lrrrxx.exe family_berbew C:\hbtbtt.exe family_berbew C:\vdjjd.exe family_berbew C:\fllllll.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
1pddp.exelrlllll.exebtbtnh.exehhnhht.exedpddv.exeppvvd.exenthttb.exenttnnb.exe3dpvp.exeflffffx.exehtbtbb.exefrrfxrl.exetbhhbn.exepjjdv.exeflxxrxr.exebbbbtb.exedddvv.exebnbbtb.exe1pvvj.exerrlllll.exenbhtnn.exejvjdv.exerfrlllr.exe9nhbhn.exerxrflrx.exelllllll.exetnbthh.exepdpjd.exe9lrrrxx.exehbtbtt.exevdjjd.exefllllll.exenhhbbb.exepvdvv.exejvjpp.exefxfxxxx.exehbtbth.exedvvjd.exe7jpjj.exexffxrrl.exenbhhhh.exethnhhh.exedpjvp.exefffrrfx.exexlfxxxx.exe7nbtnn.exeppjpv.exe9pvvj.exefxxrxxx.exetnhbbb.exe5jdvp.exe3fllrrf.exehbttbh.exe1pvdd.exepdjjv.exelflrfll.exexflrxxx.exebtnhbh.exevdddd.exe9ddvv.exelxlfxff.exenbbbtt.exepjpjd.exevvvjj.exepid process 3320 1pddp.exe 1660 lrlllll.exe 3012 btbtnh.exe 4536 hhnhht.exe 4640 dpddv.exe 4908 ppvvd.exe 1452 nthttb.exe 336 nttnnb.exe 4156 3dpvp.exe 648 flffffx.exe 536 htbtbb.exe 2568 frrfxrl.exe 3636 tbhhbn.exe 1132 pjjdv.exe 2464 flxxrxr.exe 3100 bbbbtb.exe 3736 dddvv.exe 2172 bnbbtb.exe 2876 1pvvj.exe 3928 rrlllll.exe 4704 nbhtnn.exe 1460 jvjdv.exe 4988 rfrlllr.exe 1196 9nhbhn.exe 1836 rxrflrx.exe 1112 lllllll.exe 4384 tnbthh.exe 2508 pdpjd.exe 4884 9lrrrxx.exe 2868 hbtbtt.exe 4412 vdjjd.exe 4944 fllllll.exe 4720 nhhbbb.exe 400 pvdvv.exe 980 jvjpp.exe 1956 fxfxxxx.exe 1408 hbtbth.exe 5072 dvvjd.exe 1588 7jpjj.exe 5060 xffxrrl.exe 4760 nbhhhh.exe 4364 thnhhh.exe 1152 dpjvp.exe 2168 fffrrfx.exe 2424 xlfxxxx.exe 1452 7nbtnn.exe 2232 ppjpv.exe 4156 9pvvj.exe 2444 fxxrxxx.exe 4104 tnhbbb.exe 5100 5jdvp.exe 2112 3fllrrf.exe 1252 hbttbh.exe 4056 1pvdd.exe 3032 pdjjv.exe 1472 lflrfll.exe 2716 xflrxxx.exe 4900 btnhbh.exe 4556 vdddd.exe 4068 9ddvv.exe 3008 lxlfxff.exe 5036 nbbbtt.exe 2944 pjpjd.exe 2236 vvvjj.exe -
Processes:
resource yara_rule behavioral2/memory/3440-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3440-5-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\1pddp.exe upx behavioral2/memory/3320-8-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lrlllll.exe upx C:\btbtnh.exe upx behavioral2/memory/3012-19-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\hhnhht.exe upx behavioral2/memory/4536-26-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppvvd.exe upx behavioral2/memory/4908-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4640-31-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nthttb.exe upx behavioral2/memory/1452-45-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4908-43-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\dpddv.exe upx C:\nttnnb.exe upx behavioral2/memory/336-50-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3dpvp.exe upx behavioral2/memory/1660-13-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\flffffx.exe upx behavioral2/memory/4156-60-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\htbtbb.exe upx behavioral2/memory/648-66-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\frrfxrl.exe upx C:\tbhhbn.exe upx behavioral2/memory/2568-77-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjjdv.exe upx behavioral2/memory/3636-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1132-85-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\flxxrxr.exe upx behavioral2/memory/1132-89-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2464-94-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bbbbtb.exe upx C:\dddvv.exe upx behavioral2/memory/3736-106-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bnbbtb.exe upx \??\c:\1pvvj.exe upx behavioral2/memory/2876-113-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rrlllll.exe upx behavioral2/memory/2876-119-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3928-123-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nbhtnn.exe upx behavioral2/memory/4704-130-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jvjdv.exe upx behavioral2/memory/1460-132-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rfrlllr.exe upx behavioral2/memory/1460-136-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\9nhbhn.exe upx behavioral2/memory/1196-147-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\rxrflrx.exe upx behavioral2/memory/1836-151-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1112-155-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\tnbthh.exe upx behavioral2/memory/4384-163-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pdpjd.exe upx \??\c:\lllllll.exe upx C:\9lrrrxx.exe upx C:\hbtbtt.exe upx C:\vdjjd.exe upx behavioral2/memory/4412-184-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fllllll.exe upx behavioral2/memory/4944-190-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4720-196-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe1pddp.exelrlllll.exebtbtnh.exehhnhht.exedpddv.exeppvvd.exenthttb.exenttnnb.exe3dpvp.exeflffffx.exehtbtbb.exefrrfxrl.exetbhhbn.exepjjdv.exeflxxrxr.exebbbbtb.exedddvv.exebnbbtb.exe1pvvj.exerrlllll.exenbhtnn.exedescription pid process target process PID 3440 wrote to memory of 3320 3440 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe 1pddp.exe PID 3440 wrote to memory of 3320 3440 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe 1pddp.exe PID 3440 wrote to memory of 3320 3440 1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe 1pddp.exe PID 3320 wrote to memory of 1660 3320 1pddp.exe lrlllll.exe PID 3320 wrote to memory of 1660 3320 1pddp.exe lrlllll.exe PID 3320 wrote to memory of 1660 3320 1pddp.exe lrlllll.exe PID 1660 wrote to memory of 3012 1660 lrlllll.exe btbtnh.exe PID 1660 wrote to memory of 3012 1660 lrlllll.exe btbtnh.exe PID 1660 wrote to memory of 3012 1660 lrlllll.exe btbtnh.exe PID 3012 wrote to memory of 4536 3012 btbtnh.exe hhnhht.exe PID 3012 wrote to memory of 4536 3012 btbtnh.exe hhnhht.exe PID 3012 wrote to memory of 4536 3012 btbtnh.exe hhnhht.exe PID 4536 wrote to memory of 4640 4536 hhnhht.exe dpddv.exe PID 4536 wrote to memory of 4640 4536 hhnhht.exe dpddv.exe PID 4536 wrote to memory of 4640 4536 hhnhht.exe dpddv.exe PID 4640 wrote to memory of 4908 4640 dpddv.exe ppvvd.exe PID 4640 wrote to memory of 4908 4640 dpddv.exe ppvvd.exe PID 4640 wrote to memory of 4908 4640 dpddv.exe ppvvd.exe PID 4908 wrote to memory of 1452 4908 ppvvd.exe nthttb.exe PID 4908 wrote to memory of 1452 4908 ppvvd.exe nthttb.exe PID 4908 wrote to memory of 1452 4908 ppvvd.exe nthttb.exe PID 1452 wrote to memory of 336 1452 nthttb.exe nttnnb.exe PID 1452 wrote to memory of 336 1452 nthttb.exe nttnnb.exe PID 1452 wrote to memory of 336 1452 nthttb.exe nttnnb.exe PID 336 wrote to memory of 4156 336 nttnnb.exe 3dpvp.exe PID 336 wrote to memory of 4156 336 nttnnb.exe 3dpvp.exe PID 336 wrote to memory of 4156 336 nttnnb.exe 3dpvp.exe PID 4156 wrote to memory of 648 4156 3dpvp.exe flffffx.exe PID 4156 wrote to memory of 648 4156 3dpvp.exe flffffx.exe PID 4156 wrote to memory of 648 4156 3dpvp.exe flffffx.exe PID 648 wrote to memory of 536 648 flffffx.exe htbtbb.exe PID 648 wrote to memory of 536 648 flffffx.exe htbtbb.exe PID 648 wrote to memory of 536 648 flffffx.exe htbtbb.exe PID 536 wrote to memory of 2568 536 htbtbb.exe frrfxrl.exe PID 536 wrote to memory of 2568 536 htbtbb.exe frrfxrl.exe PID 536 wrote to memory of 2568 536 htbtbb.exe frrfxrl.exe PID 2568 wrote to memory of 3636 2568 frrfxrl.exe tbhhbn.exe PID 2568 wrote to memory of 3636 2568 frrfxrl.exe tbhhbn.exe PID 2568 wrote to memory of 3636 2568 frrfxrl.exe tbhhbn.exe PID 3636 wrote to memory of 1132 3636 tbhhbn.exe pjjdv.exe PID 3636 wrote to memory of 1132 3636 tbhhbn.exe pjjdv.exe PID 3636 wrote to memory of 1132 3636 tbhhbn.exe pjjdv.exe PID 1132 wrote to memory of 2464 1132 pjjdv.exe flxxrxr.exe PID 1132 wrote to memory of 2464 1132 pjjdv.exe flxxrxr.exe PID 1132 wrote to memory of 2464 1132 pjjdv.exe flxxrxr.exe PID 2464 wrote to memory of 3100 2464 flxxrxr.exe bbbbtb.exe PID 2464 wrote to memory of 3100 2464 flxxrxr.exe bbbbtb.exe PID 2464 wrote to memory of 3100 2464 flxxrxr.exe bbbbtb.exe PID 3100 wrote to memory of 3736 3100 bbbbtb.exe dddvv.exe PID 3100 wrote to memory of 3736 3100 bbbbtb.exe dddvv.exe PID 3100 wrote to memory of 3736 3100 bbbbtb.exe dddvv.exe PID 3736 wrote to memory of 2172 3736 dddvv.exe bnbbtb.exe PID 3736 wrote to memory of 2172 3736 dddvv.exe bnbbtb.exe PID 3736 wrote to memory of 2172 3736 dddvv.exe bnbbtb.exe PID 2172 wrote to memory of 2876 2172 bnbbtb.exe 1pvvj.exe PID 2172 wrote to memory of 2876 2172 bnbbtb.exe 1pvvj.exe PID 2172 wrote to memory of 2876 2172 bnbbtb.exe 1pvvj.exe PID 2876 wrote to memory of 3928 2876 1pvvj.exe rrlllll.exe PID 2876 wrote to memory of 3928 2876 1pvvj.exe rrlllll.exe PID 2876 wrote to memory of 3928 2876 1pvvj.exe rrlllll.exe PID 3928 wrote to memory of 4704 3928 rrlllll.exe nbhtnn.exe PID 3928 wrote to memory of 4704 3928 rrlllll.exe nbhtnn.exe PID 3928 wrote to memory of 4704 3928 rrlllll.exe nbhtnn.exe PID 4704 wrote to memory of 1460 4704 nbhtnn.exe jvjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1a5b21e0e0271c3a1f63c5234395fcf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\1pddp.exec:\1pddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\lrlllll.exec:\lrlllll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\btbtnh.exec:\btbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hhnhht.exec:\hhnhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\dpddv.exec:\dpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\ppvvd.exec:\ppvvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\nthttb.exec:\nthttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\nttnnb.exec:\nttnnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\3dpvp.exec:\3dpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\flffffx.exec:\flffffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\htbtbb.exec:\htbtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\frrfxrl.exec:\frrfxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\tbhhbn.exec:\tbhhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\flxxrxr.exec:\flxxrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\bbbbtb.exec:\bbbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\dddvv.exec:\dddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\bnbbtb.exec:\bnbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\1pvvj.exec:\1pvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rrlllll.exec:\rrlllll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\nbhtnn.exec:\nbhtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\jvjdv.exec:\jvjdv.exe23⤵
- Executes dropped EXE
PID:1460 -
\??\c:\rfrlllr.exec:\rfrlllr.exe24⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9nhbhn.exec:\9nhbhn.exe25⤵
- Executes dropped EXE
PID:1196 -
\??\c:\rxrflrx.exec:\rxrflrx.exe26⤵
- Executes dropped EXE
PID:1836 -
\??\c:\lllllll.exec:\lllllll.exe27⤵
- Executes dropped EXE
PID:1112 -
\??\c:\tnbthh.exec:\tnbthh.exe28⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pdpjd.exec:\pdpjd.exe29⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9lrrrxx.exec:\9lrrrxx.exe30⤵
- Executes dropped EXE
PID:4884 -
\??\c:\hbtbtt.exec:\hbtbtt.exe31⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vdjjd.exec:\vdjjd.exe32⤵
- Executes dropped EXE
PID:4412 -
\??\c:\fllllll.exec:\fllllll.exe33⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nhhbbb.exec:\nhhbbb.exe34⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pvdvv.exec:\pvdvv.exe35⤵
- Executes dropped EXE
PID:400 -
\??\c:\jvjpp.exec:\jvjpp.exe36⤵
- Executes dropped EXE
PID:980 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe37⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbtbth.exec:\hbtbth.exe38⤵
- Executes dropped EXE
PID:1408 -
\??\c:\dvvjd.exec:\dvvjd.exe39⤵
- Executes dropped EXE
PID:5072 -
\??\c:\7jpjj.exec:\7jpjj.exe40⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xffxrrl.exec:\xffxrrl.exe41⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nbhhhh.exec:\nbhhhh.exe42⤵
- Executes dropped EXE
PID:4760 -
\??\c:\thnhhh.exec:\thnhhh.exe43⤵
- Executes dropped EXE
PID:4364 -
\??\c:\dpjvp.exec:\dpjvp.exe44⤵
- Executes dropped EXE
PID:1152 -
\??\c:\fffrrfx.exec:\fffrrfx.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xlfxxxx.exec:\xlfxxxx.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7nbtnn.exec:\7nbtnn.exe47⤵
- Executes dropped EXE
PID:1452 -
\??\c:\ppjpv.exec:\ppjpv.exe48⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9pvvj.exec:\9pvvj.exe49⤵
- Executes dropped EXE
PID:4156 -
\??\c:\fxxrxxx.exec:\fxxrxxx.exe50⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tnhbbb.exec:\tnhbbb.exe51⤵
- Executes dropped EXE
PID:4104 -
\??\c:\5jdvp.exec:\5jdvp.exe52⤵
- Executes dropped EXE
PID:5100 -
\??\c:\3fllrrf.exec:\3fllrrf.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hbttbh.exec:\hbttbh.exe54⤵
- Executes dropped EXE
PID:1252 -
\??\c:\1pvdd.exec:\1pvdd.exe55⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pdjjv.exec:\pdjjv.exe56⤵
- Executes dropped EXE
PID:3032 -
\??\c:\lflrfll.exec:\lflrfll.exe57⤵
- Executes dropped EXE
PID:1472 -
\??\c:\xflrxxx.exec:\xflrxxx.exe58⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btnhbh.exec:\btnhbh.exe59⤵
- Executes dropped EXE
PID:4900 -
\??\c:\vdddd.exec:\vdddd.exe60⤵
- Executes dropped EXE
PID:4556 -
\??\c:\9ddvv.exec:\9ddvv.exe61⤵
- Executes dropped EXE
PID:4068 -
\??\c:\lxlfxff.exec:\lxlfxff.exe62⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbbbtt.exec:\nbbbtt.exe63⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjpjd.exec:\pjpjd.exe64⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vvvjj.exec:\vvvjj.exe65⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxlrlxx.exec:\fxlrlxx.exe66⤵PID:4472
-
\??\c:\tntnhn.exec:\tntnhn.exe67⤵PID:220
-
\??\c:\vvvvp.exec:\vvvvp.exe68⤵PID:1972
-
\??\c:\rlrxfrf.exec:\rlrxfrf.exe69⤵PID:5076
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe70⤵PID:4824
-
\??\c:\1tbbbb.exec:\1tbbbb.exe71⤵PID:1836
-
\??\c:\jjjjj.exec:\jjjjj.exe72⤵PID:1332
-
\??\c:\dvppd.exec:\dvppd.exe73⤵PID:1644
-
\??\c:\flllrrx.exec:\flllrrx.exe74⤵PID:2652
-
\??\c:\ntbthh.exec:\ntbthh.exe75⤵PID:4032
-
\??\c:\pddjv.exec:\pddjv.exe76⤵PID:396
-
\??\c:\frrrlll.exec:\frrrlll.exe77⤵PID:2636
-
\??\c:\7flfffx.exec:\7flfffx.exe78⤵PID:1256
-
\??\c:\9bhnth.exec:\9bhnth.exe79⤵PID:1640
-
\??\c:\dpvpv.exec:\dpvpv.exe80⤵PID:2440
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe81⤵PID:3652
-
\??\c:\lrlxxrr.exec:\lrlxxrr.exe82⤵PID:4956
-
\??\c:\htbbtb.exec:\htbbtb.exe83⤵PID:1340
-
\??\c:\dpppj.exec:\dpppj.exe84⤵PID:1956
-
\??\c:\ddppv.exec:\ddppv.exe85⤵PID:452
-
\??\c:\lxffxfx.exec:\lxffxfx.exe86⤵PID:1028
-
\??\c:\5ntnhn.exec:\5ntnhn.exe87⤵PID:2160
-
\??\c:\ttthbh.exec:\ttthbh.exe88⤵PID:1660
-
\??\c:\dpjjp.exec:\dpjjp.exe89⤵PID:4536
-
\??\c:\fxffrff.exec:\fxffrff.exe90⤵PID:1172
-
\??\c:\nttnhh.exec:\nttnhh.exe91⤵PID:4764
-
\??\c:\7hntht.exec:\7hntht.exe92⤵PID:1152
-
\??\c:\pvvdd.exec:\pvvdd.exe93⤵PID:2208
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe94⤵PID:996
-
\??\c:\bnbttn.exec:\bnbttn.exe95⤵PID:1668
-
\??\c:\tnnnhn.exec:\tnnnhn.exe96⤵PID:4024
-
\??\c:\5jjjd.exec:\5jjjd.exe97⤵PID:2456
-
\??\c:\rxffflr.exec:\rxffflr.exe98⤵PID:1648
-
\??\c:\1tnhhh.exec:\1tnhhh.exe99⤵PID:3636
-
\??\c:\hhtnnb.exec:\hhtnnb.exe100⤵PID:1252
-
\??\c:\3vvvd.exec:\3vvvd.exe101⤵PID:2276
-
\??\c:\1rxxxxx.exec:\1rxxxxx.exe102⤵PID:1948
-
\??\c:\nbbbtb.exec:\nbbbtb.exe103⤵PID:1472
-
\??\c:\tntnhh.exec:\tntnhh.exe104⤵PID:2172
-
\??\c:\jdjdj.exec:\jdjdj.exe105⤵PID:392
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe106⤵PID:4168
-
\??\c:\vpvpd.exec:\vpvpd.exe107⤵PID:4500
-
\??\c:\1xxxxff.exec:\1xxxxff.exe108⤵PID:1524
-
\??\c:\9bbtnn.exec:\9bbtnn.exe109⤵PID:1600
-
\??\c:\3bbbtb.exec:\3bbbtb.exe110⤵PID:4084
-
\??\c:\5pvvv.exec:\5pvvv.exe111⤵PID:2292
-
\??\c:\frrrrrl.exec:\frrrrrl.exe112⤵PID:5012
-
\??\c:\flxxxxx.exec:\flxxxxx.exe113⤵PID:4988
-
\??\c:\ntnhnh.exec:\ntnhnh.exe114⤵PID:2556
-
\??\c:\vjvpp.exec:\vjvpp.exe115⤵PID:4972
-
\??\c:\jdvvp.exec:\jdvvp.exe116⤵PID:4960
-
\??\c:\7xlfxxr.exec:\7xlfxxr.exe117⤵PID:4108
-
\??\c:\thnhtt.exec:\thnhtt.exe118⤵PID:3700
-
\??\c:\vjppp.exec:\vjppp.exe119⤵PID:4384
-
\??\c:\pjpjv.exec:\pjpjv.exe120⤵PID:2508
-
\??\c:\9rrlfxr.exec:\9rrlfxr.exe121⤵PID:4260
-
\??\c:\rffxxxr.exec:\rffxxxr.exe122⤵PID:1240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-