Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 22:22
Behavioral task
behavioral1
Sample
0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe
-
Size
173KB
-
MD5
0f4515cf3ade269e6ad0d81a0ee990f0
-
SHA1
5d8135c2abe989f50ee4cf2f706842a52f5886f3
-
SHA256
aae802b6232494f8ace0bb982dfc16844fd4cf1c414f9e4a28751e8b87dc4b54
-
SHA512
95a125c9eb3f7c279afc7b648282073103e7062461a9869611a57837aa401af7fc1b8199768d6f277484eed938dcef2ae644cd5621024baa215872ce53fe4def
-
SSDEEP
3072:ehOmTsF93UYfwC6GIout1sWRkVap3daVszyKd+XqQz0esujClt+zZ4dMovmW1q7M:ecm4FmowdHoSKWqoFdAszBd+aQz0IClL
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4404-7-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3244-6-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/644-14-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1688-19-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3788-31-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5072-38-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2084-44-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1020-52-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3292-59-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/976-63-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1696-70-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/872-71-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3588-81-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/740-88-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2344-98-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3720-105-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3852-115-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5016-131-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4956-134-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3848-143-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3212-149-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1924-165-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3872-170-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/852-187-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3524-202-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/452-207-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4844-211-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4432-218-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4616-220-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/436-224-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4060-233-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1072-246-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3812-250-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1556-254-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3616-258-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3292-265-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1292-270-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1700-276-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3060-280-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1868-293-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4840-300-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4132-319-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4540-338-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3700-348-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3300-355-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3836-377-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/4444-400-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1592-411-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2084-432-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/5092-440-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3280-453-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3688-459-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1488-464-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/208-488-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2732-569-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3244-576-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3296-586-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/984-630-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3968-674-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/3396-681-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2740-790-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/1116-846-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/228-860-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon behavioral2/memory/2412-890-0x0000000000400000-0x0000000000430000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x000600000002327d-3.dat family_berbew behavioral2/files/0x0009000000023434-10.dat family_berbew behavioral2/files/0x0007000000023440-16.dat family_berbew behavioral2/files/0x0007000000023441-22.dat family_berbew behavioral2/files/0x0007000000023443-28.dat family_berbew behavioral2/files/0x0007000000023444-34.dat family_berbew behavioral2/files/0x0007000000023445-41.dat family_berbew behavioral2/files/0x0007000000023446-46.dat family_berbew behavioral2/files/0x0007000000023447-51.dat family_berbew behavioral2/files/0x0007000000023448-58.dat family_berbew behavioral2/files/0x0007000000023449-62.dat family_berbew behavioral2/files/0x000700000002344a-69.dat family_berbew behavioral2/files/0x000700000002344b-75.dat family_berbew behavioral2/files/0x000700000002344c-80.dat family_berbew behavioral2/files/0x000700000002344d-85.dat family_berbew behavioral2/files/0x000700000002344e-91.dat family_berbew behavioral2/files/0x000700000002344f-97.dat family_berbew behavioral2/files/0x0007000000023450-101.dat family_berbew behavioral2/files/0x0007000000023451-108.dat family_berbew behavioral2/files/0x0007000000023452-112.dat family_berbew behavioral2/files/0x0007000000023453-119.dat family_berbew behavioral2/files/0x0007000000023454-125.dat family_berbew behavioral2/files/0x0007000000023455-130.dat family_berbew behavioral2/files/0x000a000000023439-137.dat family_berbew behavioral2/files/0x0007000000023456-141.dat family_berbew behavioral2/files/0x0007000000023457-147.dat family_berbew behavioral2/files/0x0007000000023458-153.dat family_berbew behavioral2/files/0x0007000000023459-159.dat family_berbew behavioral2/files/0x000700000002345a-164.dat family_berbew behavioral2/files/0x000700000002345b-171.dat family_berbew behavioral2/files/0x000700000002345c-175.dat family_berbew behavioral2/files/0x000700000002345d-181.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4404 rxrlfff.exe 644 htttnb.exe 1688 bbbhhh.exe 3788 ppvvp.exe 1072 nbtttt.exe 5072 dvvpj.exe 2084 xrffxfl.exe 1020 ntnhtn.exe 3292 dpdvv.exe 976 rlrrrxx.exe 1696 tnbttt.exe 872 ppjdd.exe 3588 rrfxflf.exe 1672 bnbbbb.exe 740 rxfxxrr.exe 2344 rxffxxx.exe 1892 tnbttn.exe 3720 ddddj.exe 3852 lxrfrlx.exe 4376 llfffxx.exe 688 jdppd.exe 5016 flffxxx.exe 4956 bntnhh.exe 3848 vvddd.exe 3212 flrxxxx.exe 1472 1nnhbb.exe 3968 jdddv.exe 1924 jdvdv.exe 3872 tnhhhn.exe 4412 jddvv.exe 3336 7llffxr.exe 1160 bhhnhb.exe 852 bhnnhh.exe 2432 vppjj.exe 4040 frfxxll.exe 5080 rrrrlll.exe 3524 htntth.exe 1068 pjdvv.exe 452 pvvpj.exe 4844 lxllxrx.exe 4432 lxffxxr.exe 4616 nhbhbh.exe 436 3ppdv.exe 4156 rlxxfrx.exe 4060 rxxrrlf.exe 2564 vppdd.exe 1936 5vjdd.exe 1652 flrlflf.exe 1072 lrrrlxx.exe 3812 pjvvp.exe 1556 xxffxfx.exe 3616 lxrrrfx.exe 2024 nbntbn.exe 3292 jdvvd.exe 4848 rrflrxf.exe 1292 bntnbb.exe 1700 lfllffx.exe 3060 fxrxxxf.exe 3588 tbbhbt.exe 4704 vjdpj.exe 1672 vdvdd.exe 1868 nbnbhb.exe 3528 nbbtth.exe 4840 vjjdd.exe -
resource yara_rule behavioral2/memory/3244-0-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000600000002327d-3.dat upx behavioral2/memory/4404-7-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3244-6-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0009000000023434-10.dat upx behavioral2/files/0x0007000000023440-16.dat upx behavioral2/memory/644-14-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1688-19-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023441-22.dat upx behavioral2/memory/3788-24-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023443-28.dat upx behavioral2/memory/3788-31-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023444-34.dat upx behavioral2/memory/5072-38-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023445-41.dat upx behavioral2/memory/2084-44-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023446-46.dat upx behavioral2/files/0x0007000000023447-51.dat upx behavioral2/memory/1020-52-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023448-58.dat upx behavioral2/memory/3292-59-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023449-62.dat upx behavioral2/memory/976-63-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/1696-70-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344a-69.dat upx behavioral2/memory/872-71-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344b-75.dat upx behavioral2/memory/3588-77-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344c-80.dat upx behavioral2/memory/3588-81-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344d-85.dat upx behavioral2/memory/740-88-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344e-91.dat upx behavioral2/memory/2344-98-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002344f-97.dat upx behavioral2/files/0x0007000000023450-101.dat upx behavioral2/memory/3720-105-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023451-108.dat upx behavioral2/files/0x0007000000023452-112.dat upx behavioral2/memory/3852-115-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023453-119.dat upx behavioral2/memory/5016-126-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023454-125.dat upx behavioral2/files/0x0007000000023455-130.dat upx behavioral2/memory/5016-131-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4956-134-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000a000000023439-137.dat upx behavioral2/files/0x0007000000023456-141.dat upx behavioral2/memory/3848-143-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3212-149-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x0007000000023457-147.dat upx behavioral2/files/0x0007000000023458-153.dat upx behavioral2/files/0x0007000000023459-159.dat upx behavioral2/memory/1924-165-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002345a-164.dat upx behavioral2/files/0x000700000002345b-171.dat upx behavioral2/memory/3872-170-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/files/0x000700000002345c-175.dat upx behavioral2/files/0x000700000002345d-181.dat upx behavioral2/memory/852-187-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/3524-202-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/452-207-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4844-211-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral2/memory/4432-214-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 4404 3244 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 81 PID 3244 wrote to memory of 4404 3244 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 81 PID 3244 wrote to memory of 4404 3244 0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe 81 PID 4404 wrote to memory of 644 4404 rxrlfff.exe 82 PID 4404 wrote to memory of 644 4404 rxrlfff.exe 82 PID 4404 wrote to memory of 644 4404 rxrlfff.exe 82 PID 644 wrote to memory of 1688 644 htttnb.exe 83 PID 644 wrote to memory of 1688 644 htttnb.exe 83 PID 644 wrote to memory of 1688 644 htttnb.exe 83 PID 1688 wrote to memory of 3788 1688 bbbhhh.exe 84 PID 1688 wrote to memory of 3788 1688 bbbhhh.exe 84 PID 1688 wrote to memory of 3788 1688 bbbhhh.exe 84 PID 3788 wrote to memory of 1072 3788 ppvvp.exe 85 PID 3788 wrote to memory of 1072 3788 ppvvp.exe 85 PID 3788 wrote to memory of 1072 3788 ppvvp.exe 85 PID 1072 wrote to memory of 5072 1072 nbtttt.exe 86 PID 1072 wrote to memory of 5072 1072 nbtttt.exe 86 PID 1072 wrote to memory of 5072 1072 nbtttt.exe 86 PID 5072 wrote to memory of 2084 5072 dvvpj.exe 87 PID 5072 wrote to memory of 2084 5072 dvvpj.exe 87 PID 5072 wrote to memory of 2084 5072 dvvpj.exe 87 PID 2084 wrote to memory of 1020 2084 xrffxfl.exe 88 PID 2084 wrote to memory of 1020 2084 xrffxfl.exe 88 PID 2084 wrote to memory of 1020 2084 xrffxfl.exe 88 PID 1020 wrote to memory of 3292 1020 ntnhtn.exe 89 PID 1020 wrote to memory of 3292 1020 ntnhtn.exe 89 PID 1020 wrote to memory of 3292 1020 ntnhtn.exe 89 PID 3292 wrote to memory of 976 3292 dpdvv.exe 90 PID 3292 wrote to memory of 976 3292 dpdvv.exe 90 PID 3292 wrote to memory of 976 3292 dpdvv.exe 90 PID 976 wrote to memory of 1696 976 rlrrrxx.exe 91 PID 976 wrote to memory of 1696 976 rlrrrxx.exe 91 PID 976 wrote to memory of 1696 976 rlrrrxx.exe 91 PID 1696 wrote to memory of 872 1696 tnbttt.exe 92 PID 1696 wrote to memory of 872 1696 tnbttt.exe 92 PID 1696 wrote to memory of 872 1696 tnbttt.exe 92 PID 872 wrote to memory of 3588 872 ppjdd.exe 93 PID 872 wrote to memory of 3588 872 ppjdd.exe 93 PID 872 wrote to memory of 3588 872 ppjdd.exe 93 PID 3588 wrote to memory of 1672 3588 rrfxflf.exe 94 PID 3588 wrote to memory of 1672 3588 rrfxflf.exe 94 PID 3588 wrote to memory of 1672 3588 rrfxflf.exe 94 PID 1672 wrote to memory of 740 1672 bnbbbb.exe 96 PID 1672 wrote to memory of 740 1672 bnbbbb.exe 96 PID 1672 wrote to memory of 740 1672 bnbbbb.exe 96 PID 740 wrote to memory of 2344 740 rxfxxrr.exe 98 PID 740 wrote to memory of 2344 740 rxfxxrr.exe 98 PID 740 wrote to memory of 2344 740 rxfxxrr.exe 98 PID 2344 wrote to memory of 1892 2344 rxffxxx.exe 99 PID 2344 wrote to memory of 1892 2344 rxffxxx.exe 99 PID 2344 wrote to memory of 1892 2344 rxffxxx.exe 99 PID 1892 wrote to memory of 3720 1892 tnbttn.exe 100 PID 1892 wrote to memory of 3720 1892 tnbttn.exe 100 PID 1892 wrote to memory of 3720 1892 tnbttn.exe 100 PID 3720 wrote to memory of 3852 3720 ddddj.exe 101 PID 3720 wrote to memory of 3852 3720 ddddj.exe 101 PID 3720 wrote to memory of 3852 3720 ddddj.exe 101 PID 3852 wrote to memory of 4376 3852 lxrfrlx.exe 102 PID 3852 wrote to memory of 4376 3852 lxrfrlx.exe 102 PID 3852 wrote to memory of 4376 3852 lxrfrlx.exe 102 PID 4376 wrote to memory of 688 4376 llfffxx.exe 103 PID 4376 wrote to memory of 688 4376 llfffxx.exe 103 PID 4376 wrote to memory of 688 4376 llfffxx.exe 103 PID 688 wrote to memory of 5016 688 jdppd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f4515cf3ade269e6ad0d81a0ee990f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\rxrlfff.exec:\rxrlfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\htttnb.exec:\htttnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\bbbhhh.exec:\bbbhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\ppvvp.exec:\ppvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\nbtttt.exec:\nbtttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\dvvpj.exec:\dvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\xrffxfl.exec:\xrffxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ntnhtn.exec:\ntnhtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\dpdvv.exec:\dpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:976 -
\??\c:\tnbttt.exec:\tnbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\ppjdd.exec:\ppjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\rrfxflf.exec:\rrfxflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\bnbbbb.exec:\bnbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\rxffxxx.exec:\rxffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\tnbttn.exec:\tnbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\ddddj.exec:\ddddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\llfffxx.exec:\llfffxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\jdppd.exec:\jdppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\flffxxx.exec:\flffxxx.exe23⤵
- Executes dropped EXE
PID:5016 -
\??\c:\bntnhh.exec:\bntnhh.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\vvddd.exec:\vvddd.exe25⤵
- Executes dropped EXE
PID:3848 -
\??\c:\flrxxxx.exec:\flrxxxx.exe26⤵
- Executes dropped EXE
PID:3212 -
\??\c:\1nnhbb.exec:\1nnhbb.exe27⤵
- Executes dropped EXE
PID:1472 -
\??\c:\jdddv.exec:\jdddv.exe28⤵
- Executes dropped EXE
PID:3968 -
\??\c:\jdvdv.exec:\jdvdv.exe29⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnhhhn.exec:\tnhhhn.exe30⤵
- Executes dropped EXE
PID:3872 -
\??\c:\jddvv.exec:\jddvv.exe31⤵
- Executes dropped EXE
PID:4412 -
\??\c:\7llffxr.exec:\7llffxr.exe32⤵
- Executes dropped EXE
PID:3336 -
\??\c:\bhhnhb.exec:\bhhnhb.exe33⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bhnnhh.exec:\bhnnhh.exe34⤵
- Executes dropped EXE
PID:852 -
\??\c:\vppjj.exec:\vppjj.exe35⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frfxxll.exec:\frfxxll.exe36⤵
- Executes dropped EXE
PID:4040 -
\??\c:\rrrrlll.exec:\rrrrlll.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\htntth.exec:\htntth.exe38⤵
- Executes dropped EXE
PID:3524 -
\??\c:\pjdvv.exec:\pjdvv.exe39⤵
- Executes dropped EXE
PID:1068 -
\??\c:\pvvpj.exec:\pvvpj.exe40⤵
- Executes dropped EXE
PID:452 -
\??\c:\lxllxrx.exec:\lxllxrx.exe41⤵
- Executes dropped EXE
PID:4844 -
\??\c:\lxffxxr.exec:\lxffxxr.exe42⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nhbhbh.exec:\nhbhbh.exe43⤵
- Executes dropped EXE
PID:4616 -
\??\c:\3ppdv.exec:\3ppdv.exe44⤵
- Executes dropped EXE
PID:436 -
\??\c:\rlxxfrx.exec:\rlxxfrx.exe45⤵
- Executes dropped EXE
PID:4156 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe46⤵
- Executes dropped EXE
PID:4060 -
\??\c:\vppdd.exec:\vppdd.exe47⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5vjdd.exec:\5vjdd.exe48⤵
- Executes dropped EXE
PID:1936 -
\??\c:\flrlflf.exec:\flrlflf.exe49⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lrrrlxx.exec:\lrrrlxx.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pjvvp.exec:\pjvvp.exe51⤵
- Executes dropped EXE
PID:3812 -
\??\c:\xxffxfx.exec:\xxffxfx.exe52⤵
- Executes dropped EXE
PID:1556 -
\??\c:\lxrrrfx.exec:\lxrrrfx.exe53⤵
- Executes dropped EXE
PID:3616 -
\??\c:\nbntbn.exec:\nbntbn.exe54⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdvvd.exec:\jdvvd.exe55⤵
- Executes dropped EXE
PID:3292 -
\??\c:\rrflrxf.exec:\rrflrxf.exe56⤵
- Executes dropped EXE
PID:4848 -
\??\c:\bntnbb.exec:\bntnbb.exe57⤵
- Executes dropped EXE
PID:1292 -
\??\c:\lfllffx.exec:\lfllffx.exe58⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tbbhbt.exec:\tbbhbt.exe60⤵
- Executes dropped EXE
PID:3588 -
\??\c:\vjdpj.exec:\vjdpj.exe61⤵
- Executes dropped EXE
PID:4704 -
\??\c:\vdvdd.exec:\vdvdd.exe62⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nbnbhb.exec:\nbnbhb.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\nbbtth.exec:\nbbtth.exe64⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vjjdd.exec:\vjjdd.exe65⤵
- Executes dropped EXE
PID:4840 -
\??\c:\fxlllll.exec:\fxlllll.exe66⤵PID:3192
-
\??\c:\flrrrxx.exec:\flrrrxx.exe67⤵PID:3240
-
\??\c:\tnttnt.exec:\tnttnt.exe68⤵PID:4804
-
\??\c:\jjjjj.exec:\jjjjj.exe69⤵PID:3436
-
\??\c:\1pjdv.exec:\1pjdv.exe70⤵PID:2368
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe71⤵PID:4132
-
\??\c:\nhhhtn.exec:\nhhhtn.exe72⤵PID:2768
-
\??\c:\bbnhhh.exec:\bbnhhh.exe73⤵PID:2232
-
\??\c:\dvppj.exec:\dvppj.exe74⤵PID:2688
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe75⤵PID:4956
-
\??\c:\bhbntb.exec:\bhbntb.exe76⤵PID:4588
-
\??\c:\tbhbbb.exec:\tbhbbb.exe77⤵PID:3848
-
\??\c:\pdjdd.exec:\pdjdd.exe78⤵PID:4540
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe79⤵PID:1928
-
\??\c:\frxlllf.exec:\frxlllf.exe80⤵PID:3700
-
\??\c:\nntnnn.exec:\nntnnn.exe81⤵PID:2008
-
\??\c:\dvvvj.exec:\dvvvj.exe82⤵PID:3300
-
\??\c:\frrrrxx.exec:\frrrrxx.exe83⤵PID:4760
-
\??\c:\nnnntt.exec:\nnnntt.exe84⤵PID:1504
-
\??\c:\nbntbn.exec:\nbntbn.exe85⤵PID:3284
-
\??\c:\pjjpp.exec:\pjjpp.exe86⤵PID:1808
-
\??\c:\1llrlrr.exec:\1llrlrr.exe87⤵PID:544
-
\??\c:\xrlxrlf.exec:\xrlxrlf.exe88⤵PID:852
-
\??\c:\nnnbtn.exec:\nnnbtn.exe89⤵PID:3836
-
\??\c:\nhthtt.exec:\nhthtt.exe90⤵PID:5024
-
\??\c:\dddvd.exec:\dddvd.exe91⤵PID:5080
-
\??\c:\jjpvv.exec:\jjpvv.exe92⤵PID:3052
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe93⤵PID:4008
-
\??\c:\7bbnhh.exec:\7bbnhh.exe94⤵PID:2224
-
\??\c:\btnhhb.exec:\btnhhb.exe95⤵PID:4436
-
\??\c:\jddvd.exec:\jddvd.exe96⤵PID:4440
-
\??\c:\pjdpj.exec:\pjdpj.exe97⤵PID:4444
-
\??\c:\3llrffl.exec:\3llrffl.exe98⤵PID:1524
-
\??\c:\ttntbn.exec:\ttntbn.exe99⤵PID:436
-
\??\c:\btbtnn.exec:\btbtnn.exe100⤵PID:1592
-
\??\c:\pdvpd.exec:\pdvpd.exe101⤵PID:3740
-
\??\c:\jppdv.exec:\jppdv.exe102⤵PID:1540
-
\??\c:\rfllfxr.exec:\rfllfxr.exe103⤵PID:1532
-
\??\c:\bbbbnt.exec:\bbbbnt.exe104⤵PID:1560
-
\??\c:\bhbthb.exec:\bhbthb.exe105⤵PID:1072
-
\??\c:\5vpjp.exec:\5vpjp.exe106⤵PID:2084
-
\??\c:\5ppvp.exec:\5ppvp.exe107⤵PID:1556
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe108⤵PID:2908
-
\??\c:\nhhtnb.exec:\nhhtnb.exe109⤵PID:5092
-
\??\c:\3nbthh.exec:\3nbthh.exe110⤵PID:4480
-
\??\c:\7ddvp.exec:\7ddvp.exe111⤵PID:3756
-
\??\c:\rlllxrl.exec:\rlllxrl.exe112⤵PID:976
-
\??\c:\lfrlxlr.exec:\lfrlxlr.exe113⤵PID:3280
-
\??\c:\bbbnhb.exec:\bbbnhb.exe114⤵PID:1732
-
\??\c:\7ddvd.exec:\7ddvd.exe115⤵PID:3688
-
\??\c:\vdvpj.exec:\vdvpj.exe116⤵PID:1488
-
\??\c:\5ffxlfr.exec:\5ffxlfr.exe117⤵PID:532
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe118⤵PID:4180
-
\??\c:\nhnhhh.exec:\nhnhhh.exe119⤵PID:1892
-
\??\c:\pvpvj.exec:\pvpvj.exe120⤵PID:1776
-
\??\c:\frlfxrl.exec:\frlfxrl.exe121⤵PID:2028
-
\??\c:\9btnbb.exec:\9btnbb.exe122⤵PID:3720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-