Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 12:07
Behavioral task
behavioral1
Sample
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe
-
Size
487KB
-
MD5
430f4a2033b39973a4a2fab2717fe1e0
-
SHA1
8f7ee530ef281051177cc01ec6771bc7dc259080
-
SHA256
5b8009564cb608a6d5a9952b7cdb7666f2f3ebc73dde0f4c5824c865880b7755
-
SHA512
3f4cdf1829b5e2c8d472b2f515d3165e6194e98b18d86068f386c71429065be80dbbb2ec707e8ad09bfd0b43b2faae46eaae3494b07e96abec6a8398599d0f62
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF23ye:I7TcfNWj168w1VjsyvhNFF2ie
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2364-8-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1736-10-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1736-17-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/3000-37-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2696-46-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2588-48-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2492-64-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2592-73-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2452-83-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2924-92-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2948-101-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2764-109-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2824-119-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1632-121-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1972-143-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1548-153-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2148-162-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1940-188-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/780-197-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/576-209-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1136-225-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2420-228-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1896-261-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2016-278-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1172-283-0x0000000000260000-0x000000000028E000-memory.dmp family_blackmoon behavioral1/memory/2952-296-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1732-309-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2012-316-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2984-323-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2728-354-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2768-398-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/488-483-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/488-490-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1340-544-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/868-578-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2928-683-0x0000000000220000-0x000000000024E000-memory.dmp family_blackmoon behavioral1/memory/820-1028-0x0000000000220000-0x000000000024E000-memory.dmp family_blackmoon behavioral1/memory/1240-1149-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1596-1190-0x00000000003A0000-0x00000000003CE000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\fffllfr.exe family_berbew C:\vvpvp.exe family_berbew C:\nbttbt.exe family_berbew C:\dpppd.exe family_berbew C:\bttnnt.exe family_berbew C:\7dvjp.exe family_berbew C:\flrxlxr.exe family_berbew C:\jpjvj.exe family_berbew C:\xxrfrrr.exe family_berbew C:\vdjdj.exe family_berbew C:\rlxflrx.exe family_berbew C:\pvvvd.exe family_berbew C:\xxflrrl.exe family_berbew C:\nhtbhn.exe family_berbew C:\rxrfxff.exe family_berbew C:\hbnntt.exe family_berbew C:\hhbhbn.exe family_berbew C:\lxxrxrr.exe family_berbew C:\vppjj.exe family_berbew \??\c:\xfrfrlf.exe family_berbew \??\c:\pvpdj.exe family_berbew C:\htbnhb.exe family_berbew \??\c:\flxlfrr.exe family_berbew C:\bhnthh.exe family_berbew \??\c:\fffllrf.exe family_berbew C:\pdvdj.exe family_berbew C:\btbnbn.exe family_berbew C:\pvpvd.exe family_berbew C:\nbthtb.exe family_berbew C:\djjvp.exe family_berbew C:\htnthb.exe family_berbew C:\dvpdp.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
fffllfr.exevvpvp.exenbttbt.exedpppd.exebttnnt.exe7dvjp.exeflrxlxr.exejpjvj.exexxrfrrr.exevdjdj.exerlxflrx.exepvvvd.exexxflrrl.exenhtbhn.exerxrfxff.exehbnntt.exehhbhbn.exelxxrxrr.exevppjj.exexfrfrlf.exepvpdj.exehtbnhb.exeflxlfrr.exebhnthh.exefffllrf.exepdvdj.exebtbnbn.exepvpvd.exenbthtb.exedjjvp.exehtnthb.exedvpdp.exebnbntt.exejvvpd.exejjpjj.exentthbn.exejdvpj.exe3fffrfl.exenhnbtt.exejdjvj.exelfrxlll.exebbbbbn.exedpvpd.exelxlxflr.exe3tnhtn.exe9pdpj.exelxfllrl.exettthnb.exe1dpvv.exeddpjp.exelrlfrrl.exedpjjj.exexxxflrf.exetnbttb.exebhbhnt.exexxrlxlx.exe3tthbb.exennhthn.exeddjpd.exefxxrrlx.exebhthhn.exedvdvj.exe1xxllrl.exethbbht.exepid process 1736 fffllfr.exe 2112 vvpvp.exe 3000 nbttbt.exe 2696 dpppd.exe 2588 bttnnt.exe 2492 7dvjp.exe 2592 flrxlxr.exe 2452 jpjvj.exe 2924 xxrfrrr.exe 2948 vdjdj.exe 2764 rlxflrx.exe 2824 pvvvd.exe 1632 xxflrrl.exe 1860 nhtbhn.exe 1972 rxrfxff.exe 1548 hbnntt.exe 2148 hhbhbn.exe 1496 lxxrxrr.exe 1432 vppjj.exe 1940 xfrfrlf.exe 780 pvpdj.exe 576 htbnhb.exe 816 flxlfrr.exe 1136 bhnthh.exe 2420 fffllrf.exe 2156 pdvdj.exe 1664 btbnbn.exe 1896 pvpvd.exe 1840 nbthtb.exe 2016 djjvp.exe 1172 htnthb.exe 1288 dvpdp.exe 2952 bnbntt.exe 1732 jvvpd.exe 1716 jjpjj.exe 2012 ntthbn.exe 2984 jdvpj.exe 1628 3fffrfl.exe 2604 nhnbtt.exe 2656 jdjvj.exe 2076 lfrxlll.exe 2728 bbbbbn.exe 2480 dpvpd.exe 2372 lxlxflr.exe 2704 3tnhtn.exe 2932 9pdpj.exe 1128 lxfllrl.exe 1960 ttthnb.exe 2768 1dpvv.exe 2796 ddpjp.exe 2940 lrlfrrl.exe 2824 dpjjj.exe 1944 xxxflrf.exe 340 tnbttb.exe 2368 bhbhnt.exe 308 xxrlxlx.exe 1548 3tthbb.exe 1892 nnhthn.exe 1524 ddjpd.exe 1396 fxxrrlx.exe 2124 bhthhn.exe 488 dvdvj.exe 324 1xxllrl.exe 616 thbbht.exe -
Processes:
resource yara_rule behavioral1/memory/2364-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2364-8-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1736-10-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1736-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/3000-37-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2696-46-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2588-48-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2492-64-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2592-73-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2452-74-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2452-83-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2924-92-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2948-101-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2764-109-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2824-119-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1632-121-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1972-143-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1548-153-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2148-162-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1432-172-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1940-188-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/780-197-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/576-209-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1136-225-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2420-228-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2156-236-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1896-261-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2016-278-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2952-296-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1732-309-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2012-316-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2984-323-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2728-354-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2372-367-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2768-398-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2796-405-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2824-418-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/488-483-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/488-490-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/616-497-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1340-544-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2172-551-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/868-578-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2964-604-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1680-753-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2084-816-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1812-871-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1728-878-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1744-891-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2616-941-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1424-996-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/820-1021-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1188-1105-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1764-1142-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1240-1149-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2264-1162-0x0000000000220000-0x000000000024E000-memory.dmp upx behavioral1/memory/2604-1222-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2604-1228-0x00000000001B0000-0x00000000001DE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exefffllfr.exevvpvp.exenbttbt.exedpppd.exebttnnt.exe7dvjp.exeflrxlxr.exejpjvj.exexxrfrrr.exevdjdj.exerlxflrx.exepvvvd.exexxflrrl.exenhtbhn.exerxrfxff.exedescription pid process target process PID 2364 wrote to memory of 1736 2364 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe fffllfr.exe PID 2364 wrote to memory of 1736 2364 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe fffllfr.exe PID 2364 wrote to memory of 1736 2364 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe fffllfr.exe PID 2364 wrote to memory of 1736 2364 430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe fffllfr.exe PID 1736 wrote to memory of 2112 1736 fffllfr.exe vvpvp.exe PID 1736 wrote to memory of 2112 1736 fffllfr.exe vvpvp.exe PID 1736 wrote to memory of 2112 1736 fffllfr.exe vvpvp.exe PID 1736 wrote to memory of 2112 1736 fffllfr.exe vvpvp.exe PID 2112 wrote to memory of 3000 2112 vvpvp.exe nbttbt.exe PID 2112 wrote to memory of 3000 2112 vvpvp.exe nbttbt.exe PID 2112 wrote to memory of 3000 2112 vvpvp.exe nbttbt.exe PID 2112 wrote to memory of 3000 2112 vvpvp.exe nbttbt.exe PID 3000 wrote to memory of 2696 3000 nbttbt.exe dpppd.exe PID 3000 wrote to memory of 2696 3000 nbttbt.exe dpppd.exe PID 3000 wrote to memory of 2696 3000 nbttbt.exe dpppd.exe PID 3000 wrote to memory of 2696 3000 nbttbt.exe dpppd.exe PID 2696 wrote to memory of 2588 2696 dpppd.exe bttnnt.exe PID 2696 wrote to memory of 2588 2696 dpppd.exe bttnnt.exe PID 2696 wrote to memory of 2588 2696 dpppd.exe bttnnt.exe PID 2696 wrote to memory of 2588 2696 dpppd.exe bttnnt.exe PID 2588 wrote to memory of 2492 2588 bttnnt.exe 7dvjp.exe PID 2588 wrote to memory of 2492 2588 bttnnt.exe 7dvjp.exe PID 2588 wrote to memory of 2492 2588 bttnnt.exe 7dvjp.exe PID 2588 wrote to memory of 2492 2588 bttnnt.exe 7dvjp.exe PID 2492 wrote to memory of 2592 2492 7dvjp.exe flrxlxr.exe PID 2492 wrote to memory of 2592 2492 7dvjp.exe flrxlxr.exe PID 2492 wrote to memory of 2592 2492 7dvjp.exe flrxlxr.exe PID 2492 wrote to memory of 2592 2492 7dvjp.exe flrxlxr.exe PID 2592 wrote to memory of 2452 2592 flrxlxr.exe jpjvj.exe PID 2592 wrote to memory of 2452 2592 flrxlxr.exe jpjvj.exe PID 2592 wrote to memory of 2452 2592 flrxlxr.exe jpjvj.exe PID 2592 wrote to memory of 2452 2592 flrxlxr.exe jpjvj.exe PID 2452 wrote to memory of 2924 2452 jpjvj.exe xxrfrrr.exe PID 2452 wrote to memory of 2924 2452 jpjvj.exe xxrfrrr.exe PID 2452 wrote to memory of 2924 2452 jpjvj.exe xxrfrrr.exe PID 2452 wrote to memory of 2924 2452 jpjvj.exe xxrfrrr.exe PID 2924 wrote to memory of 2948 2924 xxrfrrr.exe vdjdj.exe PID 2924 wrote to memory of 2948 2924 xxrfrrr.exe vdjdj.exe PID 2924 wrote to memory of 2948 2924 xxrfrrr.exe vdjdj.exe PID 2924 wrote to memory of 2948 2924 xxrfrrr.exe vdjdj.exe PID 2948 wrote to memory of 2764 2948 vdjdj.exe rlxflrx.exe PID 2948 wrote to memory of 2764 2948 vdjdj.exe rlxflrx.exe PID 2948 wrote to memory of 2764 2948 vdjdj.exe rlxflrx.exe PID 2948 wrote to memory of 2764 2948 vdjdj.exe rlxflrx.exe PID 2764 wrote to memory of 2824 2764 rlxflrx.exe pvvvd.exe PID 2764 wrote to memory of 2824 2764 rlxflrx.exe pvvvd.exe PID 2764 wrote to memory of 2824 2764 rlxflrx.exe pvvvd.exe PID 2764 wrote to memory of 2824 2764 rlxflrx.exe pvvvd.exe PID 2824 wrote to memory of 1632 2824 pvvvd.exe xxflrrl.exe PID 2824 wrote to memory of 1632 2824 pvvvd.exe xxflrrl.exe PID 2824 wrote to memory of 1632 2824 pvvvd.exe xxflrrl.exe PID 2824 wrote to memory of 1632 2824 pvvvd.exe xxflrrl.exe PID 1632 wrote to memory of 1860 1632 xxflrrl.exe nhtbhn.exe PID 1632 wrote to memory of 1860 1632 xxflrrl.exe nhtbhn.exe PID 1632 wrote to memory of 1860 1632 xxflrrl.exe nhtbhn.exe PID 1632 wrote to memory of 1860 1632 xxflrrl.exe nhtbhn.exe PID 1860 wrote to memory of 1972 1860 nhtbhn.exe rxrfxff.exe PID 1860 wrote to memory of 1972 1860 nhtbhn.exe rxrfxff.exe PID 1860 wrote to memory of 1972 1860 nhtbhn.exe rxrfxff.exe PID 1860 wrote to memory of 1972 1860 nhtbhn.exe rxrfxff.exe PID 1972 wrote to memory of 1548 1972 rxrfxff.exe hbnntt.exe PID 1972 wrote to memory of 1548 1972 rxrfxff.exe hbnntt.exe PID 1972 wrote to memory of 1548 1972 rxrfxff.exe hbnntt.exe PID 1972 wrote to memory of 1548 1972 rxrfxff.exe hbnntt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\430f4a2033b39973a4a2fab2717fe1e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\fffllfr.exec:\fffllfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvpvp.exec:\vvpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nbttbt.exec:\nbttbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\dpppd.exec:\dpppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bttnnt.exec:\bttnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7dvjp.exec:\7dvjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\flrxlxr.exec:\flrxlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jpjvj.exec:\jpjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxrfrrr.exec:\xxrfrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vdjdj.exec:\vdjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlxflrx.exec:\rlxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pvvvd.exec:\pvvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\xxflrrl.exec:\xxflrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhtbhn.exec:\nhtbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rxrfxff.exec:\rxrfxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hbnntt.exec:\hbnntt.exe17⤵
- Executes dropped EXE
-
\??\c:\hhbhbn.exec:\hhbhbn.exe18⤵
- Executes dropped EXE
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe19⤵
- Executes dropped EXE
-
\??\c:\vppjj.exec:\vppjj.exe20⤵
- Executes dropped EXE
-
\??\c:\xfrfrlf.exec:\xfrfrlf.exe21⤵
- Executes dropped EXE
-
\??\c:\pvpdj.exec:\pvpdj.exe22⤵
- Executes dropped EXE
-
\??\c:\htbnhb.exec:\htbnhb.exe23⤵
- Executes dropped EXE
-
\??\c:\flxlfrr.exec:\flxlfrr.exe24⤵
- Executes dropped EXE
-
\??\c:\bhnthh.exec:\bhnthh.exe25⤵
- Executes dropped EXE
-
\??\c:\fffllrf.exec:\fffllrf.exe26⤵
- Executes dropped EXE
-
\??\c:\pdvdj.exec:\pdvdj.exe27⤵
- Executes dropped EXE
-
\??\c:\btbnbn.exec:\btbnbn.exe28⤵
- Executes dropped EXE
-
\??\c:\pvpvd.exec:\pvpvd.exe29⤵
- Executes dropped EXE
-
\??\c:\nbthtb.exec:\nbthtb.exe30⤵
- Executes dropped EXE
-
\??\c:\djjvp.exec:\djjvp.exe31⤵
- Executes dropped EXE
-
\??\c:\htnthb.exec:\htnthb.exe32⤵
- Executes dropped EXE
-
\??\c:\dvpdp.exec:\dvpdp.exe33⤵
- Executes dropped EXE
-
\??\c:\bnbntt.exec:\bnbntt.exe34⤵
- Executes dropped EXE
-
\??\c:\jvvpd.exec:\jvvpd.exe35⤵
- Executes dropped EXE
-
\??\c:\jjpjj.exec:\jjpjj.exe36⤵
- Executes dropped EXE
-
\??\c:\ntthbn.exec:\ntthbn.exe37⤵
- Executes dropped EXE
-
\??\c:\jdvpj.exec:\jdvpj.exe38⤵
- Executes dropped EXE
-
\??\c:\3fffrfl.exec:\3fffrfl.exe39⤵
- Executes dropped EXE
-
\??\c:\nhnbtt.exec:\nhnbtt.exe40⤵
- Executes dropped EXE
-
\??\c:\jdjvj.exec:\jdjvj.exe41⤵
- Executes dropped EXE
-
\??\c:\lfrxlll.exec:\lfrxlll.exe42⤵
- Executes dropped EXE
-
\??\c:\bbbbbn.exec:\bbbbbn.exe43⤵
- Executes dropped EXE
-
\??\c:\dpvpd.exec:\dpvpd.exe44⤵
- Executes dropped EXE
-
\??\c:\lxlxflr.exec:\lxlxflr.exe45⤵
- Executes dropped EXE
-
\??\c:\3tnhtn.exec:\3tnhtn.exe46⤵
- Executes dropped EXE
-
\??\c:\9pdpj.exec:\9pdpj.exe47⤵
- Executes dropped EXE
-
\??\c:\lxfllrl.exec:\lxfllrl.exe48⤵
- Executes dropped EXE
-
\??\c:\ttthnb.exec:\ttthnb.exe49⤵
- Executes dropped EXE
-
\??\c:\1dpvv.exec:\1dpvv.exe50⤵
- Executes dropped EXE
-
\??\c:\ddpjp.exec:\ddpjp.exe51⤵
- Executes dropped EXE
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe52⤵
- Executes dropped EXE
-
\??\c:\dpjjj.exec:\dpjjj.exe53⤵
- Executes dropped EXE
-
\??\c:\xxxflrf.exec:\xxxflrf.exe54⤵
- Executes dropped EXE
-
\??\c:\tnbttb.exec:\tnbttb.exe55⤵
- Executes dropped EXE
-
\??\c:\bhbhnt.exec:\bhbhnt.exe56⤵
- Executes dropped EXE
-
\??\c:\xxrlxlx.exec:\xxrlxlx.exe57⤵
- Executes dropped EXE
-
\??\c:\3tthbb.exec:\3tthbb.exe58⤵
- Executes dropped EXE
-
\??\c:\nnhthn.exec:\nnhthn.exe59⤵
- Executes dropped EXE
-
\??\c:\ddjpd.exec:\ddjpd.exe60⤵
- Executes dropped EXE
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe61⤵
- Executes dropped EXE
-
\??\c:\bhthhn.exec:\bhthhn.exe62⤵
- Executes dropped EXE
-
\??\c:\dvdvj.exec:\dvdvj.exe63⤵
- Executes dropped EXE
-
\??\c:\1xxllrl.exec:\1xxllrl.exe64⤵
- Executes dropped EXE
-
\??\c:\thbbht.exec:\thbbht.exe65⤵
- Executes dropped EXE
-
\??\c:\pvddv.exec:\pvddv.exe66⤵
-
\??\c:\fllxxxl.exec:\fllxxxl.exe67⤵
-
\??\c:\btbttn.exec:\btbttn.exe68⤵
-
\??\c:\dvpvd.exec:\dvpvd.exe69⤵
-
\??\c:\3ffrrll.exec:\3ffrrll.exe70⤵
-
\??\c:\bttnth.exec:\bttnth.exe71⤵
-
\??\c:\ppddv.exec:\ppddv.exe72⤵
-
\??\c:\hhbhhb.exec:\hhbhhb.exe73⤵
-
\??\c:\5jjvv.exec:\5jjvv.exe74⤵
-
\??\c:\rfrllfx.exec:\rfrllfx.exe75⤵
-
\??\c:\fxrrllx.exec:\fxrrllx.exe76⤵
-
\??\c:\hbttnt.exec:\hbttnt.exe77⤵
-
\??\c:\9dvpv.exec:\9dvpv.exe78⤵
-
\??\c:\fllllfl.exec:\fllllfl.exe79⤵
-
\??\c:\vddvd.exec:\vddvd.exe80⤵
-
\??\c:\5hbntb.exec:\5hbntb.exe81⤵
-
\??\c:\7pvpv.exec:\7pvpv.exe82⤵
-
\??\c:\lxlrfrr.exec:\lxlrfrr.exe83⤵
-
\??\c:\bhtbtn.exec:\bhtbtn.exe84⤵
-
\??\c:\lxxxxlx.exec:\lxxxxlx.exe85⤵
-
\??\c:\fffrlxr.exec:\fffrlxr.exe86⤵
-
\??\c:\3nbnth.exec:\3nbnth.exe87⤵
-
\??\c:\djjdp.exec:\djjdp.exe88⤵
-
\??\c:\frlflfl.exec:\frlflfl.exe89⤵
-
\??\c:\nnhbth.exec:\nnhbth.exe90⤵
-
\??\c:\vdjpd.exec:\vdjpd.exe91⤵
-
\??\c:\jvpdp.exec:\jvpdp.exe92⤵
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe93⤵
-
\??\c:\thbbbn.exec:\thbbbn.exe94⤵
-
\??\c:\vdpdj.exec:\vdpdj.exe95⤵
-
\??\c:\3xrxrlx.exec:\3xrxrlx.exe96⤵
-
\??\c:\bnnhhb.exec:\bnnhhb.exe97⤵
-
\??\c:\vvvpd.exec:\vvvpd.exe98⤵
-
\??\c:\rfxfrff.exec:\rfxfrff.exe99⤵
-
\??\c:\bbnnbt.exec:\bbnnbt.exe100⤵
-
\??\c:\5nhtnh.exec:\5nhtnh.exe101⤵
-
\??\c:\5pjjp.exec:\5pjjp.exe102⤵
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe103⤵
-
\??\c:\9ttbtb.exec:\9ttbtb.exe104⤵
-
\??\c:\dpvpd.exec:\dpvpd.exe105⤵
-
\??\c:\9rrxxlx.exec:\9rrxxlx.exe106⤵
-
\??\c:\bhnhtb.exec:\bhnhtb.exe107⤵
-
\??\c:\pddjd.exec:\pddjd.exe108⤵
-
\??\c:\dpddj.exec:\dpddj.exe109⤵
-
\??\c:\5rfllxr.exec:\5rfllxr.exe110⤵
-
\??\c:\nbhhhb.exec:\nbhhhb.exe111⤵
-
\??\c:\dvvpd.exec:\dvvpd.exe112⤵
-
\??\c:\xxxxlxx.exec:\xxxxlxx.exe113⤵
-
\??\c:\tttnbn.exec:\tttnbn.exe114⤵
-
\??\c:\3vddp.exec:\3vddp.exe115⤵
-
\??\c:\jdvjd.exec:\jdvjd.exe116⤵
-
\??\c:\lrfrrrf.exec:\lrfrrrf.exe117⤵
-
\??\c:\nttnhb.exec:\nttnhb.exe118⤵
-
\??\c:\pdvpd.exec:\pdvpd.exe119⤵
-
\??\c:\xllrllf.exec:\xllrllf.exe120⤵
-
\??\c:\hththt.exec:\hththt.exe121⤵
-
\??\c:\tnnhhn.exec:\tnnhhn.exe122⤵
-
\??\c:\jvdjj.exec:\jvdjj.exe123⤵
-
\??\c:\fllfxrl.exec:\fllfxrl.exe124⤵
-
\??\c:\hhntbb.exec:\hhntbb.exe125⤵
-
\??\c:\7jdjd.exec:\7jdjd.exe126⤵
-
\??\c:\vvvpj.exec:\vvvpj.exe127⤵
-
\??\c:\ffxfxfx.exec:\ffxfxfx.exe128⤵
-
\??\c:\tttnbh.exec:\tttnbh.exe129⤵
-
\??\c:\bntnht.exec:\bntnht.exe130⤵
-
\??\c:\pdjjd.exec:\pdjjd.exe131⤵
-
\??\c:\9xllrrr.exec:\9xllrrr.exe132⤵
-
\??\c:\thtntn.exec:\thtntn.exe133⤵
-
\??\c:\jvjvd.exec:\jvjvd.exe134⤵
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe135⤵
-
\??\c:\nttnhh.exec:\nttnhh.exe136⤵
-
\??\c:\djjpp.exec:\djjpp.exe137⤵
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe138⤵
-
\??\c:\5tnnbh.exec:\5tnnbh.exe139⤵
-
\??\c:\jvjdv.exec:\jvjdv.exe140⤵
-
\??\c:\lfrrffl.exec:\lfrrffl.exe141⤵
-
\??\c:\nbhnhn.exec:\nbhnhn.exe142⤵
-
\??\c:\vvddp.exec:\vvddp.exe143⤵
-
\??\c:\llrlrrx.exec:\llrlrrx.exe144⤵
-
\??\c:\rfllxxr.exec:\rfllxxr.exe145⤵
-
\??\c:\9thntb.exec:\9thntb.exe146⤵
-
\??\c:\ppvpj.exec:\ppvpj.exe147⤵
-
\??\c:\xrfrfxf.exec:\xrfrfxf.exe148⤵
-
\??\c:\bbthbn.exec:\bbthbn.exe149⤵
-
\??\c:\tbnhhh.exec:\tbnhhh.exe150⤵
-
\??\c:\ddvdj.exec:\ddvdj.exe151⤵
-
\??\c:\9fxfxlx.exec:\9fxfxlx.exe152⤵
-
\??\c:\htbtnn.exec:\htbtnn.exe153⤵
-
\??\c:\ppvpv.exec:\ppvpv.exe154⤵
-
\??\c:\rlllffx.exec:\rlllffx.exe155⤵
-
\??\c:\hhnttt.exec:\hhnttt.exe156⤵
-
\??\c:\1nbnth.exec:\1nbnth.exe157⤵
-
\??\c:\fffxrrx.exec:\fffxrrx.exe158⤵
-
\??\c:\7xfrfxl.exec:\7xfrfxl.exe159⤵
-
\??\c:\vvjpv.exec:\vvjpv.exe160⤵
-
\??\c:\vvpvj.exec:\vvpvj.exe161⤵
-
\??\c:\1lfrxrf.exec:\1lfrxrf.exe162⤵
-
\??\c:\hhnhbn.exec:\hhnhbn.exe163⤵
-
\??\c:\1ddjv.exec:\1ddjv.exe164⤵
-
\??\c:\lrrllxx.exec:\lrrllxx.exe165⤵
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe166⤵
-
\??\c:\hbhnhn.exec:\hbhnhn.exe167⤵
-
\??\c:\1jdpp.exec:\1jdpp.exe168⤵
-
\??\c:\frlfllr.exec:\frlfllr.exe169⤵
-
\??\c:\rlxxffx.exec:\rlxxffx.exe170⤵
-
\??\c:\nnntbt.exec:\nnntbt.exe171⤵
-
\??\c:\9vvvp.exec:\9vvvp.exe172⤵
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe173⤵
-
\??\c:\ttbhtt.exec:\ttbhtt.exe174⤵
-
\??\c:\pjvjd.exec:\pjvjd.exe175⤵
-
\??\c:\llrlrrr.exec:\llrlrrr.exe176⤵
-
\??\c:\lfflflf.exec:\lfflflf.exe177⤵
-
\??\c:\9thnth.exec:\9thnth.exe178⤵
-
\??\c:\vvjdj.exec:\vvjdj.exe179⤵
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe180⤵
-
\??\c:\ttthbh.exec:\ttthbh.exe181⤵
-
\??\c:\vppdd.exec:\vppdd.exe182⤵
-
\??\c:\xffxrlx.exec:\xffxrlx.exe183⤵
-
\??\c:\xllfffr.exec:\xllfffr.exe184⤵
-
\??\c:\btnnhn.exec:\btnnhn.exe185⤵
-
\??\c:\vjjvd.exec:\vjjvd.exe186⤵
-
\??\c:\9lrfxlf.exec:\9lrfxlf.exe187⤵
-
\??\c:\hhbthn.exec:\hhbthn.exe188⤵
-
\??\c:\dvpjp.exec:\dvpjp.exe189⤵
-
\??\c:\ppjjv.exec:\ppjjv.exe190⤵
-
\??\c:\frllfll.exec:\frllfll.exe191⤵
-
\??\c:\hhbttn.exec:\hhbttn.exe192⤵
-
\??\c:\tbnthh.exec:\tbnthh.exe193⤵
-
\??\c:\jdvpj.exec:\jdvpj.exe194⤵
-
\??\c:\rxlrlrx.exec:\rxlrlrx.exe195⤵
-
\??\c:\bnnhth.exec:\bnnhth.exe196⤵
-
\??\c:\bnthbh.exec:\bnthbh.exe197⤵
-
\??\c:\jjjdj.exec:\jjjdj.exe198⤵
-
\??\c:\rrlrlfl.exec:\rrlrlfl.exe199⤵
-
\??\c:\nbthnt.exec:\nbthnt.exe200⤵
-
\??\c:\7jjvv.exec:\7jjvv.exe201⤵
-
\??\c:\rrxrrfr.exec:\rrxrrfr.exe202⤵
-
\??\c:\bbbtbn.exec:\bbbtbn.exe203⤵
-
\??\c:\dvjpd.exec:\dvjpd.exe204⤵
-
\??\c:\jjpjj.exec:\jjpjj.exe205⤵
-
\??\c:\5lfllxf.exec:\5lfllxf.exe206⤵
-
\??\c:\bnhnbh.exec:\bnhnbh.exe207⤵
-
\??\c:\jjjjd.exec:\jjjjd.exe208⤵
-
\??\c:\llflrxf.exec:\llflrxf.exe209⤵
-
\??\c:\tbhnnh.exec:\tbhnnh.exe210⤵
-
\??\c:\vjdpj.exec:\vjdpj.exe211⤵
-
\??\c:\thtntn.exec:\thtntn.exe212⤵
-
\??\c:\ddddp.exec:\ddddp.exe213⤵
-
\??\c:\pjpdd.exec:\pjpdd.exe214⤵
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe215⤵
-
\??\c:\7tbttb.exec:\7tbttb.exe216⤵
-
\??\c:\djdpd.exec:\djdpd.exe217⤵
-
\??\c:\xrfxlrf.exec:\xrfxlrf.exe218⤵
-
\??\c:\ffrxllr.exec:\ffrxllr.exe219⤵
-
\??\c:\3thhbh.exec:\3thhbh.exe220⤵
-
\??\c:\dpvjp.exec:\dpvjp.exe221⤵
-
\??\c:\5xlffxx.exec:\5xlffxx.exe222⤵
-
\??\c:\tnhhtt.exec:\tnhhtt.exe223⤵
-
\??\c:\tbhtth.exec:\tbhtth.exe224⤵
-
\??\c:\vvdvv.exec:\vvdvv.exe225⤵
-
\??\c:\xrffrrr.exec:\xrffrrr.exe226⤵
-
\??\c:\ttthth.exec:\ttthth.exe227⤵
-
\??\c:\pdvdv.exec:\pdvdv.exe228⤵
-
\??\c:\dpdvp.exec:\dpdvp.exe229⤵
-
\??\c:\frxxffl.exec:\frxxffl.exe230⤵
-
\??\c:\9nntnh.exec:\9nntnh.exe231⤵
-
\??\c:\pvdpp.exec:\pvdpp.exe232⤵
-
\??\c:\pvpdp.exec:\pvpdp.exe233⤵
-
\??\c:\xrfffff.exec:\xrfffff.exe234⤵
-
\??\c:\hbntnb.exec:\hbntnb.exe235⤵
-
\??\c:\ddpvd.exec:\ddpvd.exe236⤵
-
\??\c:\llflrrf.exec:\llflrrf.exe237⤵
-
\??\c:\nhhntt.exec:\nhhntt.exe238⤵
-
\??\c:\tbtbbb.exec:\tbtbbb.exe239⤵
-
\??\c:\jppdp.exec:\jppdp.exe240⤵
-
\??\c:\7flxxfx.exec:\7flxxfx.exe241⤵