Analysis
-
max time kernel
139s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 00:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe
-
Size
520KB
-
MD5
1d8241f54bc9fe616a9d278a6110ae10
-
SHA1
3421919049276645bef654f50dce75b3dc34e8d3
-
SHA256
03d1811f1ab5eb5a2827997f50c2600acf0ba1d94f1f7e9a459b61aee413786f
-
SHA512
d0e2bd521690c0926bcbc9776113f8347bcb68c2b9ee2e44c85258c56e25a2f3c701008e008ab52d5693bec38ca1571addfcb1211e15b207377f8592fadc45bc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3w:q7Tc2NYHUrAwfMHNnpls489A
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/364-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/880-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3412-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/864-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1972-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3476-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3520-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4432-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3368-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5004-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4012-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3576-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/380-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4076-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1936-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1520-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4572-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3088-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1544-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/808-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5108-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2316-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2336-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1868-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3812-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1884-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/912-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/60-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4168-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1892-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1600-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1316-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/852-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3316-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2720-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4260-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1184-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2420-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4292-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4672-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/724-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1200-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2868-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4024-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2736-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4712-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 880 nhhbtn.exe 1552 jjjjj.exe 1416 ffxxlfx.exe 3412 djpdp.exe 864 jvjdv.exe 1972 dpdjp.exe 4796 thhbtn.exe 912 llllffx.exe 3476 5djdv.exe 3196 fllrlfx.exe 3520 dddvj.exe 3624 bhhbtt.exe 4432 djdvv.exe 3368 nhnhhb.exe 4692 5llfxxx.exe 4220 btnnnb.exe 5004 vvvvv.exe 4012 fxxrllf.exe 4940 bhnnnh.exe 944 djvvv.exe 3864 bbnhhh.exe 3576 jjvvv.exe 1936 dpdvp.exe 2880 lxfxrff.exe 5080 jdjjj.exe 380 llxfrrf.exe 4076 ppvpv.exe 1520 hbbbth.exe 4572 xrrrlll.exe 3088 bbtnbb.exe 1544 1vjjd.exe 3776 rfllxfx.exe 808 jvdjv.exe 1068 ffrlxxf.exe 1452 nhbntb.exe 228 5vjdd.exe 5108 3rxrlll.exe 3464 ffxxrrl.exe 1184 hbbnhh.exe 3588 vpvpv.exe 4372 fxfxrrl.exe 4560 tbbnbh.exe 2316 pjdvv.exe 2336 3lrlfxl.exe 2736 9nbttt.exe 1868 pvjdd.exe 3812 jpdpj.exe 1760 rllflll.exe 1884 1vdvp.exe 2464 fflffff.exe 992 hntnnn.exe 912 5ttnnn.exe 2744 vjddd.exe 4980 ffxxrrr.exe 60 5bttth.exe 4168 vvjjj.exe 1892 frxrllf.exe 1600 nhbbtn.exe 3120 dpvvd.exe 4432 xllfxlf.exe 4464 5bhbtb.exe 668 bhbnhh.exe 1316 jvddd.exe 852 rflflfx.exe -
resource yara_rule behavioral2/memory/364-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/880-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3412-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/864-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1972-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3476-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3520-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4432-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3368-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5004-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4012-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3576-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/380-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4076-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1936-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1520-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4572-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3088-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1544-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/808-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5108-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2316-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2336-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1868-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3812-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1884-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/912-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2744-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/60-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4168-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1892-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1600-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1316-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/852-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3316-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3928-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3776-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2720-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4260-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1184-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2420-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4292-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-443-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 364 wrote to memory of 880 364 1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe 82 PID 364 wrote to memory of 880 364 1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe 82 PID 364 wrote to memory of 880 364 1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe 82 PID 880 wrote to memory of 1552 880 nhhbtn.exe 83 PID 880 wrote to memory of 1552 880 nhhbtn.exe 83 PID 880 wrote to memory of 1552 880 nhhbtn.exe 83 PID 1552 wrote to memory of 1416 1552 jjjjj.exe 84 PID 1552 wrote to memory of 1416 1552 jjjjj.exe 84 PID 1552 wrote to memory of 1416 1552 jjjjj.exe 84 PID 1416 wrote to memory of 3412 1416 ffxxlfx.exe 85 PID 1416 wrote to memory of 3412 1416 ffxxlfx.exe 85 PID 1416 wrote to memory of 3412 1416 ffxxlfx.exe 85 PID 3412 wrote to memory of 864 3412 djpdp.exe 86 PID 3412 wrote to memory of 864 3412 djpdp.exe 86 PID 3412 wrote to memory of 864 3412 djpdp.exe 86 PID 864 wrote to memory of 1972 864 jvjdv.exe 87 PID 864 wrote to memory of 1972 864 jvjdv.exe 87 PID 864 wrote to memory of 1972 864 jvjdv.exe 87 PID 1972 wrote to memory of 4796 1972 dpdjp.exe 88 PID 1972 wrote to memory of 4796 1972 dpdjp.exe 88 PID 1972 wrote to memory of 4796 1972 dpdjp.exe 88 PID 4796 wrote to memory of 912 4796 thhbtn.exe 89 PID 4796 wrote to memory of 912 4796 thhbtn.exe 89 PID 4796 wrote to memory of 912 4796 thhbtn.exe 89 PID 912 wrote to memory of 3476 912 llllffx.exe 90 PID 912 wrote to memory of 3476 912 llllffx.exe 90 PID 912 wrote to memory of 3476 912 llllffx.exe 90 PID 3476 wrote to memory of 3196 3476 5djdv.exe 92 PID 3476 wrote to memory of 3196 3476 5djdv.exe 92 PID 3476 wrote to memory of 3196 3476 5djdv.exe 92 PID 3196 wrote to memory of 3520 3196 fllrlfx.exe 94 PID 3196 wrote to memory of 3520 3196 fllrlfx.exe 94 PID 3196 wrote to memory of 3520 3196 fllrlfx.exe 94 PID 3520 wrote to memory of 3624 3520 dddvj.exe 95 PID 3520 wrote to memory of 3624 3520 dddvj.exe 95 PID 3520 wrote to memory of 3624 3520 dddvj.exe 95 PID 3624 wrote to memory of 4432 3624 bhhbtt.exe 97 PID 3624 wrote to memory of 4432 3624 bhhbtt.exe 97 PID 3624 wrote to memory of 4432 3624 bhhbtt.exe 97 PID 4432 wrote to memory of 3368 4432 djdvv.exe 98 PID 4432 wrote to memory of 3368 4432 djdvv.exe 98 PID 4432 wrote to memory of 3368 4432 djdvv.exe 98 PID 3368 wrote to memory of 4692 3368 nhnhhb.exe 99 PID 3368 wrote to memory of 4692 3368 nhnhhb.exe 99 PID 3368 wrote to memory of 4692 3368 nhnhhb.exe 99 PID 4692 wrote to memory of 4220 4692 5llfxxx.exe 100 PID 4692 wrote to memory of 4220 4692 5llfxxx.exe 100 PID 4692 wrote to memory of 4220 4692 5llfxxx.exe 100 PID 4220 wrote to memory of 5004 4220 btnnnb.exe 101 PID 4220 wrote to memory of 5004 4220 btnnnb.exe 101 PID 4220 wrote to memory of 5004 4220 btnnnb.exe 101 PID 5004 wrote to memory of 4012 5004 vvvvv.exe 102 PID 5004 wrote to memory of 4012 5004 vvvvv.exe 102 PID 5004 wrote to memory of 4012 5004 vvvvv.exe 102 PID 4012 wrote to memory of 4940 4012 fxxrllf.exe 103 PID 4012 wrote to memory of 4940 4012 fxxrllf.exe 103 PID 4012 wrote to memory of 4940 4012 fxxrllf.exe 103 PID 4940 wrote to memory of 944 4940 bhnnnh.exe 104 PID 4940 wrote to memory of 944 4940 bhnnnh.exe 104 PID 4940 wrote to memory of 944 4940 bhnnnh.exe 104 PID 944 wrote to memory of 3864 944 djvvv.exe 105 PID 944 wrote to memory of 3864 944 djvvv.exe 105 PID 944 wrote to memory of 3864 944 djvvv.exe 105 PID 3864 wrote to memory of 3576 3864 bbnhhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d8241f54bc9fe616a9d278a6110ae10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\nhhbtn.exec:\nhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\jjjjj.exec:\jjjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\ffxxlfx.exec:\ffxxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\djpdp.exec:\djpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\jvjdv.exec:\jvjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\dpdjp.exec:\dpdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\thhbtn.exec:\thhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\llllffx.exec:\llllffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\5djdv.exec:\5djdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\fllrlfx.exec:\fllrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\dddvj.exec:\dddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\bhhbtt.exec:\bhhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\djdvv.exec:\djdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\nhnhhb.exec:\nhnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\5llfxxx.exec:\5llfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\btnnnb.exec:\btnnnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\vvvvv.exec:\vvvvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\fxxrllf.exec:\fxxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\bhnnnh.exec:\bhnnnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\djvvv.exec:\djvvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\bbnhhh.exec:\bbnhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\jjvvv.exec:\jjvvv.exe23⤵
- Executes dropped EXE
PID:3576 -
\??\c:\dpdvp.exec:\dpdvp.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxfxrff.exec:\lxfxrff.exe25⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jdjjj.exec:\jdjjj.exe26⤵
- Executes dropped EXE
PID:5080 -
\??\c:\llxfrrf.exec:\llxfrrf.exe27⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppvpv.exec:\ppvpv.exe28⤵
- Executes dropped EXE
PID:4076 -
\??\c:\hbbbth.exec:\hbbbth.exe29⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrrrlll.exec:\xrrrlll.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\bbtnbb.exec:\bbtnbb.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\1vjjd.exec:\1vjjd.exe32⤵
- Executes dropped EXE
PID:1544 -
\??\c:\rfllxfx.exec:\rfllxfx.exe33⤵
- Executes dropped EXE
PID:3776 -
\??\c:\jvdjv.exec:\jvdjv.exe34⤵
- Executes dropped EXE
PID:808 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe35⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nhbntb.exec:\nhbntb.exe36⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5vjdd.exec:\5vjdd.exe37⤵
- Executes dropped EXE
PID:228 -
\??\c:\3rxrlll.exec:\3rxrlll.exe38⤵
- Executes dropped EXE
PID:5108 -
\??\c:\ffxxrrl.exec:\ffxxrrl.exe39⤵
- Executes dropped EXE
PID:3464 -
\??\c:\hbbnhh.exec:\hbbnhh.exe40⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vpvpv.exec:\vpvpv.exe41⤵
- Executes dropped EXE
PID:3588 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe42⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tbbnbh.exec:\tbbnbh.exe43⤵
- Executes dropped EXE
PID:4560 -
\??\c:\pjdvv.exec:\pjdvv.exe44⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3lrlfxl.exec:\3lrlfxl.exe45⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9nbttt.exec:\9nbttt.exe46⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pvjdd.exec:\pvjdd.exe47⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jpdpj.exec:\jpdpj.exe48⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rllflll.exec:\rllflll.exe49⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1vdvp.exec:\1vdvp.exe50⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fflffff.exec:\fflffff.exe51⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hntnnn.exec:\hntnnn.exe52⤵
- Executes dropped EXE
PID:992 -
\??\c:\5ttnnn.exec:\5ttnnn.exe53⤵
- Executes dropped EXE
PID:912 -
\??\c:\vjddd.exec:\vjddd.exe54⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5bttth.exec:\5bttth.exe56⤵
- Executes dropped EXE
PID:60 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:4168 -
\??\c:\frxrllf.exec:\frxrllf.exe58⤵
- Executes dropped EXE
PID:1892 -
\??\c:\nhbbtn.exec:\nhbbtn.exe59⤵
- Executes dropped EXE
PID:1600 -
\??\c:\dpvvd.exec:\dpvvd.exe60⤵
- Executes dropped EXE
PID:3120 -
\??\c:\xllfxlf.exec:\xllfxlf.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\5bhbtb.exec:\5bhbtb.exe62⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bhbnhh.exec:\bhbnhh.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\jvddd.exec:\jvddd.exe64⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rflflfx.exec:\rflflfx.exe65⤵
- Executes dropped EXE
PID:852 -
\??\c:\rrrlffx.exec:\rrrlffx.exe66⤵PID:3316
-
\??\c:\tthnth.exec:\tthnth.exe67⤵PID:392
-
\??\c:\xrlrflx.exec:\xrlrflx.exe68⤵PID:4888
-
\??\c:\tthbnh.exec:\tthbnh.exe69⤵PID:3984
-
\??\c:\tttnhh.exec:\tttnhh.exe70⤵PID:4848
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe71⤵PID:3868
-
\??\c:\tnbbnn.exec:\tnbbnn.exe72⤵PID:3192
-
\??\c:\jvjvv.exec:\jvjvv.exe73⤵PID:4820
-
\??\c:\9xfrlfx.exec:\9xfrlfx.exe74⤵PID:2612
-
\??\c:\tnnhbt.exec:\tnnhbt.exe75⤵PID:1744
-
\??\c:\vjjdv.exec:\vjjdv.exe76⤵PID:3928
-
\??\c:\xfxlfff.exec:\xfxlfff.exe77⤵PID:1992
-
\??\c:\1bhbbb.exec:\1bhbbb.exe78⤵PID:4340
-
\??\c:\dddvv.exec:\dddvv.exe79⤵PID:1508
-
\??\c:\pjpvv.exec:\pjpvv.exe80⤵PID:2324
-
\??\c:\rllffxx.exec:\rllffxx.exe81⤵PID:3508
-
\??\c:\nntnnh.exec:\nntnnh.exe82⤵PID:3088
-
\??\c:\5thbhn.exec:\5thbhn.exe83⤵PID:3432
-
\??\c:\dpdvv.exec:\dpdvv.exe84⤵PID:4024
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe85⤵PID:3776
-
\??\c:\bhnthn.exec:\bhnthn.exe86⤵PID:2720
-
\??\c:\hbnhhh.exec:\hbnhhh.exe87⤵PID:1068
-
\??\c:\jjjdj.exec:\jjjdj.exe88⤵PID:3028
-
\??\c:\1frlfxr.exec:\1frlfxr.exe89⤵PID:4924
-
\??\c:\bbtnhh.exec:\bbtnhh.exe90⤵PID:384
-
\??\c:\vjdvj.exec:\vjdvj.exe91⤵PID:4260
-
\??\c:\lrxffrx.exec:\lrxffrx.exe92⤵PID:1184
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe93⤵PID:1356
-
\??\c:\htbnht.exec:\htbnht.exe94⤵PID:2420
-
\??\c:\pdjjd.exec:\pdjjd.exe95⤵PID:1152
-
\??\c:\xrffllr.exec:\xrffllr.exe96⤵PID:3164
-
\??\c:\tbtnhh.exec:\tbtnhh.exe97⤵PID:2552
-
\??\c:\jvddv.exec:\jvddv.exe98⤵PID:3412
-
\??\c:\3lfxlfx.exec:\3lfxlfx.exe99⤵PID:2472
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe100⤵PID:4292
-
\??\c:\hbbtnn.exec:\hbbtnn.exe101⤵PID:3812
-
\??\c:\djjdv.exec:\djjdv.exe102⤵PID:5104
-
\??\c:\frxrlfl.exec:\frxrlfl.exe103⤵PID:2936
-
\??\c:\nhbtnn.exec:\nhbtnn.exe104⤵PID:3476
-
\??\c:\jdvjp.exec:\jdvjp.exe105⤵PID:428
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe106⤵PID:4596
-
\??\c:\ttnbnn.exec:\ttnbnn.exe107⤵PID:432
-
\??\c:\nbnbtn.exec:\nbnbtn.exe108⤵PID:1300
-
\??\c:\3vvpj.exec:\3vvpj.exe109⤵PID:3368
-
\??\c:\3flxfxf.exec:\3flxfxf.exe110⤵PID:4672
-
\??\c:\tnnhbt.exec:\tnnhbt.exe111⤵PID:724
-
\??\c:\bthbnh.exec:\bthbnh.exe112⤵PID:1200
-
\??\c:\5vjdp.exec:\5vjdp.exe113⤵PID:852
-
\??\c:\lflxxrx.exec:\lflxxrx.exe114⤵PID:1988
-
\??\c:\hhtthn.exec:\hhtthn.exe115⤵PID:3252
-
\??\c:\9jvpp.exec:\9jvpp.exe116⤵PID:2668
-
\??\c:\xfffxfx.exec:\xfffxfx.exe117⤵PID:948
-
\??\c:\btbttn.exec:\btbttn.exe118⤵PID:4960
-
\??\c:\ddpjp.exec:\ddpjp.exe119⤵PID:4136
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe120⤵PID:3784
-
\??\c:\hbtnth.exec:\hbtnth.exe121⤵PID:4812
-
\??\c:\jdjjj.exec:\jdjjj.exe122⤵PID:4368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-