Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 13:03
Behavioral task
behavioral1
Sample
54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe
-
Size
497KB
-
MD5
54fd12996f12514733f5cb3b262148b0
-
SHA1
07309c4593849367e14c646a2cc3836c4969db9b
-
SHA256
e76c32aa146b517ab517bb72f368196f9613ea476e77606c1465b5c0f469414f
-
SHA512
5d3ec0338dad8bf82f304ac96cd8d006ae874a80a7e2c60d1a019407ecab5d39a8996673355d76482b94c17647ac1a60632fb5c97bd0d01b7945f334936c7317
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxS:0KFmFVtrRcFEFmFA
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2024-8-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2504-6-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3036-311-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1504-498-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2596-541-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1608-560-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2456-566-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2028-590-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4900-588-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2520-582-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3212-580-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2512-576-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2904-572-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2924-564-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1380-556-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3104-550-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4692-545-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3404-535-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3180-533-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1868-512-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1480-473-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4596-462-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4816-459-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/544-426-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3344-409-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/684-393-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2904-384-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1148-373-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4580-369-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4116-363-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1980-361-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4908-351-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2452-345-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4388-340-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3800-336-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2248-332-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2084-329-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1504-319-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1040-315-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2576-309-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3944-303-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3572-299-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4420-295-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/232-291-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2024-287-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1072-283-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/116-279-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4620-275-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1864-271-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3116-267-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4932-263-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3984-261-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2328-255-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4464-251-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1592-247-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4652-243-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2216-236-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4716-229-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/752-225-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1644-215-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2244-211-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2508-207-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5084-200-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2304-191-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2024 pdjdv.exe 232 fllrfxl.exe 4100 ppvpv.exe 2556 ffrrfxl.exe 3648 3ntnhb.exe 3140 pjpjj.exe 2576 xxfxrrl.exe 3432 bhttnn.exe 4312 vdvdp.exe 4528 vvjjp.exe 1020 fxfrrxr.exe 1504 bbnhbb.exe 2380 dpvvd.exe 2084 xrfxrxr.exe 2248 lrflfff.exe 3852 7nntnt.exe 3736 9vpjd.exe 2796 frxlfff.exe 4168 fxlrlrr.exe 3384 9hhhbh.exe 4920 ppvpp.exe 5056 jdpjj.exe 1776 3xlflfx.exe 1956 bbbnnt.exe 4732 djpvv.exe 1236 frlrfxr.exe 1824 thttnh.exe 2456 1nnnhh.exe 760 ddpjv.exe 2304 xrrxrrl.exe 1728 9hnhbb.exe 5084 3jjdd.exe 2520 rxlrrlr.exe 2508 rflfffx.exe 2244 ttbhbh.exe 1644 dppjj.exe 5112 rllllfx.exe 1940 rffxrlf.exe 752 nttbtn.exe 4716 pjpvp.exe 772 ddpdd.exe 2216 7xxxlll.exe 2288 bnbbtn.exe 4652 dpvpp.exe 1592 xlrrrlf.exe 4464 hhtthh.exe 2328 bbhbtt.exe 3984 5flfxxx.exe 4932 xlxrlfx.exe 3116 hhttbh.exe 1864 djvpj.exe 4620 xrxffrr.exe 116 lxrlrlr.exe 1072 bthhnt.exe 2024 jjddv.exe 232 rxlxllf.exe 4420 hnbtnt.exe 3572 btnthh.exe 3944 jdddd.exe 2576 xxflffl.exe 3036 hhttbb.exe 1040 ppjjd.exe 4176 jdppp.exe 1504 fxxxrrl.exe -
resource yara_rule behavioral2/memory/2504-0-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000500000002326f-4.dat upx behavioral2/files/0x00090000000233c0-11.dat upx behavioral2/memory/232-12-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2024-8-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2504-6-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x00070000000233c7-14.dat upx behavioral2/files/0x00070000000233c8-24.dat upx behavioral2/memory/4100-23-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x00070000000233c9-31.dat upx behavioral2/memory/3648-34-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x00070000000233d0-74.dat upx behavioral2/files/0x00070000000233d8-120.dat upx behavioral2/memory/3036-311-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1504-498-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2596-541-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1608-560-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2456-566-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2028-590-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4900-588-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2520-582-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3212-580-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2512-576-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2904-572-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2924-564-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1380-556-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3104-550-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4692-545-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3404-535-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3180-533-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1868-512-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1480-473-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4596-462-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4816-459-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/544-426-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3344-409-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/684-393-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2904-384-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1148-373-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4580-369-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4116-363-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1980-361-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4908-351-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2452-345-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4388-340-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3800-336-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2248-332-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2084-329-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1504-319-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1040-315-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2576-309-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3944-303-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3572-299-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4420-295-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/232-291-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2024-287-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1072-283-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/116-279-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4620-275-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1864-271-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3116-267-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4932-263-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3984-261-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2328-255-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2024 2504 54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe 136 PID 2504 wrote to memory of 2024 2504 54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe 136 PID 2504 wrote to memory of 2024 2504 54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe 136 PID 2024 wrote to memory of 232 2024 pdjdv.exe 137 PID 2024 wrote to memory of 232 2024 pdjdv.exe 137 PID 2024 wrote to memory of 232 2024 pdjdv.exe 137 PID 232 wrote to memory of 4100 232 fllrfxl.exe 84 PID 232 wrote to memory of 4100 232 fllrfxl.exe 84 PID 232 wrote to memory of 4100 232 fllrfxl.exe 84 PID 4100 wrote to memory of 2556 4100 ppvpv.exe 85 PID 4100 wrote to memory of 2556 4100 ppvpv.exe 85 PID 4100 wrote to memory of 2556 4100 ppvpv.exe 85 PID 2556 wrote to memory of 3648 2556 ffrrfxl.exe 86 PID 2556 wrote to memory of 3648 2556 ffrrfxl.exe 86 PID 2556 wrote to memory of 3648 2556 ffrrfxl.exe 86 PID 3648 wrote to memory of 3140 3648 3ntnhb.exe 87 PID 3648 wrote to memory of 3140 3648 3ntnhb.exe 87 PID 3648 wrote to memory of 3140 3648 3ntnhb.exe 87 PID 3140 wrote to memory of 2576 3140 pjpjj.exe 141 PID 3140 wrote to memory of 2576 3140 pjpjj.exe 141 PID 3140 wrote to memory of 2576 3140 pjpjj.exe 141 PID 2576 wrote to memory of 3432 2576 xxfxrrl.exe 89 PID 2576 wrote to memory of 3432 2576 xxfxrrl.exe 89 PID 2576 wrote to memory of 3432 2576 xxfxrrl.exe 89 PID 3432 wrote to memory of 4312 3432 bhttnn.exe 90 PID 3432 wrote to memory of 4312 3432 bhttnn.exe 90 PID 3432 wrote to memory of 4312 3432 bhttnn.exe 90 PID 4312 wrote to memory of 4528 4312 vdvdp.exe 91 PID 4312 wrote to memory of 4528 4312 vdvdp.exe 91 PID 4312 wrote to memory of 4528 4312 vdvdp.exe 91 PID 4528 wrote to memory of 1020 4528 vvjjp.exe 92 PID 4528 wrote to memory of 1020 4528 vvjjp.exe 92 PID 4528 wrote to memory of 1020 4528 vvjjp.exe 92 PID 1020 wrote to memory of 1504 1020 fxfrrxr.exe 145 PID 1020 wrote to memory of 1504 1020 fxfrrxr.exe 145 PID 1020 wrote to memory of 1504 1020 fxfrrxr.exe 145 PID 1504 wrote to memory of 2380 1504 bbnhbb.exe 94 PID 1504 wrote to memory of 2380 1504 bbnhbb.exe 94 PID 1504 wrote to memory of 2380 1504 bbnhbb.exe 94 PID 2380 wrote to memory of 2084 2380 dpvvd.exe 95 PID 2380 wrote to memory of 2084 2380 dpvvd.exe 95 PID 2380 wrote to memory of 2084 2380 dpvvd.exe 95 PID 2084 wrote to memory of 2248 2084 xrfxrxr.exe 96 PID 2084 wrote to memory of 2248 2084 xrfxrxr.exe 96 PID 2084 wrote to memory of 2248 2084 xrfxrxr.exe 96 PID 2248 wrote to memory of 3852 2248 lrflfff.exe 97 PID 2248 wrote to memory of 3852 2248 lrflfff.exe 97 PID 2248 wrote to memory of 3852 2248 lrflfff.exe 97 PID 3852 wrote to memory of 3736 3852 7nntnt.exe 203 PID 3852 wrote to memory of 3736 3852 7nntnt.exe 203 PID 3852 wrote to memory of 3736 3852 7nntnt.exe 203 PID 3736 wrote to memory of 2796 3736 9vpjd.exe 99 PID 3736 wrote to memory of 2796 3736 9vpjd.exe 99 PID 3736 wrote to memory of 2796 3736 9vpjd.exe 99 PID 2796 wrote to memory of 4168 2796 frxlfff.exe 100 PID 2796 wrote to memory of 4168 2796 frxlfff.exe 100 PID 2796 wrote to memory of 4168 2796 frxlfff.exe 100 PID 4168 wrote to memory of 3384 4168 fxlrlrr.exe 101 PID 4168 wrote to memory of 3384 4168 fxlrlrr.exe 101 PID 4168 wrote to memory of 3384 4168 fxlrlrr.exe 101 PID 3384 wrote to memory of 4920 3384 9hhhbh.exe 102 PID 3384 wrote to memory of 4920 3384 9hhhbh.exe 102 PID 3384 wrote to memory of 4920 3384 9hhhbh.exe 102 PID 4920 wrote to memory of 5056 4920 ppvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\54fd12996f12514733f5cb3b262148b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pdjdv.exec:\pdjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fllrfxl.exec:\fllrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\ppvpv.exec:\ppvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\ffrrfxl.exec:\ffrrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3ntnhb.exec:\3ntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\pjpjj.exec:\pjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\bhttnn.exec:\bhttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\vdvdp.exec:\vdvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\vvjjp.exec:\vvjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\fxfrrxr.exec:\fxfrrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\bbnhbb.exec:\bbnhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\dpvvd.exec:\dpvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lrflfff.exec:\lrflfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\7nntnt.exec:\7nntnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\9vpjd.exec:\9vpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\frxlfff.exec:\frxlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\fxlrlrr.exec:\fxlrlrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\9hhhbh.exec:\9hhhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\ppvpp.exec:\ppvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\jdpjj.exec:\jdpjj.exe23⤵
- Executes dropped EXE
PID:5056 -
\??\c:\3xlflfx.exec:\3xlflfx.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bbbnnt.exec:\bbbnnt.exe25⤵
- Executes dropped EXE
PID:1956 -
\??\c:\djpvv.exec:\djpvv.exe26⤵
- Executes dropped EXE
PID:4732 -
\??\c:\frlrfxr.exec:\frlrfxr.exe27⤵
- Executes dropped EXE
PID:1236 -
\??\c:\thttnh.exec:\thttnh.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1nnnhh.exec:\1nnnhh.exe29⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddpjv.exec:\ddpjv.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9hnhbb.exec:\9hnhbb.exe32⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3jjdd.exec:\3jjdd.exe33⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rxlrrlr.exec:\rxlrrlr.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rflfffx.exec:\rflfffx.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ttbhbh.exec:\ttbhbh.exe36⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dppjj.exec:\dppjj.exe37⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rllllfx.exec:\rllllfx.exe38⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rffxrlf.exec:\rffxrlf.exe39⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nttbtn.exec:\nttbtn.exe40⤵
- Executes dropped EXE
PID:752 -
\??\c:\pjpvp.exec:\pjpvp.exe41⤵
- Executes dropped EXE
PID:4716 -
\??\c:\ddpdd.exec:\ddpdd.exe42⤵
- Executes dropped EXE
PID:772 -
\??\c:\7xxxlll.exec:\7xxxlll.exe43⤵
- Executes dropped EXE
PID:2216 -
\??\c:\bnbbtn.exec:\bnbbtn.exe44⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpvpp.exec:\dpvpp.exe45⤵
- Executes dropped EXE
PID:4652 -
\??\c:\xlrrrlf.exec:\xlrrrlf.exe46⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hhtthh.exec:\hhtthh.exe47⤵
- Executes dropped EXE
PID:4464 -
\??\c:\bbhbtt.exec:\bbhbtt.exe48⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5flfxxx.exec:\5flfxxx.exe49⤵
- Executes dropped EXE
PID:3984 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe50⤵
- Executes dropped EXE
PID:4932 -
\??\c:\hhttbh.exec:\hhttbh.exe51⤵
- Executes dropped EXE
PID:3116 -
\??\c:\djvpj.exec:\djvpj.exe52⤵
- Executes dropped EXE
PID:1864 -
\??\c:\xrxffrr.exec:\xrxffrr.exe53⤵
- Executes dropped EXE
PID:4620 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe54⤵
- Executes dropped EXE
PID:116 -
\??\c:\bthhnt.exec:\bthhnt.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jjddv.exec:\jjddv.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rxlxllf.exec:\rxlxllf.exe57⤵
- Executes dropped EXE
PID:232 -
\??\c:\hnbtnt.exec:\hnbtnt.exe58⤵
- Executes dropped EXE
PID:4420 -
\??\c:\btnthh.exec:\btnthh.exe59⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jdddd.exec:\jdddd.exe60⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xxflffl.exec:\xxflffl.exe61⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hhttbb.exec:\hhttbb.exe62⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ppjjd.exec:\ppjjd.exe63⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jdppp.exec:\jdppp.exe64⤵
- Executes dropped EXE
PID:4176 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\nbbbtn.exec:\nbbbtn.exe66⤵PID:2756
-
\??\c:\pjvvp.exec:\pjvvp.exe67⤵PID:2084
-
\??\c:\9fffxll.exec:\9fffxll.exe68⤵PID:2248
-
\??\c:\3htnht.exec:\3htnht.exe69⤵PID:3800
-
\??\c:\jdpdv.exec:\jdpdv.exe70⤵PID:4388
-
\??\c:\fxfxllf.exec:\fxfxllf.exe71⤵PID:2452
-
\??\c:\ppvpp.exec:\ppvpp.exe72⤵PID:4908
-
\??\c:\frrllfr.exec:\frrllfr.exe73⤵PID:1960
-
\??\c:\fxrlfll.exec:\fxrlfll.exe74⤵PID:1776
-
\??\c:\hbhnth.exec:\hbhnth.exe75⤵PID:1980
-
\??\c:\pvddd.exec:\pvddd.exe76⤵PID:4116
-
\??\c:\lxllfff.exec:\lxllfff.exe77⤵PID:4580
-
\??\c:\nnbtbb.exec:\nnbtbb.exe78⤵PID:1148
-
\??\c:\1jddd.exec:\1jddd.exe79⤵PID:2876
-
\??\c:\pdpdv.exec:\pdpdv.exe80⤵PID:2728
-
\??\c:\rrxrfff.exec:\rrxrfff.exe81⤵PID:2456
-
\??\c:\hhthnn.exec:\hhthnn.exe82⤵PID:2904
-
\??\c:\pdjvp.exec:\pdjvp.exe83⤵PID:2068
-
\??\c:\pjjjj.exec:\pjjjj.exe84⤵PID:684
-
\??\c:\lrrlllf.exec:\lrrlllf.exe85⤵PID:2360
-
\??\c:\tnbtnh.exec:\tnbtnh.exe86⤵PID:3340
-
\??\c:\tbtttt.exec:\tbtttt.exe87⤵PID:2508
-
\??\c:\pjddd.exec:\pjddd.exe88⤵PID:1644
-
\??\c:\flrlffx.exec:\flrlffx.exe89⤵PID:3344
-
\??\c:\nbnhbb.exec:\nbnhbb.exe90⤵PID:3368
-
\??\c:\nthbbb.exec:\nthbbb.exe91⤵PID:4608
-
\??\c:\ppjjd.exec:\ppjjd.exe92⤵PID:3076
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe93⤵PID:4448
-
\??\c:\hbtnhh.exec:\hbtnhh.exe94⤵PID:2216
-
\??\c:\tntnhh.exec:\tntnhh.exe95⤵PID:544
-
\??\c:\jvdpj.exec:\jvdpj.exe96⤵PID:1848
-
\??\c:\frxrllf.exec:\frxrllf.exe97⤵PID:716
-
\??\c:\5hnnhn.exec:\5hnnhn.exe98⤵PID:2584
-
\??\c:\bhbhnn.exec:\bhbhnn.exe99⤵PID:3692
-
\??\c:\vdpjv.exec:\vdpjv.exe100⤵PID:3280
-
\??\c:\llxrffr.exec:\llxrffr.exe101⤵PID:3812
-
\??\c:\ntthbt.exec:\ntthbt.exe102⤵PID:3568
-
\??\c:\dpppj.exec:\dpppj.exe103⤵PID:1176
-
\??\c:\9dddv.exec:\9dddv.exe104⤵PID:3116
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe105⤵PID:4816
-
\??\c:\tnnnbb.exec:\tnnnbb.exe106⤵PID:3292
-
\??\c:\vjjdd.exec:\vjjdd.exe107⤵PID:4596
-
\??\c:\jjjjd.exec:\jjjjd.exe108⤵PID:4676
-
\??\c:\xflllll.exec:\xflllll.exe109⤵PID:1480
-
\??\c:\bhhhtt.exec:\bhhhtt.exe110⤵PID:3464
-
\??\c:\hbtnnn.exec:\hbtnnn.exe111⤵PID:1336
-
\??\c:\ppvvj.exec:\ppvvj.exe112⤵PID:4672
-
\??\c:\rlfflff.exec:\rlfflff.exe113⤵PID:4556
-
\??\c:\hbbbbb.exec:\hbbbbb.exe114⤵PID:2576
-
\??\c:\jdjdv.exec:\jdjdv.exe115⤵PID:4760
-
\??\c:\pdpjv.exec:\pdpjv.exe116⤵PID:1540
-
\??\c:\fflffff.exec:\fflffff.exe117⤵PID:1504
-
\??\c:\bnnnnh.exec:\bnnnnh.exe118⤵PID:3544
-
\??\c:\hbbbtt.exec:\hbbbtt.exe119⤵PID:348
-
\??\c:\vdjdv.exec:\vdjdv.exe120⤵PID:5064
-
\??\c:\xxfxxfx.exec:\xxfxxfx.exe121⤵PID:5092
-
\??\c:\hbbtnn.exec:\hbbtnn.exe122⤵PID:1868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-