Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 21:54
Behavioral task
behavioral1
Sample
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
Resource
win7-20240419-en
General
-
Target
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe
-
Size
251KB
-
MD5
69d9be638f02536a48e42f4d1ef28960
-
SHA1
f962f39ce5e07410b9c255290b4f408e67829f51
-
SHA256
f9f19f07a5996f19be240df6c403f571898a2cdb9b2d379dd8d0966694b233c9
-
SHA512
e4302773a46cc376a12b8a397c7263cfdc5164c186c826133f1c8c08e9364a25eded2e0b293e6ee7efbc85a4f620dbe90ea1d183a628e44d7e3a55b93ca6c9a9
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+H:ccm4FmowdHoSi9EIBftapTs4WZazY
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/60-0-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1564-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3108-18-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4540-28-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3692-41-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2240-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1056-35-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4448-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1028-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3972-66-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1792-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2104-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3964-91-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/972-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4856-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4404-104-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/408-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3240-122-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3216-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3248-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2696-168-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4752-173-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2260-185-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2368-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4556-193-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-197-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4048-207-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4208-219-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3520-218-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3084-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2056-229-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2484-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1056-238-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2624-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1624-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2204-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2036-257-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3404-267-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3224-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1392-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1608-298-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4728-305-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-309-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/332-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1280-338-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1080-342-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3048-346-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2648-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/644-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2404-395-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4552-417-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1448-424-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1292-447-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2396-455-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/512-470-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4436-579-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5100-597-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2260-619-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3748-728-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2332-770-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3732-839-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2768-852-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3664-1065-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\bbthth.exe family_berbew \??\c:\7pdjp.exe family_berbew C:\rxflfll.exe family_berbew C:\hhbnbn.exe family_berbew C:\bntnhb.exe family_berbew C:\xfrlllr.exe family_berbew \??\c:\nhhnhb.exe family_berbew C:\ppjvp.exe family_berbew C:\httnhh.exe family_berbew \??\c:\lllrrll.exe family_berbew C:\1bhbbb.exe family_berbew C:\lflrrlr.exe family_berbew C:\thbhhh.exe family_berbew \??\c:\5ppvj.exe family_berbew C:\1rfllrr.exe family_berbew C:\ttbbtb.exe family_berbew \??\c:\pddpj.exe family_berbew C:\lflrfrr.exe family_berbew C:\lxfxlll.exe family_berbew C:\nhbhbh.exe family_berbew C:\9vjvj.exe family_berbew C:\htbhbb.exe family_berbew C:\xfllrfx.exe family_berbew C:\hhhthb.exe family_berbew C:\xxrxxrl.exe family_berbew C:\btbhhh.exe family_berbew C:\pvjdd.exe family_berbew C:\fxxllrr.exe family_berbew C:\llrrflx.exe family_berbew C:\dpppp.exe family_berbew \??\c:\fxrfxrl.exe family_berbew C:\thtnhb.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
bbthth.exe7pdjp.exerxflfll.exehhbnbn.exebntnhb.exexfrlllr.exenhhnhb.exeppjvp.exehttnhh.exelllrrll.exe1bhbbb.exelflrrlr.exethbhhh.exe5ppvj.exe1rfllrr.exettbbtb.exepddpj.exelflrfrr.exelxfxlll.exenhbhbh.exe9vjvj.exehtbhbb.exexfllrfx.exehhhthb.exexxrxxrl.exebtbhhh.exepvjdd.exefxxllrr.exellrrflx.exedpppp.exefxrfxrl.exethtnhb.exedvpdv.exefxlffrx.exe3hthbt.exepdjjd.exelrrrrxr.exehnhbnh.exetntnhb.exeddjdd.exefxrxxll.exelfxrlrr.exebnbnnn.exe9vjpj.exerxrxlxl.exehhnbbb.exenhnbtb.exerxrlfxr.exexxfrfxl.exehbnhhb.exelllfrrl.exebbtbnh.exedvjjd.exehhbhhb.exevdjjd.exe3ppjj.exelfxrfll.exenbhntb.exepjjdd.exelflrrxf.exetthnnn.exehhttht.exevpjjj.exe1flllrr.exepid process 1564 bbthth.exe 4408 7pdjp.exe 3108 rxflfll.exe 4540 hhbnbn.exe 1056 bntnhb.exe 3692 xfrlllr.exe 2240 nhhnhb.exe 4448 ppjvp.exe 1028 httnhh.exe 3972 lllrrll.exe 3724 1bhbbb.exe 1792 lflrrlr.exe 2104 thbhhh.exe 3964 5ppvj.exe 4856 1rfllrr.exe 972 ttbbtb.exe 4404 pddpj.exe 1608 lflrfrr.exe 408 lxfxlll.exe 3240 nhbhbh.exe 3196 9vjvj.exe 3216 htbhbb.exe 4284 xfllrfx.exe 4152 hhhthb.exe 3800 xxrxxrl.exe 3248 btbhhh.exe 3764 pvjdd.exe 2696 fxxllrr.exe 4752 llrrflx.exe 1500 dpppp.exe 2260 fxrfxrl.exe 2368 thtnhb.exe 4556 dvpdv.exe 1012 fxlffrx.exe 2648 3hthbt.exe 4512 pdjjd.exe 4048 lrrrrxr.exe 1312 hnhbnh.exe 4420 tntnhb.exe 3520 ddjdd.exe 4208 fxrxxll.exe 3084 lfxrlrr.exe 2056 bnbnnn.exe 2484 9vjpj.exe 1056 rxrxlxl.exe 2624 hhnbbb.exe 2404 nhnbtb.exe 1624 rxrlfxr.exe 2204 xxfrfxl.exe 2036 hbnhhb.exe 3576 lllfrrl.exe 2992 bbtbnh.exe 3404 dvjjd.exe 2028 hhbhhb.exe 5052 vdjjd.exe 3224 3ppjj.exe 1448 lfxrfll.exe 5068 nbhntb.exe 1392 pjjdd.exe 2536 lflrrxf.exe 408 tthnnn.exe 1608 hhttht.exe 2764 vpjjj.exe 4728 1flllrr.exe -
Processes:
resource yara_rule behavioral2/memory/60-0-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bbthth.exe upx behavioral2/memory/1564-8-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7pdjp.exe upx C:\rxflfll.exe upx behavioral2/memory/3108-18-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hhbnbn.exe upx behavioral2/memory/4540-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4408-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4540-28-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\bntnhb.exe upx C:\xfrlllr.exe upx behavioral2/memory/3692-41-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\nhhnhb.exe upx behavioral2/memory/2240-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1056-35-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ppjvp.exe upx C:\httnhh.exe upx behavioral2/memory/4448-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1028-55-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1028-60-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lllrrll.exe upx C:\1bhbbb.exe upx behavioral2/memory/3972-66-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\lflrrlr.exe upx behavioral2/memory/1792-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1792-77-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\thbhhh.exe upx \??\c:\5ppvj.exe upx behavioral2/memory/2104-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3964-85-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1rfllrr.exe upx behavioral2/memory/3964-91-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\ttbbtb.exe upx behavioral2/memory/972-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4856-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4404-104-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\pddpj.exe upx C:\lflrfrr.exe upx C:\lxfxlll.exe upx behavioral2/memory/408-116-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhbhbh.exe upx behavioral2/memory/3240-122-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\9vjvj.exe upx C:\htbhbb.exe upx C:\xfllrfx.exe upx behavioral2/memory/3216-135-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\hhhthb.exe upx C:\xxrxxrl.exe upx C:\btbhhh.exe upx behavioral2/memory/3248-154-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pvjdd.exe upx C:\fxxllrr.exe upx C:\llrrflx.exe upx behavioral2/memory/2696-168-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4752-173-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dpppp.exe upx \??\c:\fxrfxrl.exe upx C:\thtnhb.exe upx behavioral2/memory/2260-185-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2368-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4556-193-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1012-197-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4048-207-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exebbthth.exe7pdjp.exerxflfll.exehhbnbn.exebntnhb.exexfrlllr.exenhhnhb.exeppjvp.exehttnhh.exelllrrll.exe1bhbbb.exelflrrlr.exethbhhh.exe5ppvj.exe1rfllrr.exettbbtb.exepddpj.exelflrfrr.exelxfxlll.exenhbhbh.exe9vjvj.exedescription pid process target process PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe bbthth.exe PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe bbthth.exe PID 60 wrote to memory of 1564 60 69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe bbthth.exe PID 1564 wrote to memory of 4408 1564 bbthth.exe 7pdjp.exe PID 1564 wrote to memory of 4408 1564 bbthth.exe 7pdjp.exe PID 1564 wrote to memory of 4408 1564 bbthth.exe 7pdjp.exe PID 4408 wrote to memory of 3108 4408 7pdjp.exe rxflfll.exe PID 4408 wrote to memory of 3108 4408 7pdjp.exe rxflfll.exe PID 4408 wrote to memory of 3108 4408 7pdjp.exe rxflfll.exe PID 3108 wrote to memory of 4540 3108 rxflfll.exe hhbnbn.exe PID 3108 wrote to memory of 4540 3108 rxflfll.exe hhbnbn.exe PID 3108 wrote to memory of 4540 3108 rxflfll.exe hhbnbn.exe PID 4540 wrote to memory of 1056 4540 hhbnbn.exe bntnhb.exe PID 4540 wrote to memory of 1056 4540 hhbnbn.exe bntnhb.exe PID 4540 wrote to memory of 1056 4540 hhbnbn.exe bntnhb.exe PID 1056 wrote to memory of 3692 1056 bntnhb.exe xfrlllr.exe PID 1056 wrote to memory of 3692 1056 bntnhb.exe xfrlllr.exe PID 1056 wrote to memory of 3692 1056 bntnhb.exe xfrlllr.exe PID 3692 wrote to memory of 2240 3692 xfrlllr.exe nhhnhb.exe PID 3692 wrote to memory of 2240 3692 xfrlllr.exe nhhnhb.exe PID 3692 wrote to memory of 2240 3692 xfrlllr.exe nhhnhb.exe PID 2240 wrote to memory of 4448 2240 nhhnhb.exe ppjvp.exe PID 2240 wrote to memory of 4448 2240 nhhnhb.exe ppjvp.exe PID 2240 wrote to memory of 4448 2240 nhhnhb.exe ppjvp.exe PID 4448 wrote to memory of 1028 4448 ppjvp.exe httnhh.exe PID 4448 wrote to memory of 1028 4448 ppjvp.exe httnhh.exe PID 4448 wrote to memory of 1028 4448 ppjvp.exe httnhh.exe PID 1028 wrote to memory of 3972 1028 httnhh.exe lllrrll.exe PID 1028 wrote to memory of 3972 1028 httnhh.exe lllrrll.exe PID 1028 wrote to memory of 3972 1028 httnhh.exe lllrrll.exe PID 3972 wrote to memory of 3724 3972 lllrrll.exe 1bhbbb.exe PID 3972 wrote to memory of 3724 3972 lllrrll.exe 1bhbbb.exe PID 3972 wrote to memory of 3724 3972 lllrrll.exe 1bhbbb.exe PID 3724 wrote to memory of 1792 3724 1bhbbb.exe lflrrlr.exe PID 3724 wrote to memory of 1792 3724 1bhbbb.exe lflrrlr.exe PID 3724 wrote to memory of 1792 3724 1bhbbb.exe lflrrlr.exe PID 1792 wrote to memory of 2104 1792 lflrrlr.exe thbhhh.exe PID 1792 wrote to memory of 2104 1792 lflrrlr.exe thbhhh.exe PID 1792 wrote to memory of 2104 1792 lflrrlr.exe thbhhh.exe PID 2104 wrote to memory of 3964 2104 thbhhh.exe 5ppvj.exe PID 2104 wrote to memory of 3964 2104 thbhhh.exe 5ppvj.exe PID 2104 wrote to memory of 3964 2104 thbhhh.exe 5ppvj.exe PID 3964 wrote to memory of 4856 3964 5ppvj.exe 1rfllrr.exe PID 3964 wrote to memory of 4856 3964 5ppvj.exe 1rfllrr.exe PID 3964 wrote to memory of 4856 3964 5ppvj.exe 1rfllrr.exe PID 4856 wrote to memory of 972 4856 1rfllrr.exe ttbbtb.exe PID 4856 wrote to memory of 972 4856 1rfllrr.exe ttbbtb.exe PID 4856 wrote to memory of 972 4856 1rfllrr.exe ttbbtb.exe PID 972 wrote to memory of 4404 972 ttbbtb.exe pddpj.exe PID 972 wrote to memory of 4404 972 ttbbtb.exe pddpj.exe PID 972 wrote to memory of 4404 972 ttbbtb.exe pddpj.exe PID 4404 wrote to memory of 1608 4404 pddpj.exe lflrfrr.exe PID 4404 wrote to memory of 1608 4404 pddpj.exe lflrfrr.exe PID 4404 wrote to memory of 1608 4404 pddpj.exe lflrfrr.exe PID 1608 wrote to memory of 408 1608 lflrfrr.exe lxfxlll.exe PID 1608 wrote to memory of 408 1608 lflrfrr.exe lxfxlll.exe PID 1608 wrote to memory of 408 1608 lflrfrr.exe lxfxlll.exe PID 408 wrote to memory of 3240 408 lxfxlll.exe nhbhbh.exe PID 408 wrote to memory of 3240 408 lxfxlll.exe nhbhbh.exe PID 408 wrote to memory of 3240 408 lxfxlll.exe nhbhbh.exe PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 9vjvj.exe PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 9vjvj.exe PID 3240 wrote to memory of 3196 3240 nhbhbh.exe 9vjvj.exe PID 3196 wrote to memory of 3216 3196 9vjvj.exe htbhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69d9be638f02536a48e42f4d1ef28960_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\bbthth.exec:\bbthth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\7pdjp.exec:\7pdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\rxflfll.exec:\rxflfll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\hhbnbn.exec:\hhbnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\bntnhb.exec:\bntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\xfrlllr.exec:\xfrlllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nhhnhb.exec:\nhhnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\ppjvp.exec:\ppjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\httnhh.exec:\httnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lllrrll.exec:\lllrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\1bhbbb.exec:\1bhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\lflrrlr.exec:\lflrrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\thbhhh.exec:\thbhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\5ppvj.exec:\5ppvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\1rfllrr.exec:\1rfllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ttbbtb.exec:\ttbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\pddpj.exec:\pddpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\lflrfrr.exec:\lflrfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\lxfxlll.exec:\lxfxlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\nhbhbh.exec:\nhbhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\9vjvj.exec:\9vjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\htbhbb.exec:\htbhbb.exe23⤵
- Executes dropped EXE
PID:3216 -
\??\c:\xfllrfx.exec:\xfllrfx.exe24⤵
- Executes dropped EXE
PID:4284 -
\??\c:\hhhthb.exec:\hhhthb.exe25⤵
- Executes dropped EXE
PID:4152 -
\??\c:\xxrxxrl.exec:\xxrxxrl.exe26⤵
- Executes dropped EXE
PID:3800 -
\??\c:\btbhhh.exec:\btbhhh.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pvjdd.exec:\pvjdd.exe28⤵
- Executes dropped EXE
PID:3764 -
\??\c:\fxxllrr.exec:\fxxllrr.exe29⤵
- Executes dropped EXE
PID:2696 -
\??\c:\llrrflx.exec:\llrrflx.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dpppp.exec:\dpppp.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\thtnhb.exec:\thtnhb.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\dvpdv.exec:\dvpdv.exe34⤵
- Executes dropped EXE
PID:4556 -
\??\c:\fxlffrx.exec:\fxlffrx.exe35⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3hthbt.exec:\3hthbt.exe36⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pdjjd.exec:\pdjjd.exe37⤵
- Executes dropped EXE
PID:4512 -
\??\c:\lrrrrxr.exec:\lrrrrxr.exe38⤵
- Executes dropped EXE
PID:4048 -
\??\c:\hnhbnh.exec:\hnhbnh.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\tntnhb.exec:\tntnhb.exe40⤵
- Executes dropped EXE
PID:4420 -
\??\c:\ddjdd.exec:\ddjdd.exe41⤵
- Executes dropped EXE
PID:3520 -
\??\c:\fxrxxll.exec:\fxrxxll.exe42⤵
- Executes dropped EXE
PID:4208 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe43⤵
- Executes dropped EXE
PID:3084 -
\??\c:\bnbnnn.exec:\bnbnnn.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9vjpj.exec:\9vjpj.exe45⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rxrxlxl.exec:\rxrxlxl.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\hhnbbb.exec:\hhnbbb.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nhnbtb.exec:\nhnbtb.exe48⤵
- Executes dropped EXE
PID:2404 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe49⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxfrfxl.exec:\xxfrfxl.exe50⤵
- Executes dropped EXE
PID:2204 -
\??\c:\hbnhhb.exec:\hbnhhb.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lllfrrl.exec:\lllfrrl.exe52⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbtbnh.exec:\bbtbnh.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\dvjjd.exec:\dvjjd.exe54⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hhbhhb.exec:\hhbhhb.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vdjjd.exec:\vdjjd.exe56⤵
- Executes dropped EXE
PID:5052 -
\??\c:\3ppjj.exec:\3ppjj.exe57⤵
- Executes dropped EXE
PID:3224 -
\??\c:\lfxrfll.exec:\lfxrfll.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nbhntb.exec:\nbhntb.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pjjdd.exec:\pjjdd.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lflrrxf.exec:\lflrrxf.exe61⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tthnnn.exec:\tthnnn.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\hhttht.exec:\hhttht.exe63⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpjjj.exec:\vpjjj.exe64⤵
- Executes dropped EXE
PID:2764 -
\??\c:\1flllrr.exec:\1flllrr.exe65⤵
- Executes dropped EXE
PID:4728 -
\??\c:\nbnhhn.exec:\nbnhhn.exe66⤵PID:4436
-
\??\c:\jvppp.exec:\jvppp.exe67⤵PID:2896
-
\??\c:\1xfxxfl.exec:\1xfxxfl.exe68⤵PID:532
-
\??\c:\lrrrfll.exec:\lrrrfll.exe69⤵PID:4152
-
\??\c:\hhtbbn.exec:\hhtbbn.exe70⤵PID:4712
-
\??\c:\nnbbbh.exec:\nnbbbh.exe71⤵PID:1844
-
\??\c:\djvdj.exec:\djvdj.exe72⤵PID:3248
-
\??\c:\xxrffff.exec:\xxrffff.exe73⤵PID:332
-
\??\c:\fxffrxx.exec:\fxffrxx.exe74⤵PID:3448
-
\??\c:\nthhtb.exec:\nthhtb.exe75⤵PID:1280
-
\??\c:\jpvvv.exec:\jpvvv.exe76⤵PID:1080
-
\??\c:\thbhhn.exec:\thbhhn.exe77⤵PID:3048
-
\??\c:\1dddj.exec:\1dddj.exe78⤵PID:968
-
\??\c:\vvdvj.exec:\vvdvj.exe79⤵PID:1984
-
\??\c:\lfxxflx.exec:\lfxxflx.exe80⤵PID:4460
-
\??\c:\hbhbbb.exec:\hbhbbb.exe81⤵PID:4576
-
\??\c:\jjvvd.exec:\jjvvd.exe82⤵PID:2640
-
\??\c:\vvdjp.exec:\vvdjp.exe83⤵PID:4520
-
\??\c:\xxrlffx.exec:\xxrlffx.exe84⤵PID:2648
-
\??\c:\bhnnbn.exec:\bhnnbn.exe85⤵PID:4200
-
\??\c:\9ttnht.exec:\9ttnht.exe86⤵PID:4356
-
\??\c:\vjjjd.exec:\vjjjd.exe87⤵PID:3556
-
\??\c:\lfrxlfx.exec:\lfrxlfx.exe88⤵PID:644
-
\??\c:\xrrlrfx.exec:\xrrlrfx.exe89⤵PID:2972
-
\??\c:\hnbbnn.exec:\hnbbnn.exe90⤵PID:4036
-
\??\c:\vdvpv.exec:\vdvpv.exe91⤵PID:3792
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe92⤵PID:3372
-
\??\c:\xrfxxff.exec:\xrfxxff.exe93⤵PID:2404
-
\??\c:\thbbnb.exec:\thbbnb.exe94⤵PID:1636
-
\??\c:\ppjdp.exec:\ppjdp.exe95⤵PID:4732
-
\??\c:\vjjjv.exec:\vjjjv.exe96⤵PID:4864
-
\??\c:\lxxxxrx.exec:\lxxxxrx.exe97⤵PID:2080
-
\??\c:\hthnnb.exec:\hthnnb.exe98⤵PID:2104
-
\??\c:\djvvj.exec:\djvvj.exe99⤵PID:4552
-
\??\c:\jpjvj.exec:\jpjvj.exe100⤵PID:4856
-
\??\c:\1lxxrxx.exec:\1lxxrxx.exe101⤵PID:1448
-
\??\c:\ntnhhh.exec:\ntnhhh.exe102⤵PID:1468
-
\??\c:\pdjjj.exec:\pdjjj.exe103⤵PID:2704
-
\??\c:\5dppj.exec:\5dppj.exe104⤵PID:3944
-
\??\c:\fxxxfrr.exec:\fxxxfrr.exe105⤵PID:4532
-
\??\c:\tntttb.exec:\tntttb.exe106⤵PID:1692
-
\??\c:\jvvjv.exec:\jvvjv.exe107⤵PID:3196
-
\??\c:\flfffxr.exec:\flfffxr.exe108⤵PID:1292
-
\??\c:\hbhhht.exec:\hbhhht.exe109⤵PID:4372
-
\??\c:\ppvvj.exec:\ppvvj.exe110⤵PID:2988
-
\??\c:\xflfrrf.exec:\xflfrrf.exe111⤵PID:2396
-
\??\c:\bbhbbh.exec:\bbhbbh.exe112⤵PID:1860
-
\??\c:\3vjjj.exec:\3vjjj.exe113⤵PID:2804
-
\??\c:\xrxxfll.exec:\xrxxfll.exe114⤵PID:1996
-
\??\c:\hhbhtb.exec:\hhbhtb.exe115⤵PID:512
-
\??\c:\pdppv.exec:\pdppv.exe116⤵PID:2668
-
\??\c:\thnnnt.exec:\thnnnt.exe117⤵PID:3448
-
\??\c:\ppvpp.exec:\ppvpp.exe118⤵PID:4584
-
\??\c:\dppvv.exec:\dppvv.exe119⤵PID:3768
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe120⤵PID:4696
-
\??\c:\pvppv.exec:\pvppv.exe121⤵PID:4440
-
\??\c:\xlrlxrx.exec:\xlrlxrx.exe122⤵PID:3348
-
\??\c:\lrflflx.exec:\lrflflx.exe123⤵PID:4868
-
\??\c:\nnnthn.exec:\nnnthn.exe124⤵PID:4596
-
\??\c:\bhbhhn.exec:\bhbhhn.exe125⤵PID:2640
-
\??\c:\pjvvv.exec:\pjvvv.exe126⤵PID:4508
-
\??\c:\lxllllr.exec:\lxllllr.exe127⤵PID:5036
-
\??\c:\nntnnt.exec:\nntnnt.exe128⤵PID:3828
-
\??\c:\hnbhth.exec:\hnbhth.exe129⤵PID:4420
-
\??\c:\jdjdd.exec:\jdjdd.exe130⤵PID:4208
-
\??\c:\9djdd.exec:\9djdd.exe131⤵PID:2020
-
\??\c:\llrllrx.exec:\llrllrx.exe132⤵PID:2972
-
\??\c:\frxfffl.exec:\frxfffl.exe133⤵PID:4528
-
\??\c:\btnnnn.exec:\btnnnn.exe134⤵PID:4072
-
\??\c:\5djdd.exec:\5djdd.exe135⤵PID:2204
-
\??\c:\xlfffff.exec:\xlfffff.exe136⤵PID:2304
-
\??\c:\9frrlrf.exec:\9frrlrf.exe137⤵PID:3524
-
\??\c:\tnnnnn.exec:\tnnnnn.exe138⤵PID:392
-
\??\c:\pvvvp.exec:\pvvvp.exe139⤵PID:1672
-
\??\c:\llrffxx.exec:\llrffxx.exe140⤵PID:3212
-
\??\c:\fxfffll.exec:\fxfffll.exe141⤵PID:4724
-
\??\c:\bbhhbb.exec:\bbhhbb.exe142⤵PID:3224
-
\??\c:\vvdpj.exec:\vvdpj.exe143⤵PID:3540
-
\??\c:\fflllll.exec:\fflllll.exe144⤵PID:2644
-
\??\c:\btbbbh.exec:\btbbbh.exe145⤵PID:4548
-
\??\c:\5httth.exec:\5httth.exe146⤵PID:3668
-
\??\c:\vvvvv.exec:\vvvvv.exe147⤵PID:840
-
\??\c:\rllllll.exec:\rllllll.exe148⤵PID:3240
-
\??\c:\xffxxxr.exec:\xffxxxr.exe149⤵PID:3812
-
\??\c:\nhhnbb.exec:\nhhnbb.exe150⤵PID:4272
-
\??\c:\pdvvp.exec:\pdvvp.exe151⤵PID:4436
-
\??\c:\lxlflll.exec:\lxlflll.exe152⤵PID:4872
-
\??\c:\tntnnn.exec:\tntnnn.exe153⤵PID:2588
-
\??\c:\hhhbth.exec:\hhhbth.exe154⤵PID:3376
-
\??\c:\jpjpp.exec:\jpjpp.exe155⤵PID:4712
-
\??\c:\vvvvp.exec:\vvvvp.exe156⤵PID:5100
-
\??\c:\rrffrrf.exec:\rrffrrf.exe157⤵PID:512
-
\??\c:\7pvvp.exec:\7pvvp.exe158⤵PID:2480
-
\??\c:\dvppj.exec:\dvppj.exe159⤵PID:4544
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe160⤵PID:2516
-
\??\c:\hbtnnn.exec:\hbtnnn.exe161⤵PID:3580
-
\??\c:\dpdjj.exec:\dpdjj.exe162⤵PID:968
-
\??\c:\3pddj.exec:\3pddj.exe163⤵PID:2260
-
\??\c:\llrrxrx.exec:\llrrxrx.exe164⤵PID:2368
-
\??\c:\tbbnnb.exec:\tbbnnb.exe165⤵PID:1396
-
\??\c:\pjppp.exec:\pjppp.exe166⤵PID:4504
-
\??\c:\lfxllll.exec:\lfxllll.exe167⤵PID:2640
-
\??\c:\ttnthn.exec:\ttnthn.exe168⤵PID:4508
-
\??\c:\jjjdv.exec:\jjjdv.exe169⤵PID:984
-
\??\c:\lrrxxfx.exec:\lrrxxfx.exe170⤵PID:4956
-
\??\c:\bnnnhh.exec:\bnnnhh.exe171⤵PID:4704
-
\??\c:\9hnhhn.exec:\9hnhhn.exe172⤵PID:4196
-
\??\c:\vvppj.exec:\vvppj.exe173⤵PID:2972
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe174⤵PID:2828
-
\??\c:\thnhhn.exec:\thnhhn.exe175⤵PID:2404
-
\??\c:\bhttbb.exec:\bhttbb.exe176⤵PID:2204
-
\??\c:\dddjd.exec:\dddjd.exe177⤵PID:2304
-
\??\c:\rlllrxx.exec:\rlllrxx.exe178⤵PID:3524
-
\??\c:\nnhhhh.exec:\nnhhhh.exe179⤵PID:5052
-
\??\c:\htthhh.exec:\htthhh.exe180⤵PID:2760
-
\??\c:\pvddp.exec:\pvddp.exe181⤵PID:5084
-
\??\c:\7xfffll.exec:\7xfffll.exe182⤵PID:2520
-
\??\c:\frrllll.exec:\frrllll.exe183⤵PID:3672
-
\??\c:\hntbhn.exec:\hntbhn.exe184⤵PID:1404
-
\??\c:\ddjjj.exec:\ddjjj.exe185⤵PID:1084
-
\??\c:\rfxlrxx.exec:\rfxlrxx.exe186⤵PID:4880
-
\??\c:\rlrrfff.exec:\rlrrfff.exe187⤵PID:3240
-
\??\c:\nhhhhb.exec:\nhhhhb.exe188⤵PID:3812
-
\??\c:\pjdjp.exec:\pjdjp.exe189⤵PID:4788
-
\??\c:\pvppj.exec:\pvppj.exe190⤵PID:2988
-
\??\c:\xfllflf.exec:\xfllflf.exe191⤵PID:3700
-
\??\c:\ffrxxfx.exec:\ffrxxfx.exe192⤵PID:2588
-
\??\c:\btbbbb.exec:\btbbbb.exe193⤵PID:3868
-
\??\c:\3jvvv.exec:\3jvvv.exe194⤵PID:3732
-
\??\c:\ppppd.exec:\ppppd.exe195⤵PID:4260
-
\??\c:\xxxxlrl.exec:\xxxxlrl.exe196⤵PID:4160
-
\??\c:\htntnh.exec:\htntnh.exe197⤵PID:3016
-
\??\c:\vvvdd.exec:\vvvdd.exe198⤵PID:2768
-
\??\c:\dpjpj.exec:\dpjpj.exe199⤵PID:3748
-
\??\c:\xxffrxx.exec:\xxffrxx.exe200⤵PID:3728
-
\??\c:\hnbbhb.exec:\hnbbhb.exe201⤵PID:3664
-
\??\c:\nntthb.exec:\nntthb.exe202⤵PID:3752
-
\??\c:\jdppj.exec:\jdppj.exe203⤵PID:4224
-
\??\c:\lflllxx.exec:\lflllxx.exe204⤵PID:1736
-
\??\c:\lrrfrxr.exec:\lrrfrxr.exe205⤵PID:4048
-
\??\c:\3hnttb.exec:\3hnttb.exe206⤵PID:2924
-
\??\c:\jjdvj.exec:\jjdvj.exe207⤵PID:4356
-
\??\c:\xrlffff.exec:\xrlffff.exe208⤵PID:4540
-
\??\c:\xrffxxf.exec:\xrffxxf.exe209⤵PID:4036
-
\??\c:\ttbbnb.exec:\ttbbnb.exe210⤵PID:2352
-
\??\c:\tnhnnt.exec:\tnhnnt.exe211⤵PID:2332
-
\??\c:\vjdjj.exec:\vjdjj.exe212⤵PID:1224
-
\??\c:\rxrxfll.exec:\rxrxfll.exe213⤵PID:4108
-
\??\c:\bnnthn.exec:\bnnthn.exe214⤵PID:2076
-
\??\c:\ddpjd.exec:\ddpjd.exe215⤵PID:2992
-
\??\c:\vvddd.exec:\vvddd.exe216⤵PID:2080
-
\??\c:\rffxxxx.exec:\rffxxxx.exe217⤵PID:3264
-
\??\c:\bbhnnt.exec:\bbhnnt.exe218⤵PID:3212
-
\??\c:\nhttnh.exec:\nhttnh.exe219⤵PID:3956
-
\??\c:\dvppv.exec:\dvppv.exe220⤵PID:4404
-
\??\c:\jjppj.exec:\jjppj.exe221⤵PID:2248
-
\??\c:\ffxrxrr.exec:\ffxrxrr.exe222⤵PID:2704
-
\??\c:\nnbbbn.exec:\nnbbbn.exe223⤵PID:2764
-
\??\c:\7jvjj.exec:\7jvjj.exe224⤵PID:2292
-
\??\c:\pdvpp.exec:\pdvpp.exe225⤵PID:4880
-
\??\c:\rrxrrxf.exec:\rrxrrxf.exe226⤵PID:4156
-
\??\c:\nntttb.exec:\nntttb.exe227⤵PID:4372
-
\??\c:\jpppp.exec:\jpppp.exe228⤵PID:4152
-
\??\c:\vvjvv.exec:\vvjvv.exe229⤵PID:2988
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe230⤵PID:1516
-
\??\c:\hbbbtb.exec:\hbbbtb.exe231⤵PID:3376
-
\??\c:\jjddd.exec:\jjddd.exe232⤵PID:3868
-
\??\c:\flxflxr.exec:\flxflxr.exe233⤵PID:3732
-
\??\c:\frxrrlf.exec:\frxrrlf.exe234⤵PID:4260
-
\??\c:\ttttnt.exec:\ttttnt.exe235⤵PID:1684
-
\??\c:\vpddj.exec:\vpddj.exe236⤵PID:3016
-
\??\c:\fxrllff.exec:\fxrllff.exe237⤵PID:2768
-
\??\c:\lfllflf.exec:\lfllflf.exe238⤵PID:1456
-
\??\c:\nnnntb.exec:\nnnntb.exe239⤵PID:2384
-
\??\c:\jvjdd.exec:\jvjdd.exe240⤵PID:2260
-
\??\c:\rrffllr.exec:\rrffllr.exe241⤵PID:3492
-
\??\c:\nntntb.exec:\nntntb.exe242⤵PID:1396