Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 10:48
Behavioral task
behavioral1
Sample
a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
-
Target
a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe
-
Size
247KB
-
MD5
a881ad63ac1ff75962efc36765437570
-
SHA1
9732b6b031d213325ce5a591ff435ccce26dd520
-
SHA256
cf2ca8a25da39a63ac87b6869b020ef16d20cd0bc56887facb2969520dd7dd9c
-
SHA512
ecc35d556248c4ba11bce1a3911f1bd29b77533dac4bb6d355d6b84b476ce283edc367bb5ccb2973b1f5908d207b5f3d12d48ec9840fcf751b1b1f49ddc0d62b
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+H:ccm4FmowdHoSi9EIBftapTs4WZazI
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4796-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2992-15-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4908-11-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3212-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3020-32-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3016-39-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3796-25-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3632-44-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1116-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/912-60-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3764-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4892-72-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2608-78-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3276-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3716-84-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2196-96-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3232-98-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4488-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2468-118-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4608-125-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-141-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1164-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3820-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1560-191-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1936-196-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4408-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3032-208-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3776-215-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2488-226-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4244-247-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4244-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2924-252-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5076-242-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4040-259-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/216-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4568-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/392-200-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4820-277-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3728-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1372-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4304-181-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3708-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3200-152-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1680-303-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4852-307-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1584-321-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4444-326-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4936-334-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/936-374-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5088-379-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/716-394-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3380-404-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/860-408-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/856-450-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4776-507-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4960-521-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2736-570-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1736-586-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1152-636-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2072-643-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4500-672-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4960-679-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4156-707-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3780-869-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0009000000023297-3.dat family_berbew behavioral2/files/0x000a000000023421-9.dat family_berbew behavioral2/files/0x000700000002342d-13.dat family_berbew behavioral2/files/0x000700000002342f-24.dat family_berbew behavioral2/files/0x0007000000023430-30.dat family_berbew behavioral2/files/0x0007000000023431-36.dat family_berbew behavioral2/files/0x0007000000023432-41.dat family_berbew behavioral2/files/0x0007000000023433-47.dat family_berbew behavioral2/files/0x0007000000023434-53.dat family_berbew behavioral2/files/0x0007000000023435-59.dat family_berbew behavioral2/files/0x0007000000023436-65.dat family_berbew behavioral2/files/0x0007000000023437-70.dat family_berbew behavioral2/files/0x0007000000023438-77.dat family_berbew behavioral2/files/0x0007000000023439-82.dat family_berbew behavioral2/files/0x000700000002343a-88.dat family_berbew behavioral2/files/0x000900000002342a-93.dat family_berbew behavioral2/files/0x000700000002343b-101.dat family_berbew behavioral2/files/0x000700000002343c-105.dat family_berbew behavioral2/files/0x000700000002343d-110.dat family_berbew behavioral2/files/0x000700000002343e-116.dat family_berbew behavioral2/files/0x0007000000023440-128.dat family_berbew behavioral2/files/0x000700000002343f-123.dat family_berbew behavioral2/files/0x0007000000023441-134.dat family_berbew behavioral2/files/0x0007000000023442-140.dat family_berbew behavioral2/files/0x0007000000023443-147.dat family_berbew behavioral2/files/0x0007000000023444-153.dat family_berbew behavioral2/files/0x000b000000023398-162.dat family_berbew behavioral2/files/0x0007000000023446-169.dat family_berbew behavioral2/files/0x0007000000023448-179.dat family_berbew behavioral2/files/0x0007000000023449-187.dat family_berbew behavioral2/files/0x0007000000023447-175.dat family_berbew behavioral2/files/0x0007000000023445-157.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4908 nhbbtn.exe 2992 9btnhh.exe 3796 tnntbb.exe 3212 hnbtnn.exe 3020 7jvdp.exe 3016 flrlfll.exe 3632 lffxfff.exe 1116 rlrxlrr.exe 912 btnnbb.exe 3764 llfrlrf.exe 4892 nttnnb.exe 2608 lrlrllf.exe 3276 tbhhnt.exe 3716 ppdvv.exe 2196 vvvvd.exe 3232 xfllrxx.exe 3376 ttnttt.exe 4488 dvppp.exe 2468 3xfxxxr.exe 4608 rlrrxrl.exe 4904 pppjj.exe 4292 9pddj.exe 4260 xlrllrr.exe 1164 hhhntn.exe 3200 ppdvp.exe 5064 xfxrrll.exe 4812 ntbnnt.exe 5024 bbtnhb.exe 3820 dvvpj.exe 4304 llxxxff.exe 1372 htttbb.exe 1560 bthbtn.exe 3728 pddvp.exe 1936 xrrxrxr.exe 392 dvdpj.exe 4408 pddjv.exe 3032 lflxxff.exe 3776 hhnhbt.exe 4368 9dppd.exe 3028 fffxlff.exe 3792 nthhbn.exe 2488 9vdjd.exe 3696 7rrfxrf.exe 1556 fxlffrx.exe 3992 nnhnnn.exe 5076 dvjdj.exe 4244 dpppj.exe 2924 llfxfll.exe 216 nnhtth.exe 4040 jvddv.exe 1480 lxfrxxx.exe 4804 tbhthh.exe 4568 pjjjp.exe 724 flxxrrr.exe 4820 nhntbt.exe 408 bntnhh.exe 1804 3ppdv.exe 3708 xflrrxx.exe 3340 lfrfxrf.exe 4468 bhbhbn.exe 4412 dddvp.exe 2768 jjdvd.exe 1680 lrxrllf.exe 4852 bttnnn.exe -
resource yara_rule behavioral2/memory/4796-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0009000000023297-3.dat upx behavioral2/memory/4796-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a000000023421-9.dat upx behavioral2/files/0x000700000002342d-13.dat upx behavioral2/memory/2992-15-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3796-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4908-11-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342f-24.dat upx behavioral2/memory/3212-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023430-30.dat upx behavioral2/memory/3020-32-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023431-36.dat upx behavioral2/memory/3016-39-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-41.dat upx behavioral2/memory/3796-25-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3632-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023433-47.dat upx behavioral2/files/0x0007000000023434-53.dat upx behavioral2/memory/1116-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/912-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023435-59.dat upx behavioral2/memory/912-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3764-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023436-65.dat upx behavioral2/files/0x0007000000023437-70.dat upx behavioral2/memory/4892-72-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2608-78-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3276-80-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023438-77.dat upx behavioral2/files/0x0007000000023439-82.dat upx behavioral2/memory/3716-84-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343a-88.dat upx behavioral2/files/0x000900000002342a-93.dat upx behavioral2/memory/2196-96-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3232-98-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343b-101.dat upx behavioral2/files/0x000700000002343c-105.dat upx behavioral2/files/0x000700000002343d-110.dat upx behavioral2/memory/4488-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343e-116.dat upx behavioral2/memory/2468-118-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023440-128.dat upx behavioral2/memory/4608-125-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002343f-123.dat upx behavioral2/files/0x0007000000023441-134.dat upx behavioral2/memory/4260-141-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023442-140.dat upx behavioral2/files/0x0007000000023443-147.dat upx behavioral2/memory/1164-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023444-153.dat upx behavioral2/files/0x000b000000023398-162.dat upx behavioral2/files/0x0007000000023446-169.dat upx behavioral2/memory/3820-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023448-179.dat upx behavioral2/files/0x0007000000023449-187.dat upx behavioral2/memory/1560-191-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1936-196-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4408-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3032-208-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3776-215-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2488-226-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3992-235-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2924-248-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4908 4796 a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe 82 PID 4796 wrote to memory of 4908 4796 a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe 82 PID 4796 wrote to memory of 4908 4796 a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe 82 PID 4908 wrote to memory of 2992 4908 nhbbtn.exe 83 PID 4908 wrote to memory of 2992 4908 nhbbtn.exe 83 PID 4908 wrote to memory of 2992 4908 nhbbtn.exe 83 PID 2992 wrote to memory of 3796 2992 9btnhh.exe 84 PID 2992 wrote to memory of 3796 2992 9btnhh.exe 84 PID 2992 wrote to memory of 3796 2992 9btnhh.exe 84 PID 3796 wrote to memory of 3212 3796 tnntbb.exe 85 PID 3796 wrote to memory of 3212 3796 tnntbb.exe 85 PID 3796 wrote to memory of 3212 3796 tnntbb.exe 85 PID 3212 wrote to memory of 3020 3212 hnbtnn.exe 86 PID 3212 wrote to memory of 3020 3212 hnbtnn.exe 86 PID 3212 wrote to memory of 3020 3212 hnbtnn.exe 86 PID 3020 wrote to memory of 3016 3020 7jvdp.exe 87 PID 3020 wrote to memory of 3016 3020 7jvdp.exe 87 PID 3020 wrote to memory of 3016 3020 7jvdp.exe 87 PID 3016 wrote to memory of 3632 3016 flrlfll.exe 88 PID 3016 wrote to memory of 3632 3016 flrlfll.exe 88 PID 3016 wrote to memory of 3632 3016 flrlfll.exe 88 PID 3632 wrote to memory of 1116 3632 lffxfff.exe 89 PID 3632 wrote to memory of 1116 3632 lffxfff.exe 89 PID 3632 wrote to memory of 1116 3632 lffxfff.exe 89 PID 1116 wrote to memory of 912 1116 rlrxlrr.exe 90 PID 1116 wrote to memory of 912 1116 rlrxlrr.exe 90 PID 1116 wrote to memory of 912 1116 rlrxlrr.exe 90 PID 912 wrote to memory of 3764 912 btnnbb.exe 92 PID 912 wrote to memory of 3764 912 btnnbb.exe 92 PID 912 wrote to memory of 3764 912 btnnbb.exe 92 PID 3764 wrote to memory of 4892 3764 llfrlrf.exe 93 PID 3764 wrote to memory of 4892 3764 llfrlrf.exe 93 PID 3764 wrote to memory of 4892 3764 llfrlrf.exe 93 PID 4892 wrote to memory of 2608 4892 nttnnb.exe 196 PID 4892 wrote to memory of 2608 4892 nttnnb.exe 196 PID 4892 wrote to memory of 2608 4892 nttnnb.exe 196 PID 2608 wrote to memory of 3276 2608 lrlrllf.exe 96 PID 2608 wrote to memory of 3276 2608 lrlrllf.exe 96 PID 2608 wrote to memory of 3276 2608 lrlrllf.exe 96 PID 3276 wrote to memory of 3716 3276 tbhhnt.exe 97 PID 3276 wrote to memory of 3716 3276 tbhhnt.exe 97 PID 3276 wrote to memory of 3716 3276 tbhhnt.exe 97 PID 3716 wrote to memory of 2196 3716 ppdvv.exe 100 PID 3716 wrote to memory of 2196 3716 ppdvv.exe 100 PID 3716 wrote to memory of 2196 3716 ppdvv.exe 100 PID 2196 wrote to memory of 3232 2196 vvvvd.exe 101 PID 2196 wrote to memory of 3232 2196 vvvvd.exe 101 PID 2196 wrote to memory of 3232 2196 vvvvd.exe 101 PID 3232 wrote to memory of 3376 3232 xfllrxx.exe 102 PID 3232 wrote to memory of 3376 3232 xfllrxx.exe 102 PID 3232 wrote to memory of 3376 3232 xfllrxx.exe 102 PID 3376 wrote to memory of 4488 3376 ttnttt.exe 151 PID 3376 wrote to memory of 4488 3376 ttnttt.exe 151 PID 3376 wrote to memory of 4488 3376 ttnttt.exe 151 PID 4488 wrote to memory of 2468 4488 dvppp.exe 104 PID 4488 wrote to memory of 2468 4488 dvppp.exe 104 PID 4488 wrote to memory of 2468 4488 dvppp.exe 104 PID 2468 wrote to memory of 4608 2468 3xfxxxr.exe 105 PID 2468 wrote to memory of 4608 2468 3xfxxxr.exe 105 PID 2468 wrote to memory of 4608 2468 3xfxxxr.exe 105 PID 4608 wrote to memory of 4904 4608 rlrrxrl.exe 106 PID 4608 wrote to memory of 4904 4608 rlrrxrl.exe 106 PID 4608 wrote to memory of 4904 4608 rlrrxrl.exe 106 PID 4904 wrote to memory of 4292 4904 pppjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a881ad63ac1ff75962efc36765437570_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\nhbbtn.exec:\nhbbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\9btnhh.exec:\9btnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\tnntbb.exec:\tnntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\hnbtnn.exec:\hnbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\7jvdp.exec:\7jvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\flrlfll.exec:\flrlfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lffxfff.exec:\lffxfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\rlrxlrr.exec:\rlrxlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\btnnbb.exec:\btnnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\llfrlrf.exec:\llfrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\nttnnb.exec:\nttnnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\lrlrllf.exec:\lrlrllf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tbhhnt.exec:\tbhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\ppdvv.exec:\ppdvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\vvvvd.exec:\vvvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\xfllrxx.exec:\xfllrxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\ttnttt.exec:\ttnttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\dvppp.exec:\dvppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\3xfxxxr.exec:\3xfxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\rlrrxrl.exec:\rlrrxrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\pppjj.exec:\pppjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\9pddj.exec:\9pddj.exe23⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xlrllrr.exec:\xlrllrr.exe24⤵
- Executes dropped EXE
PID:4260 -
\??\c:\hhhntn.exec:\hhhntn.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ppdvp.exec:\ppdvp.exe26⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xfxrrll.exec:\xfxrrll.exe27⤵
- Executes dropped EXE
PID:5064 -
\??\c:\ntbnnt.exec:\ntbnnt.exe28⤵
- Executes dropped EXE
PID:4812 -
\??\c:\bbtnhb.exec:\bbtnhb.exe29⤵
- Executes dropped EXE
PID:5024 -
\??\c:\dvvpj.exec:\dvvpj.exe30⤵
- Executes dropped EXE
PID:3820 -
\??\c:\llxxxff.exec:\llxxxff.exe31⤵
- Executes dropped EXE
PID:4304 -
\??\c:\htttbb.exec:\htttbb.exe32⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bthbtn.exec:\bthbtn.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pddvp.exec:\pddvp.exe34⤵
- Executes dropped EXE
PID:3728 -
\??\c:\xrrxrxr.exec:\xrrxrxr.exe35⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvdpj.exec:\dvdpj.exe36⤵
- Executes dropped EXE
PID:392 -
\??\c:\pddjv.exec:\pddjv.exe37⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lflxxff.exec:\lflxxff.exe38⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hhnhbt.exec:\hhnhbt.exe39⤵
- Executes dropped EXE
PID:3776 -
\??\c:\9dppd.exec:\9dppd.exe40⤵
- Executes dropped EXE
PID:4368 -
\??\c:\fffxlff.exec:\fffxlff.exe41⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nthhbn.exec:\nthhbn.exe42⤵
- Executes dropped EXE
PID:3792 -
\??\c:\9vdjd.exec:\9vdjd.exe43⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7rrfxrf.exec:\7rrfxrf.exe44⤵
- Executes dropped EXE
PID:3696 -
\??\c:\fxlffrx.exec:\fxlffrx.exe45⤵
- Executes dropped EXE
PID:1556 -
\??\c:\nnhnnn.exec:\nnhnnn.exe46⤵
- Executes dropped EXE
PID:3992 -
\??\c:\dvjdj.exec:\dvjdj.exe47⤵
- Executes dropped EXE
PID:5076 -
\??\c:\dpppj.exec:\dpppj.exe48⤵
- Executes dropped EXE
PID:4244 -
\??\c:\llfxfll.exec:\llfxfll.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nnhtth.exec:\nnhtth.exe50⤵
- Executes dropped EXE
PID:216 -
\??\c:\jvddv.exec:\jvddv.exe51⤵
- Executes dropped EXE
PID:4040 -
\??\c:\lxfrxxx.exec:\lxfrxxx.exe52⤵
- Executes dropped EXE
PID:1480 -
\??\c:\tbhthh.exec:\tbhthh.exe53⤵
- Executes dropped EXE
PID:4804 -
\??\c:\pjjjp.exec:\pjjjp.exe54⤵
- Executes dropped EXE
PID:4568 -
\??\c:\flxxrrr.exec:\flxxrrr.exe55⤵
- Executes dropped EXE
PID:724 -
\??\c:\nhntbt.exec:\nhntbt.exe56⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bntnhh.exec:\bntnhh.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\3ppdv.exec:\3ppdv.exe58⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xflrrxx.exec:\xflrrxx.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\lfrfxrf.exec:\lfrfxrf.exe60⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bhbhbn.exec:\bhbhbn.exe61⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dddvp.exec:\dddvp.exe62⤵
- Executes dropped EXE
PID:4412 -
\??\c:\jjdvd.exec:\jjdvd.exe63⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lrxrllf.exec:\lrxrllf.exe64⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bttnnn.exec:\bttnnn.exe65⤵
- Executes dropped EXE
PID:4852 -
\??\c:\7bnhtn.exec:\7bnhtn.exe66⤵PID:5096
-
\??\c:\jjppv.exec:\jjppv.exe67⤵PID:4488
-
\??\c:\1pdvj.exec:\1pdvj.exe68⤵PID:1880
-
\??\c:\fllfffr.exec:\fllfffr.exe69⤵PID:1584
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe70⤵PID:4444
-
\??\c:\bnhhth.exec:\bnhhth.exe71⤵PID:1452
-
\??\c:\7jpdv.exec:\7jpdv.exe72⤵PID:4936
-
\??\c:\pdvjv.exec:\pdvjv.exe73⤵PID:1172
-
\??\c:\5lrlffr.exec:\5lrlffr.exe74⤵PID:1520
-
\??\c:\httnnb.exec:\httnnb.exe75⤵PID:3876
-
\??\c:\vvddj.exec:\vvddj.exe76⤵PID:3548
-
\??\c:\pvdvp.exec:\pvdvp.exe77⤵PID:3308
-
\??\c:\frxfxxx.exec:\frxfxxx.exe78⤵PID:1612
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe79⤵PID:1852
-
\??\c:\ntbnht.exec:\ntbnht.exe80⤵PID:1636
-
\??\c:\pvpvd.exec:\pvpvd.exe81⤵PID:2396
-
\??\c:\pjvpd.exec:\pjvpd.exe82⤵PID:2744
-
\??\c:\rfxxlfr.exec:\rfxxlfr.exe83⤵PID:2080
-
\??\c:\llrxlxl.exec:\llrxlxl.exe84⤵PID:1372
-
\??\c:\tbthnn.exec:\tbthnn.exe85⤵PID:936
-
\??\c:\dpvpj.exec:\dpvpj.exe86⤵PID:2152
-
\??\c:\rfrrxrr.exec:\rfrrxrr.exe87⤵PID:5088
-
\??\c:\lxxllff.exec:\lxxllff.exe88⤵PID:728
-
\??\c:\bbbhhb.exec:\bbbhhb.exe89⤵PID:4560
-
\??\c:\7dppj.exec:\7dppj.exe90⤵PID:400
-
\??\c:\9ddpv.exec:\9ddpv.exe91⤵PID:716
-
\??\c:\flrlrlx.exec:\flrlrlx.exe92⤵PID:3784
-
\??\c:\nnhbth.exec:\nnhbth.exe93⤵PID:4360
-
\??\c:\nbhnnb.exec:\nbhnnb.exe94⤵PID:3380
-
\??\c:\5xxxxff.exec:\5xxxxff.exe95⤵PID:860
-
\??\c:\3hhbtt.exec:\3hhbtt.exe96⤵PID:3792
-
\??\c:\pjppj.exec:\pjppj.exe97⤵PID:796
-
\??\c:\rrrrlll.exec:\rrrrlll.exe98⤵PID:2980
-
\??\c:\1ntnhh.exec:\1ntnhh.exe99⤵PID:1416
-
\??\c:\nthnnt.exec:\nthnnt.exe100⤵PID:1260
-
\??\c:\vdvvp.exec:\vdvvp.exe101⤵PID:3016
-
\??\c:\pdpvj.exec:\pdpvj.exe102⤵PID:1112
-
\??\c:\rrxfrrr.exec:\rrxfrrr.exe103⤵PID:5084
-
\??\c:\hnbhbt.exec:\hnbhbt.exe104⤵PID:4040
-
\??\c:\nthhnh.exec:\nthhnh.exe105⤵PID:1792
-
\??\c:\djjpv.exec:\djjpv.exe106⤵PID:4992
-
\??\c:\fxxrlff.exec:\fxxrlff.exe107⤵PID:1904
-
\??\c:\lrffffl.exec:\lrffffl.exe108⤵PID:856
-
\??\c:\ntntht.exec:\ntntht.exe109⤵PID:4604
-
\??\c:\pjdvd.exec:\pjdvd.exe110⤵PID:2608
-
\??\c:\rfxfffx.exec:\rfxfffx.exe111⤵PID:4704
-
\??\c:\lxxfllf.exec:\lxxfllf.exe112⤵PID:4552
-
\??\c:\hbntth.exec:\hbntth.exe113⤵PID:4496
-
\??\c:\dddjd.exec:\dddjd.exe114⤵PID:4648
-
\??\c:\pjvvp.exec:\pjvvp.exe115⤵PID:5036
-
\??\c:\fxrfrfl.exec:\fxrfrfl.exe116⤵PID:2292
-
\??\c:\bnbntn.exec:\bnbntn.exe117⤵PID:4752
-
\??\c:\ntbbhh.exec:\ntbbhh.exe118⤵PID:3616
-
\??\c:\5vdvp.exec:\5vdvp.exe119⤵PID:4860
-
\??\c:\llfxrrr.exec:\llfxrrr.exe120⤵PID:1600
-
\??\c:\rrrrxxl.exec:\rrrrxxl.exe121⤵PID:464
-
\??\c:\thbtnb.exec:\thbtnb.exe122⤵PID:4436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-