Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 04:57
Behavioral task
behavioral1
Sample
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe
-
Size
487KB
-
MD5
2fa6fa1228e96b55b3ad77a8c627b850
-
SHA1
08a12fcd0d22ba7f243d387029d64f1ef06b3c23
-
SHA256
ae81795b2be121ba562b640838cd646bc366d21410a73c662163a261c97dcd6d
-
SHA512
dbd23abf81e652a75972faa628745632ade5821a59eba7a71f9af1ba204651b01c292812d18c814888225b2476cb0683f4869d2323de8db91161a162ba6c2f8b
-
SSDEEP
6144:mcm7ImGddXv/VWrXD486jCpoAhlq1mEjBqLyOSlhNFF23yL:I7TcfNWj168w1VjsyvhNFF2iL
Malware Config
Signatures
-
Detect Blackmoon payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2156-7-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2604-17-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2540-27-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2624-39-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2584-64-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2424-66-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2956-75-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1892-92-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2744-102-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1912-128-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1896-139-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2300-137-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2480-155-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/360-233-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2488-363-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1672-417-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1672-425-0x0000000000220000-0x000000000024E000-memory.dmp family_blackmoon behavioral1/memory/2472-457-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/776-502-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1044-532-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1624-558-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2484-653-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2684-391-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2180-371-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2516-335-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1528-308-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/872-294-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2192-284-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/992-260-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2236-195-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/1440-174-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2824-892-0x00000000005C0000-0x00000000005EE000-memory.dmp family_blackmoon behavioral1/memory/2824-895-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2688-944-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon behavioral1/memory/2656-1054-0x0000000000400000-0x000000000042E000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\1hbbnn.exe family_berbew C:\xxxxllx.exe family_berbew C:\5btttt.exe family_berbew C:\fxlxlxf.exe family_berbew \??\c:\bnthtb.exe family_berbew C:\3jdvv.exe family_berbew C:\xfxxrxr.exe family_berbew \??\c:\5bbtbb.exe family_berbew \??\c:\vpjvd.exe family_berbew \??\c:\jvppv.exe family_berbew \??\c:\jvdvp.exe family_berbew \??\c:\bbtbhn.exe family_berbew C:\bthnhh.exe family_berbew C:\ppjvj.exe family_berbew \??\c:\hnhthn.exe family_berbew C:\1tntnh.exe family_berbew \??\c:\3xlxxxl.exe family_berbew \??\c:\rfffrxl.exe family_berbew \??\c:\jvjpj.exe family_berbew \??\c:\xxxxllx.exe family_berbew C:\9lffrrf.exe family_berbew \??\c:\5bhbhh.exe family_berbew \??\c:\dvvvv.exe family_berbew \??\c:\ffflrfr.exe family_berbew \??\c:\nbtbhh.exe family_berbew C:\vpvdj.exe family_berbew C:\5pjpv.exe family_berbew C:\3ttntt.exe family_berbew \??\c:\ddddj.exe family_berbew C:\lflxlrf.exe family_berbew \??\c:\thbhhn.exe family_berbew \??\c:\rlflxfl.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
1hbbnn.exexxxxllx.exe5btttt.exefxlxlxf.exebnthtb.exe3jdvv.exexfxxrxr.exe5bbtbb.exevpjvd.exebbtbhn.exejvppv.exejvdvp.exebthnhh.exeppjvj.exehnhthn.exe1tntnh.exe3xlxxxl.exerfffrxl.exejvjpj.exexxxxllx.exe9lffrrf.exe5bhbhh.exedvvvv.exerlflxfl.exethbhhn.exedvvvv.exeffflrfr.exenbtbhh.exevpvdj.exe5pjpv.exe3ttntt.exeddddj.exelflxlrf.exe7tnhhn.exentntnn.exepdvjd.exexrflxfr.exexrfflrx.exethtttt.exejdpvj.exe3rfflxl.exehbttbb.exedvvjp.exevjjpd.exexxlrflr.exehthnbt.exe7hhhtt.exe3pjdp.exe1rlrflx.exexrlrffl.exehhbtbb.exevpjvj.exe9ddjv.exelfxrflr.exettbthb.exethbbnn.exevpvpd.exejpdjv.exe3lxxxfl.exetbbbnt.exetbtthn.exevdvpd.exerlxlrrf.exe9xllxxl.exepid process 2604 1hbbnn.exe 2540 xxxxllx.exe 2624 5btttt.exe 2708 fxlxlxf.exe 2440 bnthtb.exe 2584 3jdvv.exe 2424 xfxxrxr.exe 2956 5bbtbb.exe 1892 vpjvd.exe 2744 bbtbhn.exe 2500 jvppv.exe 2936 jvdvp.exe 1912 bthnhh.exe 2300 ppjvj.exe 1896 hnhthn.exe 2480 1tntnh.exe 1464 3xlxxxl.exe 1440 rfffrxl.exe 2260 jvjpj.exe 2204 xxxxllx.exe 2236 9lffrrf.exe 988 5bhbhh.exe 2592 dvvvv.exe 1724 rlflxfl.exe 360 thbhhn.exe 1992 dvvvv.exe 1648 ffflrfr.exe 992 nbtbhh.exe 1200 vpvdj.exe 1624 5pjpv.exe 2192 3ttntt.exe 872 ddddj.exe 2148 lflxlrf.exe 2136 7tnhhn.exe 1528 ntntnn.exe 3016 pdvjd.exe 2992 xrflxfr.exe 2516 xrfflrx.exe 2732 thtttt.exe 1312 jdpvj.exe 2576 3rfflxl.exe 2524 hbttbb.exe 2488 dvvjp.exe 2180 vjjpd.exe 2956 xxlrflr.exe 2916 hthnbt.exe 2684 7hhhtt.exe 2808 3pjdp.exe 352 1rlrflx.exe 1696 xrlrffl.exe 1672 hhbtbb.exe 380 vpjvj.exe 2932 9ddjv.exe 764 lfxrflr.exe 1592 ttbthb.exe 1540 thbbnn.exe 2472 vpvpd.exe 2248 jpdjv.exe 2260 3lxxxfl.exe 2852 tbbbnt.exe 1072 tbtthn.exe 988 vdvpd.exe 2088 rlxlrrf.exe 776 9xllxxl.exe -
Processes:
resource yara_rule behavioral1/memory/2156-0-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2156-7-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2604-17-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2624-30-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2624-39-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2584-64-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2424-66-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2956-75-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1892-83-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1892-92-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2744-102-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1912-119-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1912-128-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2744-93-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1896-139-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2300-137-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2480-155-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1440-164-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1724-221-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/360-233-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2516-327-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2488-363-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1672-417-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2472-457-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2260-470-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/776-502-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1044-532-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1624-558-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2012-759-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/336-797-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/684-823-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2184-830-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2608-684-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2484-653-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2440-628-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2708-621-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1528-590-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2684-391-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2180-371-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2516-335-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1528-308-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/872-294-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/872-286-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2192-284-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/992-260-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/992-251-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1648-242-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/360-230-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2236-195-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2204-183-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1440-174-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2040-875-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2824-892-0x00000000005C0000-0x00000000005EE000-memory.dmp upx behavioral1/memory/2824-895-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2688-944-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1404-945-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2772-953-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2808-966-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2936-979-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/1504-1005-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2656-1054-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe1hbbnn.exexxxxllx.exe5btttt.exefxlxlxf.exebnthtb.exe3jdvv.exexfxxrxr.exe5bbtbb.exevpjvd.exebbtbhn.exejvppv.exejvdvp.exebthnhh.exeppjvj.exehnhthn.exedescription pid process target process PID 2156 wrote to memory of 2604 2156 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe 1hbbnn.exe PID 2156 wrote to memory of 2604 2156 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe 1hbbnn.exe PID 2156 wrote to memory of 2604 2156 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe 1hbbnn.exe PID 2156 wrote to memory of 2604 2156 2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe 1hbbnn.exe PID 2604 wrote to memory of 2540 2604 1hbbnn.exe xxxxllx.exe PID 2604 wrote to memory of 2540 2604 1hbbnn.exe xxxxllx.exe PID 2604 wrote to memory of 2540 2604 1hbbnn.exe xxxxllx.exe PID 2604 wrote to memory of 2540 2604 1hbbnn.exe xxxxllx.exe PID 2540 wrote to memory of 2624 2540 xxxxllx.exe 5btttt.exe PID 2540 wrote to memory of 2624 2540 xxxxllx.exe 5btttt.exe PID 2540 wrote to memory of 2624 2540 xxxxllx.exe 5btttt.exe PID 2540 wrote to memory of 2624 2540 xxxxllx.exe 5btttt.exe PID 2624 wrote to memory of 2708 2624 5btttt.exe fllxfrf.exe PID 2624 wrote to memory of 2708 2624 5btttt.exe fllxfrf.exe PID 2624 wrote to memory of 2708 2624 5btttt.exe fllxfrf.exe PID 2624 wrote to memory of 2708 2624 5btttt.exe fllxfrf.exe PID 2708 wrote to memory of 2440 2708 fxlxlxf.exe hbttbh.exe PID 2708 wrote to memory of 2440 2708 fxlxlxf.exe hbttbh.exe PID 2708 wrote to memory of 2440 2708 fxlxlxf.exe hbttbh.exe PID 2708 wrote to memory of 2440 2708 fxlxlxf.exe hbttbh.exe PID 2440 wrote to memory of 2584 2440 bnthtb.exe vpjpd.exe PID 2440 wrote to memory of 2584 2440 bnthtb.exe vpjpd.exe PID 2440 wrote to memory of 2584 2440 bnthtb.exe vpjpd.exe PID 2440 wrote to memory of 2584 2440 bnthtb.exe vpjpd.exe PID 2584 wrote to memory of 2424 2584 3jdvv.exe xfxxrxr.exe PID 2584 wrote to memory of 2424 2584 3jdvv.exe xfxxrxr.exe PID 2584 wrote to memory of 2424 2584 3jdvv.exe xfxxrxr.exe PID 2584 wrote to memory of 2424 2584 3jdvv.exe xfxxrxr.exe PID 2424 wrote to memory of 2956 2424 xfxxrxr.exe xxlrflr.exe PID 2424 wrote to memory of 2956 2424 xfxxrxr.exe xxlrflr.exe PID 2424 wrote to memory of 2956 2424 xfxxrxr.exe xxlrflr.exe PID 2424 wrote to memory of 2956 2424 xfxxrxr.exe xxlrflr.exe PID 2956 wrote to memory of 1892 2956 5bbtbb.exe vpjvd.exe PID 2956 wrote to memory of 1892 2956 5bbtbb.exe vpjvd.exe PID 2956 wrote to memory of 1892 2956 5bbtbb.exe vpjvd.exe PID 2956 wrote to memory of 1892 2956 5bbtbb.exe vpjvd.exe PID 1892 wrote to memory of 2744 1892 vpjvd.exe bbtbhn.exe PID 1892 wrote to memory of 2744 1892 vpjvd.exe bbtbhn.exe PID 1892 wrote to memory of 2744 1892 vpjvd.exe bbtbhn.exe PID 1892 wrote to memory of 2744 1892 vpjvd.exe bbtbhn.exe PID 2744 wrote to memory of 2500 2744 bbtbhn.exe jvppv.exe PID 2744 wrote to memory of 2500 2744 bbtbhn.exe jvppv.exe PID 2744 wrote to memory of 2500 2744 bbtbhn.exe jvppv.exe PID 2744 wrote to memory of 2500 2744 bbtbhn.exe jvppv.exe PID 2500 wrote to memory of 2936 2500 jvppv.exe nhbhnn.exe PID 2500 wrote to memory of 2936 2500 jvppv.exe nhbhnn.exe PID 2500 wrote to memory of 2936 2500 jvppv.exe nhbhnn.exe PID 2500 wrote to memory of 2936 2500 jvppv.exe nhbhnn.exe PID 2936 wrote to memory of 1912 2936 jvdvp.exe bthnhh.exe PID 2936 wrote to memory of 1912 2936 jvdvp.exe bthnhh.exe PID 2936 wrote to memory of 1912 2936 jvdvp.exe bthnhh.exe PID 2936 wrote to memory of 1912 2936 jvdvp.exe bthnhh.exe PID 1912 wrote to memory of 2300 1912 bthnhh.exe ppjvj.exe PID 1912 wrote to memory of 2300 1912 bthnhh.exe ppjvj.exe PID 1912 wrote to memory of 2300 1912 bthnhh.exe ppjvj.exe PID 1912 wrote to memory of 2300 1912 bthnhh.exe ppjvj.exe PID 2300 wrote to memory of 1896 2300 ppjvj.exe hnhthn.exe PID 2300 wrote to memory of 1896 2300 ppjvj.exe hnhthn.exe PID 2300 wrote to memory of 1896 2300 ppjvj.exe hnhthn.exe PID 2300 wrote to memory of 1896 2300 ppjvj.exe hnhthn.exe PID 1896 wrote to memory of 2480 1896 hnhthn.exe 1tntnh.exe PID 1896 wrote to memory of 2480 1896 hnhthn.exe 1tntnh.exe PID 1896 wrote to memory of 2480 1896 hnhthn.exe 1tntnh.exe PID 1896 wrote to memory of 2480 1896 hnhthn.exe 1tntnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2fa6fa1228e96b55b3ad77a8c627b850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\1hbbnn.exec:\1hbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xxxxllx.exec:\xxxxllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5btttt.exec:\5btttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fxlxlxf.exec:\fxlxlxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bnthtb.exec:\bnthtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\3jdvv.exec:\3jdvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\xfxxrxr.exec:\xfxxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5bbtbb.exec:\5bbtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\vpjvd.exec:\vpjvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\bbtbhn.exec:\bbtbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jvppv.exec:\jvppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jvdvp.exec:\jvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bthnhh.exec:\bthnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\ppjvj.exec:\ppjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\hnhthn.exec:\hnhthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\1tntnh.exec:\1tntnh.exe17⤵
- Executes dropped EXE
PID:2480 -
\??\c:\3xlxxxl.exec:\3xlxxxl.exe18⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rfffrxl.exec:\rfffrxl.exe19⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jvjpj.exec:\jvjpj.exe20⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxxxllx.exec:\xxxxllx.exe21⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9lffrrf.exec:\9lffrrf.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5bhbhh.exec:\5bhbhh.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\dvvvv.exec:\dvvvv.exe24⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rlflxfl.exec:\rlflxfl.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thbhhn.exec:\thbhhn.exe26⤵
- Executes dropped EXE
PID:360 -
\??\c:\dvvvv.exec:\dvvvv.exe27⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ffflrfr.exec:\ffflrfr.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\nbtbhh.exec:\nbtbhh.exe29⤵
- Executes dropped EXE
PID:992 -
\??\c:\vpvdj.exec:\vpvdj.exe30⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5pjpv.exec:\5pjpv.exe31⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3ttntt.exec:\3ttntt.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\ddddj.exec:\ddddj.exe33⤵
- Executes dropped EXE
PID:872 -
\??\c:\lflxlrf.exec:\lflxlrf.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7tnhhn.exec:\7tnhhn.exe35⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ntntnn.exec:\ntntnn.exe36⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pdvjd.exec:\pdvjd.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xrflxfr.exec:\xrflxfr.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xrfflrx.exec:\xrfflrx.exe39⤵
- Executes dropped EXE
PID:2516 -
\??\c:\thtttt.exec:\thtttt.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jdpvj.exec:\jdpvj.exe41⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3rfflxl.exec:\3rfflxl.exe42⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbttbb.exec:\hbttbb.exe43⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dvvjp.exec:\dvvjp.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vjjpd.exec:\vjjpd.exe45⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxlrflr.exec:\xxlrflr.exe46⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hthnbt.exec:\hthnbt.exe47⤵
- Executes dropped EXE
PID:2916 -
\??\c:\7hhhtt.exec:\7hhhtt.exe48⤵
- Executes dropped EXE
PID:2684 -
\??\c:\3pjdp.exec:\3pjdp.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1rlrflx.exec:\1rlrflx.exe50⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrlrffl.exec:\xrlrffl.exe51⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hhbtbb.exec:\hhbtbb.exe52⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vpjvj.exec:\vpjvj.exe53⤵
- Executes dropped EXE
PID:380 -
\??\c:\9ddjv.exec:\9ddjv.exe54⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfxrflr.exec:\lfxrflr.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\ttbthb.exec:\ttbthb.exe56⤵
- Executes dropped EXE
PID:1592 -
\??\c:\thbbnn.exec:\thbbnn.exe57⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpvpd.exec:\vpvpd.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jpdjv.exec:\jpdjv.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3lxxxfl.exec:\3lxxxfl.exe60⤵
- Executes dropped EXE
PID:2260 -
\??\c:\tbbbnt.exec:\tbbbnt.exe61⤵
- Executes dropped EXE
PID:2852 -
\??\c:\tbtthn.exec:\tbtthn.exe62⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vdvpd.exec:\vdvpd.exe63⤵
- Executes dropped EXE
PID:988 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe64⤵
- Executes dropped EXE
PID:2088 -
\??\c:\9xllxxl.exec:\9xllxxl.exe65⤵
- Executes dropped EXE
PID:776 -
\??\c:\hhbthn.exec:\hhbthn.exe66⤵PID:2240
-
\??\c:\1pppd.exec:\1pppd.exe67⤵PID:1244
-
\??\c:\jvjjp.exec:\jvjjp.exe68⤵PID:1044
-
\??\c:\fffxrff.exec:\fffxrff.exe69⤵PID:884
-
\??\c:\hhhtnh.exec:\hhhtnh.exe70⤵PID:1740
-
\??\c:\tnhnbb.exec:\tnhnbb.exe71⤵PID:1200
-
\??\c:\dvppd.exec:\dvppd.exe72⤵PID:1624
-
\??\c:\rrfllfr.exec:\rrfllfr.exe73⤵PID:2380
-
\??\c:\rlflrxl.exec:\rlflrxl.exe74⤵PID:1420
-
\??\c:\nhtnbb.exec:\nhtnbb.exe75⤵PID:1728
-
\??\c:\dvvvj.exec:\dvvvj.exe76⤵PID:2504
-
\??\c:\djjpd.exec:\djjpd.exe77⤵PID:2816
-
\??\c:\3frrlxf.exec:\3frrlxf.exe78⤵PID:1528
-
\??\c:\3bnnbb.exec:\3bnnbb.exe79⤵PID:2568
-
\??\c:\tttbhb.exec:\tttbhb.exe80⤵PID:2648
-
\??\c:\ppvdd.exec:\ppvdd.exe81⤵PID:560
-
\??\c:\xxrxffr.exec:\xxrxffr.exe82⤵PID:2016
-
\??\c:\fllxfrf.exec:\fllxfrf.exe83⤵PID:2708
-
\??\c:\hbttbh.exec:\hbttbh.exe84⤵PID:2440
-
\??\c:\nhnhnn.exec:\nhnhnn.exe85⤵PID:2724
-
\??\c:\vpjpd.exec:\vpjpd.exe86⤵PID:2584
-
\??\c:\3vpdj.exec:\3vpdj.exe87⤵PID:2464
-
\??\c:\xrxffff.exec:\xrxffff.exe88⤵PID:2484
-
\??\c:\3hhnhn.exec:\3hhnhn.exe89⤵PID:2668
-
\??\c:\thbbhh.exec:\thbbhh.exe90⤵PID:2788
-
\??\c:\jdpdp.exec:\jdpdp.exe91⤵PID:2916
-
\??\c:\9jpjj.exec:\9jpjj.exe92⤵PID:108
-
\??\c:\9fxfllx.exec:\9fxfllx.exe93⤵PID:2608
-
\??\c:\nhbhnn.exec:\nhbhnn.exe94⤵PID:2936
-
\??\c:\ttnnbh.exec:\ttnnbh.exe95⤵PID:2132
-
\??\c:\jdpvp.exec:\jdpvp.exe96⤵PID:2296
-
\??\c:\lfxffxl.exec:\lfxffxl.exe97⤵PID:1360
-
\??\c:\lxrxxxf.exec:\lxrxxxf.exe98⤵PID:1896
-
\??\c:\bthtnt.exec:\bthtnt.exe99⤵PID:1588
-
\??\c:\nhbbhn.exec:\nhbbhn.exe100⤵PID:2400
-
\??\c:\jjdjp.exec:\jjdjp.exe101⤵PID:2196
-
\??\c:\jjddp.exec:\jjddp.exe102⤵PID:1888
-
\??\c:\llxlxxl.exec:\llxlxxl.exe103⤵PID:2472
-
\??\c:\tnhbnn.exec:\tnhbnn.exe104⤵PID:2224
-
\??\c:\5tnbbb.exec:\5tnbbb.exe105⤵PID:2012
-
\??\c:\jjddp.exec:\jjddp.exe106⤵PID:788
-
\??\c:\vjjjp.exec:\vjjjp.exe107⤵PID:1616
-
\??\c:\5xxfxfr.exec:\5xxfxfr.exe108⤵PID:1984
-
\??\c:\hhbhth.exec:\hhbhth.exe109⤵PID:1596
-
\??\c:\hthhnn.exec:\hthhnn.exe110⤵PID:776
-
\??\c:\5jvpp.exec:\5jvpp.exe111⤵PID:336
-
\??\c:\pjjjv.exec:\pjjjv.exe112⤵PID:952
-
\??\c:\rlflrrl.exec:\rlflrrl.exe113⤵PID:852
-
\??\c:\bnbtbh.exec:\bnbtbh.exe114⤵PID:884
-
\??\c:\btntnt.exec:\btntnt.exe115⤵PID:684
-
\??\c:\5jjpd.exec:\5jjpd.exe116⤵PID:2184
-
\??\c:\xxxffrr.exec:\xxxffrr.exe117⤵PID:1424
-
\??\c:\thhtbh.exec:\thhtbh.exe118⤵PID:1884
-
\??\c:\ppdvp.exec:\ppdvp.exe119⤵PID:2216
-
\??\c:\frfflfr.exec:\frfflfr.exe120⤵PID:1012
-
\??\c:\3nhhnh.exec:\3nhhnh.exe121⤵PID:2136
-
\??\c:\dvjjv.exec:\dvjjv.exe122⤵PID:2004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-