Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-06-2024 21:06
Behavioral task
behavioral1
Sample
0318417706053ef922735e72173eff80_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
0318417706053ef922735e72173eff80_NeikiAnalytics.exe
-
Size
313KB
-
MD5
0318417706053ef922735e72173eff80
-
SHA1
7b3fbfdfb5e9abb26201e5729064d2e047cb693e
-
SHA256
2533c02a1150c86916fa9eebdbeca0b2109b58fc9c29ad8c74f3a12f37965bd8
-
SHA512
59470003bb370ece49581b34935fdb6ddfeaba677a056de29e841a13051251408b53796b029b7604ed90c157b8e67baef0a2745179b9b61d27c96e1dbdfba2ea
-
SSDEEP
6144:/cm4FmowdHoSyZuo3F2Y9iE9MAkOCOu0EajNVBZr6y2Wff:N4wFHoSMu49P9mif
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2856-1-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2508-10-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2332-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2568-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2572-52-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2540-73-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2452-71-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/3032-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1300-90-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2608-101-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/612-129-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2824-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1540-162-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2988-175-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1104-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2368-228-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1604-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2860-286-0x0000000000260000-0x0000000000296000-memory.dmp family_blackmoon behavioral1/memory/1512-294-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/852-293-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1728-307-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1520-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2712-354-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2580-361-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2476-375-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1824-466-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2996-485-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1136-528-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1516-592-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/892-599-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/892-600-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2340-625-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-663-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2476-683-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2516-702-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2024-992-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1776-1017-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2856-1-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\00408.exe family_berbew behavioral1/memory/2508-10-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2508-12-0x00000000002B0000-0x00000000002E6000-memory.dmp family_berbew \??\c:\llrxxfr.exe family_berbew behavioral1/memory/2332-20-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\vvjvd.exe family_berbew behavioral1/memory/2568-29-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\080022.exe family_berbew C:\080240.exe family_berbew behavioral1/memory/2572-44-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2572-52-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\pvvpp.exe family_berbew \??\c:\7xflfrf.exe family_berbew behavioral1/memory/2452-62-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\xrxxxxf.exe family_berbew behavioral1/memory/2540-73-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2452-71-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\48264.exe family_berbew behavioral1/memory/3032-92-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\lxrxflx.exe family_berbew behavioral1/memory/1300-90-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2608-101-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\602866.exe family_berbew C:\1hthnn.exe family_berbew C:\nhtthh.exe family_berbew behavioral1/memory/2824-117-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/612-129-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\26402.exe family_berbew behavioral1/memory/2824-126-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\6080806.exe family_berbew \??\c:\882800.exe family_berbew C:\m6086.exe family_berbew C:\lflflff.exe family_berbew behavioral1/memory/1540-162-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\604266.exe family_berbew behavioral1/memory/2988-175-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\3jdpv.exe family_berbew C:\nnhhtb.exe family_berbew \??\c:\9bhttb.exe family_berbew C:\1vpdp.exe family_berbew C:\04802.exe family_berbew behavioral1/memory/1104-209-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\dvjpd.exe family_berbew \??\c:\66428.exe family_berbew behavioral1/memory/2368-228-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\i622280.exe family_berbew behavioral1/memory/2076-236-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew \??\c:\g8624.exe family_berbew C:\5nhhhn.exe family_berbew C:\jjppd.exe family_berbew behavioral1/memory/1604-262-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew C:\60846.exe family_berbew C:\pppdp.exe family_berbew behavioral1/memory/2860-286-0x0000000000260000-0x0000000000296000-memory.dmp family_berbew behavioral1/memory/1512-294-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/852-293-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1728-307-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/1520-327-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2764-329-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2712-354-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2580-361-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2476-375-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew behavioral1/memory/2484-383-0x0000000000400000-0x0000000000436000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
00408.exellrxxfr.exe080022.exevvjvd.exe080240.exe7xflfrf.exepvvpp.exexrxxxxf.exe48264.exelxrxflx.exe602866.exe1hthnn.exenhtthh.exe26402.exe6080806.exe882800.exem6086.exelflflff.exe604266.exe3jdpv.exennhhtb.exe9bhttb.exe1vpdp.exe04802.exedvjpd.exe66428.exei622280.exeg8624.exe5nhhhn.exejjppd.exe60846.exepppdp.exedvjjp.exec422446.exerlxfrrf.exee48466.exe88482.exeo602402.exe4240608.exe084800.exennhnbt.exedjpjv.exem0846.exedvpvp.exenbnntn.exe22266.exentttbt.exe82624.exe3djpd.exevdjdj.exeffrlrfl.exea2488.exe042840.exehbtthh.exevpdjv.exevpddp.exerffflrl.exe602486.exelxlrflx.exe2022028.exe826800.exe5pdpd.exe1nbtht.exevjdjp.exepid process 2508 00408.exe 2332 llrxxfr.exe 2568 080022.exe 2724 vvjvd.exe 2572 080240.exe 2544 7xflfrf.exe 2452 pvvpp.exe 2540 xrxxxxf.exe 1300 48264.exe 3032 lxrxflx.exe 2608 602866.exe 2784 1hthnn.exe 2824 nhtthh.exe 612 26402.exe 1788 6080806.exe 2660 882800.exe 1616 m6086.exe 1540 lflflff.exe 2988 604266.exe 2848 3jdpv.exe 2680 nnhhtb.exe 1364 9bhttb.exe 1104 1vpdp.exe 1480 04802.exe 2960 dvjpd.exe 2368 66428.exe 2076 i622280.exe 1388 g8624.exe 1324 5nhhhn.exe 1604 jjppd.exe 916 60846.exe 2860 pppdp.exe 852 dvjjp.exe 1512 c422446.exe 1760 rlxfrrf.exe 1728 e48466.exe 1600 88482.exe 1520 o602402.exe 2764 4240608.exe 2568 084800.exe 2880 nnhnbt.exe 2712 djpjv.exe 2580 m0846.exe 2744 dvpvp.exe 2820 nbnntn.exe 2476 22266.exe 2484 ntttbt.exe 2444 82624.exe 2260 3djpd.exe 2664 vdjdj.exe 2800 ffrlrfl.exe 2636 a2488.exe 1904 042840.exe 1352 hbtthh.exe 612 vpdjv.exe 2000 vpddp.exe 2668 rffflrl.exe 3000 602486.exe 1672 lxlrflx.exe 1824 2022028.exe 3012 826800.exe 2996 5pdpd.exe 2848 1nbtht.exe 384 vjdjp.exe -
Processes:
resource yara_rule behavioral1/memory/2856-1-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\00408.exe upx behavioral1/memory/2508-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2508-12-0x00000000002B0000-0x00000000002E6000-memory.dmp upx \??\c:\llrxxfr.exe upx behavioral1/memory/2332-20-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\vvjvd.exe upx behavioral1/memory/2568-29-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\080022.exe upx C:\080240.exe upx behavioral1/memory/2572-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2572-52-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pvvpp.exe upx \??\c:\7xflfrf.exe upx behavioral1/memory/2452-62-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xrxxxxf.exe upx behavioral1/memory/2540-73-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2452-71-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\48264.exe upx behavioral1/memory/3032-92-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\lxrxflx.exe upx behavioral1/memory/1300-90-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2608-101-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\602866.exe upx C:\1hthnn.exe upx C:\nhtthh.exe upx behavioral1/memory/2824-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/612-129-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\26402.exe upx behavioral1/memory/2824-126-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\6080806.exe upx \??\c:\882800.exe upx C:\m6086.exe upx C:\lflflff.exe upx behavioral1/memory/1540-162-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\604266.exe upx behavioral1/memory/2988-175-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\3jdpv.exe upx C:\nnhhtb.exe upx \??\c:\9bhttb.exe upx C:\1vpdp.exe upx C:\04802.exe upx behavioral1/memory/1104-209-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dvjpd.exe upx \??\c:\66428.exe upx behavioral1/memory/2368-228-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\i622280.exe upx behavioral1/memory/2076-236-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\g8624.exe upx C:\5nhhhn.exe upx C:\jjppd.exe upx behavioral1/memory/1604-262-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\60846.exe upx C:\pppdp.exe upx behavioral1/memory/1512-294-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/852-293-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1728-307-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1520-327-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2764-329-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2712-354-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2580-361-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2476-375-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2484-383-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2260-396-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0318417706053ef922735e72173eff80_NeikiAnalytics.exe00408.exellrxxfr.exe080022.exevvjvd.exe080240.exe7xflfrf.exepvvpp.exexrxxxxf.exe48264.exelxrxflx.exe602866.exe1hthnn.exenhtthh.exe26402.exe6080806.exedescription pid process target process PID 2856 wrote to memory of 2508 2856 0318417706053ef922735e72173eff80_NeikiAnalytics.exe 00408.exe PID 2856 wrote to memory of 2508 2856 0318417706053ef922735e72173eff80_NeikiAnalytics.exe 00408.exe PID 2856 wrote to memory of 2508 2856 0318417706053ef922735e72173eff80_NeikiAnalytics.exe 00408.exe PID 2856 wrote to memory of 2508 2856 0318417706053ef922735e72173eff80_NeikiAnalytics.exe 00408.exe PID 2508 wrote to memory of 2332 2508 00408.exe llrxxfr.exe PID 2508 wrote to memory of 2332 2508 00408.exe llrxxfr.exe PID 2508 wrote to memory of 2332 2508 00408.exe llrxxfr.exe PID 2508 wrote to memory of 2332 2508 00408.exe llrxxfr.exe PID 2332 wrote to memory of 2568 2332 llrxxfr.exe 080022.exe PID 2332 wrote to memory of 2568 2332 llrxxfr.exe 080022.exe PID 2332 wrote to memory of 2568 2332 llrxxfr.exe 080022.exe PID 2332 wrote to memory of 2568 2332 llrxxfr.exe 080022.exe PID 2568 wrote to memory of 2724 2568 080022.exe vvjvd.exe PID 2568 wrote to memory of 2724 2568 080022.exe vvjvd.exe PID 2568 wrote to memory of 2724 2568 080022.exe vvjvd.exe PID 2568 wrote to memory of 2724 2568 080022.exe vvjvd.exe PID 2724 wrote to memory of 2572 2724 vvjvd.exe 080240.exe PID 2724 wrote to memory of 2572 2724 vvjvd.exe 080240.exe PID 2724 wrote to memory of 2572 2724 vvjvd.exe 080240.exe PID 2724 wrote to memory of 2572 2724 vvjvd.exe 080240.exe PID 2572 wrote to memory of 2544 2572 080240.exe 7xflfrf.exe PID 2572 wrote to memory of 2544 2572 080240.exe 7xflfrf.exe PID 2572 wrote to memory of 2544 2572 080240.exe 7xflfrf.exe PID 2572 wrote to memory of 2544 2572 080240.exe 7xflfrf.exe PID 2544 wrote to memory of 2452 2544 7xflfrf.exe pvvpp.exe PID 2544 wrote to memory of 2452 2544 7xflfrf.exe pvvpp.exe PID 2544 wrote to memory of 2452 2544 7xflfrf.exe pvvpp.exe PID 2544 wrote to memory of 2452 2544 7xflfrf.exe pvvpp.exe PID 2452 wrote to memory of 2540 2452 pvvpp.exe xrxxxxf.exe PID 2452 wrote to memory of 2540 2452 pvvpp.exe xrxxxxf.exe PID 2452 wrote to memory of 2540 2452 pvvpp.exe xrxxxxf.exe PID 2452 wrote to memory of 2540 2452 pvvpp.exe xrxxxxf.exe PID 2540 wrote to memory of 1300 2540 xrxxxxf.exe 48264.exe PID 2540 wrote to memory of 1300 2540 xrxxxxf.exe 48264.exe PID 2540 wrote to memory of 1300 2540 xrxxxxf.exe 48264.exe PID 2540 wrote to memory of 1300 2540 xrxxxxf.exe 48264.exe PID 1300 wrote to memory of 3032 1300 48264.exe lxrxflx.exe PID 1300 wrote to memory of 3032 1300 48264.exe lxrxflx.exe PID 1300 wrote to memory of 3032 1300 48264.exe lxrxflx.exe PID 1300 wrote to memory of 3032 1300 48264.exe lxrxflx.exe PID 3032 wrote to memory of 2608 3032 lxrxflx.exe 602866.exe PID 3032 wrote to memory of 2608 3032 lxrxflx.exe 602866.exe PID 3032 wrote to memory of 2608 3032 lxrxflx.exe 602866.exe PID 3032 wrote to memory of 2608 3032 lxrxflx.exe 602866.exe PID 2608 wrote to memory of 2784 2608 602866.exe 1hthnn.exe PID 2608 wrote to memory of 2784 2608 602866.exe 1hthnn.exe PID 2608 wrote to memory of 2784 2608 602866.exe 1hthnn.exe PID 2608 wrote to memory of 2784 2608 602866.exe 1hthnn.exe PID 2784 wrote to memory of 2824 2784 1hthnn.exe nhtthh.exe PID 2784 wrote to memory of 2824 2784 1hthnn.exe nhtthh.exe PID 2784 wrote to memory of 2824 2784 1hthnn.exe nhtthh.exe PID 2784 wrote to memory of 2824 2784 1hthnn.exe nhtthh.exe PID 2824 wrote to memory of 612 2824 nhtthh.exe 26402.exe PID 2824 wrote to memory of 612 2824 nhtthh.exe 26402.exe PID 2824 wrote to memory of 612 2824 nhtthh.exe 26402.exe PID 2824 wrote to memory of 612 2824 nhtthh.exe 26402.exe PID 612 wrote to memory of 1788 612 26402.exe 6080806.exe PID 612 wrote to memory of 1788 612 26402.exe 6080806.exe PID 612 wrote to memory of 1788 612 26402.exe 6080806.exe PID 612 wrote to memory of 1788 612 26402.exe 6080806.exe PID 1788 wrote to memory of 2660 1788 6080806.exe 882800.exe PID 1788 wrote to memory of 2660 1788 6080806.exe 882800.exe PID 1788 wrote to memory of 2660 1788 6080806.exe 882800.exe PID 1788 wrote to memory of 2660 1788 6080806.exe 882800.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0318417706053ef922735e72173eff80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0318417706053ef922735e72173eff80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\00408.exec:\00408.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\llrxxfr.exec:\llrxxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\080022.exec:\080022.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vvjvd.exec:\vvjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\080240.exec:\080240.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\7xflfrf.exec:\7xflfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\pvvpp.exec:\pvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\48264.exec:\48264.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\lxrxflx.exec:\lxrxflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\602866.exec:\602866.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\1hthnn.exec:\1hthnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nhtthh.exec:\nhtthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\26402.exec:\26402.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\6080806.exec:\6080806.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\882800.exec:\882800.exe17⤵
- Executes dropped EXE
PID:2660 -
\??\c:\m6086.exec:\m6086.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lflflff.exec:\lflflff.exe19⤵
- Executes dropped EXE
PID:1540 -
\??\c:\604266.exec:\604266.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3jdpv.exec:\3jdpv.exe21⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nnhhtb.exec:\nnhhtb.exe22⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9bhttb.exec:\9bhttb.exe23⤵
- Executes dropped EXE
PID:1364 -
\??\c:\1vpdp.exec:\1vpdp.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\04802.exec:\04802.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\dvjpd.exec:\dvjpd.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\66428.exec:\66428.exe27⤵
- Executes dropped EXE
PID:2368 -
\??\c:\i622280.exec:\i622280.exe28⤵
- Executes dropped EXE
PID:2076 -
\??\c:\g8624.exec:\g8624.exe29⤵
- Executes dropped EXE
PID:1388 -
\??\c:\5nhhhn.exec:\5nhhhn.exe30⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jjppd.exec:\jjppd.exe31⤵
- Executes dropped EXE
PID:1604 -
\??\c:\60846.exec:\60846.exe32⤵
- Executes dropped EXE
PID:916 -
\??\c:\pppdp.exec:\pppdp.exe33⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvjjp.exec:\dvjjp.exe34⤵
- Executes dropped EXE
PID:852 -
\??\c:\c422446.exec:\c422446.exe35⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe36⤵
- Executes dropped EXE
PID:1760 -
\??\c:\e48466.exec:\e48466.exe37⤵
- Executes dropped EXE
PID:1728 -
\??\c:\88482.exec:\88482.exe38⤵
- Executes dropped EXE
PID:1600 -
\??\c:\o602402.exec:\o602402.exe39⤵
- Executes dropped EXE
PID:1520 -
\??\c:\4240608.exec:\4240608.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\084800.exec:\084800.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nnhnbt.exec:\nnhnbt.exe42⤵
- Executes dropped EXE
PID:2880 -
\??\c:\djpjv.exec:\djpjv.exe43⤵
- Executes dropped EXE
PID:2712 -
\??\c:\m0846.exec:\m0846.exe44⤵
- Executes dropped EXE
PID:2580 -
\??\c:\dvpvp.exec:\dvpvp.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\nbnntn.exec:\nbnntn.exe46⤵
- Executes dropped EXE
PID:2820 -
\??\c:\22266.exec:\22266.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ntttbt.exec:\ntttbt.exe48⤵
- Executes dropped EXE
PID:2484 -
\??\c:\82624.exec:\82624.exe49⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3djpd.exec:\3djpd.exe50⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vdjdj.exec:\vdjdj.exe51⤵
- Executes dropped EXE
PID:2664 -
\??\c:\ffrlrfl.exec:\ffrlrfl.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\a2488.exec:\a2488.exe53⤵
- Executes dropped EXE
PID:2636 -
\??\c:\042840.exec:\042840.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\hbtthh.exec:\hbtthh.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\vpdjv.exec:\vpdjv.exe56⤵
- Executes dropped EXE
PID:612 -
\??\c:\vpddp.exec:\vpddp.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rffflrl.exec:\rffflrl.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\602486.exec:\602486.exe59⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lxlrflx.exec:\lxlrflx.exe60⤵
- Executes dropped EXE
PID:1672 -
\??\c:\2022028.exec:\2022028.exe61⤵
- Executes dropped EXE
PID:1824 -
\??\c:\826800.exec:\826800.exe62⤵
- Executes dropped EXE
PID:3012 -
\??\c:\5pdpd.exec:\5pdpd.exe63⤵
- Executes dropped EXE
PID:2996 -
\??\c:\1nbtht.exec:\1nbtht.exe64⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjdjp.exec:\vjdjp.exe65⤵
- Executes dropped EXE
PID:384 -
\??\c:\nthbht.exec:\nthbht.exe66⤵PID:580
-
\??\c:\nbthnt.exec:\nbthnt.exe67⤵PID:488
-
\??\c:\08006.exec:\08006.exe68⤵PID:636
-
\??\c:\1lflxxl.exec:\1lflxxl.exe69⤵PID:2384
-
\??\c:\g0880.exec:\g0880.exe70⤵PID:1012
-
\??\c:\pdvvp.exec:\pdvvp.exe71⤵PID:1136
-
\??\c:\420206.exec:\420206.exe72⤵PID:1764
-
\??\c:\424688.exec:\424688.exe73⤵PID:1712
-
\??\c:\4262228.exec:\4262228.exe74⤵PID:956
-
\??\c:\8862288.exec:\8862288.exe75⤵PID:2168
-
\??\c:\nnbthh.exec:\nnbthh.exe76⤵PID:2408
-
\??\c:\480648.exec:\480648.exe77⤵PID:688
-
\??\c:\7nbntn.exec:\7nbntn.exe78⤵PID:916
-
\??\c:\dpvpv.exec:\dpvpv.exe79⤵PID:2204
-
\??\c:\i248284.exec:\i248284.exe80⤵PID:1516
-
\??\c:\824406.exec:\824406.exe81⤵PID:892
-
\??\c:\2066262.exec:\2066262.exe82⤵PID:2200
-
\??\c:\482862.exec:\482862.exe83⤵PID:1568
-
\??\c:\7xlrffl.exec:\7xlrffl.exe84⤵PID:2348
-
\??\c:\428000.exec:\428000.exe85⤵PID:2392
-
\??\c:\46464.exec:\46464.exe86⤵PID:2340
-
\??\c:\xlxflfr.exec:\xlxflfr.exe87⤵PID:2748
-
\??\c:\u048062.exec:\u048062.exe88⤵PID:2108
-
\??\c:\dvppv.exec:\dvppv.exe89⤵PID:2584
-
\??\c:\dvjpv.exec:\dvjpv.exe90⤵PID:2292
-
\??\c:\8284068.exec:\8284068.exe91⤵PID:2700
-
\??\c:\44288.exec:\44288.exe92⤵PID:2456
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe93⤵PID:2820
-
\??\c:\c044066.exec:\c044066.exe94⤵PID:2476
-
\??\c:\pjvvj.exec:\pjvvj.exe95⤵PID:2480
-
\??\c:\ttttnh.exec:\ttttnh.exe96⤵PID:2444
-
\??\c:\486888.exec:\486888.exe97⤵PID:2516
-
\??\c:\e46242.exec:\e46242.exe98⤵PID:2836
-
\??\c:\vpjpd.exec:\vpjpd.exe99⤵PID:2792
-
\??\c:\pjvvj.exec:\pjvvj.exe100⤵PID:2644
-
\??\c:\608466.exec:\608466.exe101⤵PID:1696
-
\??\c:\480284.exec:\480284.exe102⤵PID:1448
-
\??\c:\9jjpd.exec:\9jjpd.exe103⤵PID:2604
-
\??\c:\jpjvj.exec:\jpjvj.exe104⤵PID:2496
-
\??\c:\vpjjv.exec:\vpjjv.exe105⤵PID:1064
-
\??\c:\9nbnth.exec:\9nbnth.exe106⤵PID:1624
-
\??\c:\nhtnnh.exec:\nhtnnh.exe107⤵PID:1552
-
\??\c:\dpjdv.exec:\dpjdv.exe108⤵PID:3008
-
\??\c:\rffxxfx.exec:\rffxxfx.exe109⤵PID:2948
-
\??\c:\646622.exec:\646622.exe110⤵PID:2988
-
\??\c:\bthnbh.exec:\bthnbh.exe111⤵PID:2096
-
\??\c:\e24066.exec:\e24066.exe112⤵PID:668
-
\??\c:\486464.exec:\486464.exe113⤵PID:1304
-
\??\c:\bbnhtb.exec:\bbnhtb.exe114⤵PID:2132
-
\??\c:\jvdvv.exec:\jvdvv.exe115⤵PID:1144
-
\??\c:\jpjvp.exec:\jpjvp.exe116⤵PID:1384
-
\??\c:\q86028.exec:\q86028.exe117⤵PID:1088
-
\??\c:\rfrrrrr.exec:\rfrrrrr.exe118⤵PID:448
-
\??\c:\2608464.exec:\2608464.exe119⤵PID:1548
-
\??\c:\82020.exec:\82020.exe120⤵PID:1768
-
\??\c:\642688.exec:\642688.exe121⤵PID:2016
-
\??\c:\m4062.exec:\m4062.exe122⤵PID:1324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-