Analysis
- max time kernel
80s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 11:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe
- Size 274KB
- Sample240607-n4mdlaff4s
- SHA256 73ede36ab6f0f5333888edbad212d3f9362ac56c59781e2e888225b0de28cd2d
- MD5 55643fac4857aa99325c372322bfbd10
- SHA1 fbd1da37d7959996d93cca138dd4db78cb272e74
- SHA512 710bf4363c0c707baa676331c044a98e4c4342d78bbd60da3009cb585a522e9e08d1ac8ce86e8352370b713d9d4174afc7d2f817fcf4df29f08071a1954d9243
- SSDEEP 3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFBP:8cm7ImGddXmNt251UriZFt
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/2252-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1680-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3988-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4004-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2540-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1080-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/768-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/712-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4364-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4048-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3232-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4692-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1548-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1488-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4668-629-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/432-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3944-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4592-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/960-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4524-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3508-453-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1928-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1052-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3216-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2440-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1724-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5068-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2968-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1376-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1300-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3056-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4824-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2964-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3864-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1968-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2124-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1912-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2788-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1372-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3160-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/688-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3192-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1500-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3808-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4648-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4880-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1252-14-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1988 nhnhbb.exe 1252 vddjd.exe 1680 rrxrlfx.exe 4880 frxrllf.exe 2140 tnhhnn.exe 712 jvdvp.exe 3892 vvjjd.exe 5016 5xxrlff.exe 4648 lrffffx.exe 3808 7tbtnn.exe 1500 vjpjd.exe 3192 fxxxrrr.exe 688 rxlllff.exe 5064 tnttnn.exe 3988 vjjvv.exe 3044 rrlllfx.exe 3160 xlfxxrr.exe 2676 hntnnh.exe 4220 djpdd.exe 1372 vdpjd.exe 4380 3fxxxxx.exe 4004 btbbbh.exe 3700 dpdvv.exe 2788 vdjdd.exe 1912 lflfxxx.exe 4048 tntbnn.exe 2540 btnhhb.exe 2124 3dddd.exe 3752 bhhbtt.exe 1968 9vdvv.exe 3864 rfrrxxf.exe 824 rfllrrr.exe 2964 ntbttn.exe 960 pvvvd.exe 4356 5rllffr.exe 4824 xxlflrl.exe 3056 vpddj.exe 4652 3vppp.exe 3292 lfrrrxx.exe 1080 hnbbhh.exe 768 nnnnnt.exe 1300 dddpp.exe 2396 vdppp.exe 712 rlfxxll.exe 3324 hbnhtt.exe 4364 nnnnnn.exe 4468 jjddj.exe 1376 ddpjj.exe 2968 llllfll.exe 5068 1nnhhh.exe 60 hbnnnn.exe 3392 jvdpp.exe 4548 dpvpp.exe 3560 lflxxxr.exe 376 bnbtnb.exe 3920 nhnhhb.exe 4220 vjjpd.exe 1852 pjppp.exe 1724 lxlffff.exe 2840 lflffff.exe 4772 nnbtnh.exe 2088 9dpjd.exe 4848 ddppv.exe 4048 7xllrxr.exe -
resource yara_rule behavioral2/memory/2252-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1680-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3988-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4004-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2540-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3056-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/768-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/712-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4364-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2840-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4048-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4692-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/820-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/740-765-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3468-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1548-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1240-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3392-892-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4600-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2784-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4184-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2512-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1080-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1488-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4668-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4248-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/432-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2788-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3944-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4436-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4592-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/960-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4524-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4352-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3508-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1928-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1052-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4880-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3216-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2124-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2440-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3232-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1724-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/376-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5068-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2968-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1376-250-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 1988 2252 55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe 316 PID 2252 wrote to memory of 1988 2252 55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe 316 PID 2252 wrote to memory of 1988 2252 55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe 316 PID 1988 wrote to memory of 1252 1988 nhnhbb.exe 166 PID 1988 wrote to memory of 1252 1988 nhnhbb.exe 166 PID 1988 wrote to memory of 1252 1988 nhnhbb.exe 166 PID 1252 wrote to memory of 1680 1252 vddjd.exe 281 PID 1252 wrote to memory of 1680 1252 vddjd.exe 281 PID 1252 wrote to memory of 1680 1252 vddjd.exe 281 PID 1680 wrote to memory of 4880 1680 rrxrlfx.exe 169 PID 1680 wrote to memory of 4880 1680 rrxrlfx.exe 169 PID 1680 wrote to memory of 4880 1680 rrxrlfx.exe 169 PID 4880 wrote to memory of 2140 4880 frxrllf.exe 86 PID 4880 wrote to memory of 2140 4880 frxrllf.exe 86 PID 4880 wrote to memory of 2140 4880 frxrllf.exe 86 PID 2140 wrote to memory of 712 2140 tnhhnn.exe 87 PID 2140 wrote to memory of 712 2140 tnhhnn.exe 87 PID 2140 wrote to memory of 712 2140 tnhhnn.exe 87 PID 712 wrote to memory of 3892 712 jvdvp.exe 88 PID 712 wrote to memory of 3892 712 jvdvp.exe 88 PID 712 wrote to memory of 3892 712 jvdvp.exe 88 PID 3892 wrote to memory of 5016 3892 vvjjd.exe 89 PID 3892 wrote to memory of 5016 3892 vvjjd.exe 89 PID 3892 wrote to memory of 5016 3892 vvjjd.exe 89 PID 5016 wrote to memory of 4648 5016 5xxrlff.exe 90 PID 5016 wrote to memory of 4648 5016 5xxrlff.exe 90 PID 5016 wrote to memory of 4648 5016 5xxrlff.exe 90 PID 4648 wrote to memory of 3808 4648 lrffffx.exe 91 PID 4648 wrote to memory of 3808 4648 lrffffx.exe 91 PID 4648 wrote to memory of 3808 4648 lrffffx.exe 91 PID 3808 wrote to memory of 1500 3808 7tbtnn.exe 92 PID 3808 wrote to memory of 1500 3808 7tbtnn.exe 92 PID 3808 wrote to memory of 1500 3808 7tbtnn.exe 92 PID 1500 wrote to memory of 3192 1500 vjpjd.exe 742 PID 1500 wrote to memory of 3192 1500 vjpjd.exe 742 PID 1500 wrote to memory of 3192 1500 vjpjd.exe 742 PID 3192 wrote to memory of 688 3192 fxxxrrr.exe 94 PID 3192 wrote to memory of 688 3192 fxxxrrr.exe 94 PID 3192 wrote to memory of 688 3192 fxxxrrr.exe 94 PID 688 wrote to memory of 5064 688 rxlllff.exe 95 PID 688 wrote to memory of 5064 688 rxlllff.exe 95 PID 688 wrote to memory of 5064 688 rxlllff.exe 95 PID 5064 wrote to memory of 3988 5064 tnttnn.exe 96 PID 5064 wrote to memory of 3988 5064 tnttnn.exe 96 PID 5064 wrote to memory of 3988 5064 tnttnn.exe 96 PID 3988 wrote to memory of 3044 3988 vjjvv.exe 97 PID 3988 wrote to memory of 3044 3988 vjjvv.exe 97 PID 3988 wrote to memory of 3044 3988 vjjvv.exe 97 PID 3044 wrote to memory of 3160 3044 rrlllfx.exe 98 PID 3044 wrote to memory of 3160 3044 rrlllfx.exe 98 PID 3044 wrote to memory of 3160 3044 rrlllfx.exe 98 PID 3160 wrote to memory of 2676 3160 xlfxxrr.exe 99 PID 3160 wrote to memory of 2676 3160 xlfxxrr.exe 99 PID 3160 wrote to memory of 2676 3160 xlfxxrr.exe 99 PID 2676 wrote to memory of 4220 2676 hntnnh.exe 100 PID 2676 wrote to memory of 4220 2676 hntnnh.exe 100 PID 2676 wrote to memory of 4220 2676 hntnnh.exe 100 PID 4220 wrote to memory of 1372 4220 djpdd.exe 101 PID 4220 wrote to memory of 1372 4220 djpdd.exe 101 PID 4220 wrote to memory of 1372 4220 djpdd.exe 101 PID 1372 wrote to memory of 4380 1372 vdpjd.exe 102 PID 1372 wrote to memory of 4380 1372 vdpjd.exe 102 PID 1372 wrote to memory of 4380 1372 vdpjd.exe 102 PID 4380 wrote to memory of 4004 4380 3fxxxxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\55643fac4857aa99325c372322bfbd10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\nhnhbb.exec:\nhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\vddjd.exec:\vddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\frxrllf.exec:\frxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\tnhhnn.exec:\tnhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\vvjjd.exec:\vvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\5xxrlff.exec:\5xxrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\lrffffx.exec:\lrffffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\7tbtnn.exec:\7tbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\vjpjd.exec:\vjpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\rxlllff.exec:\rxlllff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\tnttnn.exec:\tnttnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\vjjvv.exec:\vjjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\rrlllfx.exec:\rrlllfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xlfxxrr.exec:\xlfxxrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\hntnnh.exec:\hntnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\djpdd.exec:\djpdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\vdpjd.exec:\vdpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\3fxxxxx.exec:\3fxxxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\btbbbh.exec:\btbbbh.exe23⤵
- Executes dropped EXE
PID:4004 -
\??\c:\dpdvv.exec:\dpdvv.exe24⤵
- Executes dropped EXE
PID:3700 -
\??\c:\vdjdd.exec:\vdjdd.exe25⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lflfxxx.exec:\lflfxxx.exe26⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tntbnn.exec:\tntbnn.exe27⤵
- Executes dropped EXE
PID:4048 -
\??\c:\btnhhb.exec:\btnhhb.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3dddd.exec:\3dddd.exe29⤵
- Executes dropped EXE
PID:2124 -
\??\c:\bhhbtt.exec:\bhhbtt.exe30⤵
- Executes dropped EXE
PID:3752 -
\??\c:\9vdvv.exec:\9vdvv.exe31⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe32⤵
- Executes dropped EXE
PID:3864 -
\??\c:\rfllrrr.exec:\rfllrrr.exe33⤵
- Executes dropped EXE
PID:824 -
\??\c:\ntbttn.exec:\ntbttn.exe34⤵
- Executes dropped EXE
PID:2964 -
\??\c:\pvvvd.exec:\pvvvd.exe35⤵
- Executes dropped EXE
PID:960 -
\??\c:\5rllffr.exec:\5rllffr.exe36⤵
- Executes dropped EXE
PID:4356 -
\??\c:\xxlflrl.exec:\xxlflrl.exe37⤵
- Executes dropped EXE
PID:4824 -
\??\c:\vpddj.exec:\vpddj.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3vppp.exec:\3vppp.exe39⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lfrrrxx.exec:\lfrrrxx.exe40⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hnbbhh.exec:\hnbbhh.exe41⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nnnnnt.exec:\nnnnnt.exe42⤵
- Executes dropped EXE
PID:768 -
\??\c:\dddpp.exec:\dddpp.exe43⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vdppp.exec:\vdppp.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rlfxxll.exec:\rlfxxll.exe45⤵
- Executes dropped EXE
PID:712 -
\??\c:\hbnhtt.exec:\hbnhtt.exe46⤵
- Executes dropped EXE
PID:3324 -
\??\c:\nnnnnn.exec:\nnnnnn.exe47⤵
- Executes dropped EXE
PID:4364 -
\??\c:\jjddj.exec:\jjddj.exe48⤵
- Executes dropped EXE
PID:4468 -
\??\c:\ddpjj.exec:\ddpjj.exe49⤵
- Executes dropped EXE
PID:1376 -
\??\c:\llllfll.exec:\llllfll.exe50⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1nnhhh.exec:\1nnhhh.exe51⤵
- Executes dropped EXE
PID:5068 -
\??\c:\hbnnnn.exec:\hbnnnn.exe52⤵
- Executes dropped EXE
PID:60 -
\??\c:\jvdpp.exec:\jvdpp.exe53⤵
- Executes dropped EXE
PID:3392 -
\??\c:\dpvpp.exec:\dpvpp.exe54⤵
- Executes dropped EXE
PID:4548 -
\??\c:\lflxxxr.exec:\lflxxxr.exe55⤵
- Executes dropped EXE
PID:3560 -
\??\c:\bnbtnb.exec:\bnbtnb.exe56⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhnhhb.exec:\nhnhhb.exe57⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vjjpd.exec:\vjjpd.exe58⤵
- Executes dropped EXE
PID:4220 -
\??\c:\pjppp.exec:\pjppp.exe59⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lxlffff.exec:\lxlffff.exe60⤵
- Executes dropped EXE
PID:1724 -
\??\c:\lflffff.exec:\lflffff.exe61⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nnbtnh.exec:\nnbtnh.exe62⤵
- Executes dropped EXE
PID:4772 -
\??\c:\9dpjd.exec:\9dpjd.exe63⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ddppv.exec:\ddppv.exe64⤵
- Executes dropped EXE
PID:4848 -
\??\c:\7xllrxr.exec:\7xllrxr.exe65⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xfxxxxf.exec:\xfxxxxf.exe66⤵PID:3232
-
\??\c:\nbnhbh.exec:\nbnhbh.exe67⤵PID:1876
-
\??\c:\hhhbbh.exec:\hhhbbh.exe68⤵PID:2440
-
\??\c:\jpppd.exec:\jpppd.exe69⤵PID:2124
-
\??\c:\5rffxfx.exec:\5rffxfx.exe70⤵PID:440
-
\??\c:\9xxxxxx.exec:\9xxxxxx.exe71⤵PID:3144
-
\??\c:\bnbttt.exec:\bnbttt.exe72⤵PID:4960
-
\??\c:\ddddj.exec:\ddddj.exe73⤵PID:864
-
\??\c:\ffrrflx.exec:\ffrrflx.exe74⤵PID:3068
-
\??\c:\lrfflll.exec:\lrfflll.exe75⤵PID:4872
-
\??\c:\9ttttb.exec:\9ttttb.exe76⤵PID:3216
-
\??\c:\hhbttb.exec:\hhbttb.exe77⤵PID:3172
-
\??\c:\5jjjd.exec:\5jjjd.exe78⤵PID:4356
-
\??\c:\xxllrrl.exec:\xxllrrl.exe79⤵PID:4824
-
\??\c:\thnhhn.exec:\thnhhn.exe80⤵PID:4520
-
\??\c:\1pppj.exec:\1pppj.exe81⤵PID:1252
-
\??\c:\jpjdp.exec:\jpjdp.exe82⤵PID:5032
-
\??\c:\lfffxfx.exec:\lfffxfx.exe83⤵PID:3240
-
\??\c:\xrrlfff.exec:\xrrlfff.exe84⤵PID:4880
-
\??\c:\thnnnn.exec:\thnnnn.exe85⤵PID:768
-
\??\c:\tnnhbh.exec:\tnnhbh.exe86⤵PID:1524
-
\??\c:\jjddv.exec:\jjddv.exe87⤵PID:4664
-
\??\c:\9rlllll.exec:\9rlllll.exe88⤵PID:3324
-
\??\c:\hhhhhh.exec:\hhhhhh.exe89⤵PID:1284
-
\??\c:\hbhhhn.exec:\hbhhhn.exe90⤵PID:4888
-
\??\c:\pppjj.exec:\pppjj.exe91⤵PID:4692
-
\??\c:\1xfxxxr.exec:\1xfxxxr.exe92⤵PID:3392
-
\??\c:\lfffrrr.exec:\lfffrrr.exe93⤵PID:4136
-
\??\c:\5nbbbb.exec:\5nbbbb.exe94⤵PID:376
-
\??\c:\jjddj.exec:\jjddj.exe95⤵PID:3904
-
\??\c:\vddjj.exec:\vddjj.exe96⤵PID:1772
-
\??\c:\lrrrlll.exec:\lrrrlll.exe97⤵PID:1352
-
\??\c:\tttttb.exec:\tttttb.exe98⤵PID:3472
-
\??\c:\btthtb.exec:\btthtb.exe99⤵PID:1052
-
\??\c:\pddvd.exec:\pddvd.exe100⤵PID:3648
-
\??\c:\3dddd.exec:\3dddd.exe101⤵PID:2284
-
\??\c:\llxxrrr.exec:\llxxrrr.exe102⤵PID:1928
-
\??\c:\hhthnt.exec:\hhthnt.exe103⤵PID:2440
-
\??\c:\bnbbbb.exec:\bnbbbb.exe104⤵PID:4336
-
\??\c:\pjdvj.exec:\pjdvj.exe105⤵PID:1984
-
\??\c:\pvjdv.exec:\pvjdv.exe106⤵PID:3144
-
\??\c:\lxlffff.exec:\lxlffff.exe107⤵PID:4960
-
\??\c:\xxxrxrx.exec:\xxxrxrx.exe108⤵PID:3508
-
\??\c:\9bhnnt.exec:\9bhnnt.exe109⤵PID:4352
-
\??\c:\jpjpd.exec:\jpjpd.exe110⤵PID:4524
-
\??\c:\vjvdp.exec:\vjvdp.exe111⤵PID:960
-
\??\c:\xfrfffx.exec:\xfrfffx.exe112⤵PID:4592
-
\??\c:\llffxxr.exec:\llffxxr.exe113⤵PID:4436
-
\??\c:\bbnntt.exec:\bbnntt.exe114⤵PID:3696
-
\??\c:\hthbbt.exec:\hthbbt.exe115⤵PID:1420
-
\??\c:\jvvpp.exec:\jvvpp.exe116⤵PID:2388
-
\??\c:\pjjvv.exec:\pjjvv.exe117⤵PID:4948
-
\??\c:\3lrrlrx.exec:\3lrrlrx.exe118⤵PID:1560
-
\??\c:\llrrxxx.exec:\llrrxxx.exe119⤵PID:544
-
\??\c:\tthhbb.exec:\tthhbb.exe120⤵PID:4880
-
\??\c:\tnbthn.exec:\tnbthn.exe121⤵PID:1300
-
\??\c:\vpddj.exec:\vpddj.exe122⤵PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-