Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
07/06/2024, 11:14
Behavioral task
behavioral1
Sample
5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe
- Size 380KB
- Sample240607-nccebagc69
- SHA256 b5faec0866a26a17b6a9bcbb05e75f0767f6a289885b293b95a124eb64a864b9
- MD5 5228e4f9c2d26e1254da2340e7e89d70
- SHA1 651e5406519f0894451cfa4fc3ed1c39cb1d8886
- SHA512 ade3a317b53df855118b174d5fdd9e280d6bbc4c12fe0a9c52ef33f0dfa2a95399ecf7e9f4d68128008716caf1a614e88fff346e988ced12cdb71ede522f40ad
- SSDEEP 6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVog:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHoI
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4844-7-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4632-13-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4520-201-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4172-255-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2088-287-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2448-380-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/452-446-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/424-450-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4372-444-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2980-440-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2364-432-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1404-429-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1012-426-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4208-424-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4672-417-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4480-415-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1944-412-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/836-408-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4496-402-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1124-400-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1912-396-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5740-392-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5492-386-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/6084-383-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3012-373-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5992-369-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1208-366-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4696-364-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1096-358-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2268-356-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1876-350-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2092-343-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/392-339-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4580-336-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5544-331-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4528-324-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3044-317-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4548-310-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5424-306-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2380-304-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/6032-294-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1948-291-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1880-283-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4692-279-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4948-277-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3000-271-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/6088-267-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3624-263-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3532-260-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3344-252-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3328-249-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1128-245-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2516-241-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4368-238-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4312-232-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/368-229-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5336-225-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5776-222-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5768-217-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3416-214-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2156-209-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1744-205-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/5804-197-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4720-191-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4632 rfrlfxl.exe 1316 xrrllfx.exe 5080 3bbbnb.exe 4556 9ppdv.exe 2928 vppdv.exe 3960 xflfrrl.exe 4408 hbhbtn.exe 4168 3hbbtn.exe 2276 jddvv.exe 1360 xlrflrl.exe 6092 fffxrlx.exe 4044 5bhbhh.exe 3800 vddvp.exe 5504 3lxrflx.exe 1332 rxxrfxl.exe 1816 tnhbbb.exe 5376 jjdpv.exe 3848 ppvjj.exe 5316 flrlllf.exe 4484 nhtnnh.exe 3460 7dvjd.exe 5240 7jjdv.exe 4356 3lxfrll.exe 4068 1hbtnn.exe 4620 vjdvp.exe 5132 jdvjd.exe 1220 frrlflr.exe 3688 tnbnht.exe 6120 nhhtbn.exe 4720 jvjdv.exe 5804 fxrfrff.exe 4520 rxxxrlf.exe 1744 btbbtt.exe 2156 jdjdv.exe 3416 xlrlxxl.exe 5768 rffrllf.exe 5776 btthnb.exe 5336 9vvpj.exe 368 3llxxfx.exe 4312 xllfxrl.exe 4368 nbhtnt.exe 2516 vddvd.exe 1128 9jjvj.exe 3328 lrrfrrf.exe 3344 hhtnhb.exe 4172 pvvpd.exe 3532 pvvpd.exe 3624 lflfxxr.exe 6088 bbhnbn.exe 3000 jjvdd.exe 4948 lrxrffx.exe 4692 xffrllr.exe 1880 thhttb.exe 2088 dpppd.exe 1948 rflfrlf.exe 6032 btbtnb.exe 1988 vvddv.exe 2380 3xfrrrl.exe 5424 nbhbnn.exe 4548 htnnht.exe 3492 vdjdd.exe 3044 flfllxl.exe 4128 fflxrxx.exe 4528 9ntttt.exe -
resource yara_rule behavioral2/memory/4844-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0008000000023288-3.dat upx behavioral2/memory/4632-9-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4844-7-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4632-13-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023417-14.dat upx behavioral2/files/0x0007000000023418-25.dat upx behavioral2/files/0x000700000002341a-37.dat upx behavioral2/files/0x000700000002341d-55.dat upx behavioral2/files/0x000700000002341f-65.dat upx behavioral2/files/0x0007000000023423-91.dat upx behavioral2/files/0x0007000000023425-103.dat upx behavioral2/files/0x0007000000023429-127.dat upx behavioral2/files/0x000700000002342c-145.dat upx behavioral2/files/0x0007000000023432-181.dat upx behavioral2/memory/4520-201-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4172-255-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2088-287-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2448-380-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/452-446-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/424-450-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4372-444-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2980-440-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2364-432-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1404-429-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1012-426-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4208-424-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4672-417-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4480-415-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1944-412-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/836-408-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4496-402-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1124-400-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1912-396-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5740-392-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5492-386-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/6084-383-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3012-373-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5992-369-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1208-366-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4696-364-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1096-358-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2268-356-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1876-350-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2092-343-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/392-339-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4580-336-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5544-331-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4528-324-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3044-317-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4548-310-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/5424-306-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2380-304-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/6032-294-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1948-291-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1880-283-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4692-279-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4948-277-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3000-271-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/6088-267-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3624-263-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3532-260-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3344-252-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3328-249-0x0000000000400000-0x0000000000472000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4844 wrote to memory of 4632 4844 5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe 83 PID 4844 wrote to memory of 4632 4844 5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe 83 PID 4844 wrote to memory of 4632 4844 5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe 83 PID 4632 wrote to memory of 1316 4632 rfrlfxl.exe 84 PID 4632 wrote to memory of 1316 4632 rfrlfxl.exe 84 PID 4632 wrote to memory of 1316 4632 rfrlfxl.exe 84 PID 1316 wrote to memory of 5080 1316 xrrllfx.exe 85 PID 1316 wrote to memory of 5080 1316 xrrllfx.exe 85 PID 1316 wrote to memory of 5080 1316 xrrllfx.exe 85 PID 5080 wrote to memory of 4556 5080 3bbbnb.exe 86 PID 5080 wrote to memory of 4556 5080 3bbbnb.exe 86 PID 5080 wrote to memory of 4556 5080 3bbbnb.exe 86 PID 4556 wrote to memory of 2928 4556 9ppdv.exe 87 PID 4556 wrote to memory of 2928 4556 9ppdv.exe 87 PID 4556 wrote to memory of 2928 4556 9ppdv.exe 87 PID 2928 wrote to memory of 3960 2928 vppdv.exe 88 PID 2928 wrote to memory of 3960 2928 vppdv.exe 88 PID 2928 wrote to memory of 3960 2928 vppdv.exe 88 PID 3960 wrote to memory of 4408 3960 xflfrrl.exe 89 PID 3960 wrote to memory of 4408 3960 xflfrrl.exe 89 PID 3960 wrote to memory of 4408 3960 xflfrrl.exe 89 PID 4408 wrote to memory of 4168 4408 hbhbtn.exe 90 PID 4408 wrote to memory of 4168 4408 hbhbtn.exe 90 PID 4408 wrote to memory of 4168 4408 hbhbtn.exe 90 PID 4168 wrote to memory of 2276 4168 3hbbtn.exe 91 PID 4168 wrote to memory of 2276 4168 3hbbtn.exe 91 PID 4168 wrote to memory of 2276 4168 3hbbtn.exe 91 PID 2276 wrote to memory of 1360 2276 jddvv.exe 92 PID 2276 wrote to memory of 1360 2276 jddvv.exe 92 PID 2276 wrote to memory of 1360 2276 jddvv.exe 92 PID 1360 wrote to memory of 6092 1360 xlrflrl.exe 93 PID 1360 wrote to memory of 6092 1360 xlrflrl.exe 93 PID 1360 wrote to memory of 6092 1360 xlrflrl.exe 93 PID 6092 wrote to memory of 4044 6092 fffxrlx.exe 94 PID 6092 wrote to memory of 4044 6092 fffxrlx.exe 94 PID 6092 wrote to memory of 4044 6092 fffxrlx.exe 94 PID 4044 wrote to memory of 3800 4044 5bhbhh.exe 95 PID 4044 wrote to memory of 3800 4044 5bhbhh.exe 95 PID 4044 wrote to memory of 3800 4044 5bhbhh.exe 95 PID 3800 wrote to memory of 5504 3800 vddvp.exe 96 PID 3800 wrote to memory of 5504 3800 vddvp.exe 96 PID 3800 wrote to memory of 5504 3800 vddvp.exe 96 PID 5504 wrote to memory of 1332 5504 3lxrflx.exe 97 PID 5504 wrote to memory of 1332 5504 3lxrflx.exe 97 PID 5504 wrote to memory of 1332 5504 3lxrflx.exe 97 PID 1332 wrote to memory of 1816 1332 rxxrfxl.exe 98 PID 1332 wrote to memory of 1816 1332 rxxrfxl.exe 98 PID 1332 wrote to memory of 1816 1332 rxxrfxl.exe 98 PID 1816 wrote to memory of 5376 1816 tnhbbb.exe 99 PID 1816 wrote to memory of 5376 1816 tnhbbb.exe 99 PID 1816 wrote to memory of 5376 1816 tnhbbb.exe 99 PID 5376 wrote to memory of 3848 5376 jjdpv.exe 100 PID 5376 wrote to memory of 3848 5376 jjdpv.exe 100 PID 5376 wrote to memory of 3848 5376 jjdpv.exe 100 PID 3848 wrote to memory of 5316 3848 ppvjj.exe 101 PID 3848 wrote to memory of 5316 3848 ppvjj.exe 101 PID 3848 wrote to memory of 5316 3848 ppvjj.exe 101 PID 5316 wrote to memory of 4484 5316 flrlllf.exe 102 PID 5316 wrote to memory of 4484 5316 flrlllf.exe 102 PID 5316 wrote to memory of 4484 5316 flrlllf.exe 102 PID 4484 wrote to memory of 3460 4484 nhtnnh.exe 103 PID 4484 wrote to memory of 3460 4484 nhtnnh.exe 103 PID 4484 wrote to memory of 3460 4484 nhtnnh.exe 103 PID 3460 wrote to memory of 5240 3460 7dvjd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5228e4f9c2d26e1254da2340e7e89d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\rfrlfxl.exec:\rfrlfxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\xrrllfx.exec:\xrrllfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\3bbbnb.exec:\3bbbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\9ppdv.exec:\9ppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\vppdv.exec:\vppdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xflfrrl.exec:\xflfrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\hbhbtn.exec:\hbhbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\3hbbtn.exec:\3hbbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\jddvv.exec:\jddvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xlrflrl.exec:\xlrflrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\fffxrlx.exec:\fffxrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6092 -
\??\c:\5bhbhh.exec:\5bhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\vddvp.exec:\vddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\3lxrflx.exec:\3lxrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5504 -
\??\c:\rxxrfxl.exec:\rxxrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\tnhbbb.exec:\tnhbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jjdpv.exec:\jjdpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
\??\c:\ppvjj.exec:\ppvjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\flrlllf.exec:\flrlllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5316 -
\??\c:\nhtnnh.exec:\nhtnnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\7dvjd.exec:\7dvjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\7jjdv.exec:\7jjdv.exe23⤵
- Executes dropped EXE
PID:5240 -
\??\c:\3lxfrll.exec:\3lxfrll.exe24⤵
- Executes dropped EXE
PID:4356 -
\??\c:\1hbtnn.exec:\1hbtnn.exe25⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vjdvp.exec:\vjdvp.exe26⤵
- Executes dropped EXE
PID:4620 -
\??\c:\jdvjd.exec:\jdvjd.exe27⤵
- Executes dropped EXE
PID:5132 -
\??\c:\frrlflr.exec:\frrlflr.exe28⤵
- Executes dropped EXE
PID:1220 -
\??\c:\tnbnht.exec:\tnbnht.exe29⤵
- Executes dropped EXE
PID:3688 -
\??\c:\nhhtbn.exec:\nhhtbn.exe30⤵
- Executes dropped EXE
PID:6120 -
\??\c:\jvjdv.exec:\jvjdv.exe31⤵
- Executes dropped EXE
PID:4720 -
\??\c:\fxrfrff.exec:\fxrfrff.exe32⤵
- Executes dropped EXE
PID:5804 -
\??\c:\rxxxrlf.exec:\rxxxrlf.exe33⤵
- Executes dropped EXE
PID:4520 -
\??\c:\btbbtt.exec:\btbbtt.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jdjdv.exec:\jdjdv.exe35⤵
- Executes dropped EXE
PID:2156 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe36⤵
- Executes dropped EXE
PID:3416 -
\??\c:\rffrllf.exec:\rffrllf.exe37⤵
- Executes dropped EXE
PID:5768 -
\??\c:\btthnb.exec:\btthnb.exe38⤵
- Executes dropped EXE
PID:5776 -
\??\c:\9vvpj.exec:\9vvpj.exe39⤵
- Executes dropped EXE
PID:5336 -
\??\c:\3llxxfx.exec:\3llxxfx.exe40⤵
- Executes dropped EXE
PID:368 -
\??\c:\xllfxrl.exec:\xllfxrl.exe41⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nbhtnt.exec:\nbhtnt.exe42⤵
- Executes dropped EXE
PID:4368 -
\??\c:\vddvd.exec:\vddvd.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\9jjvj.exec:\9jjvj.exe44⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lrrfrrf.exec:\lrrfrrf.exe45⤵
- Executes dropped EXE
PID:3328 -
\??\c:\hhtnhb.exec:\hhtnhb.exe46⤵
- Executes dropped EXE
PID:3344 -
\??\c:\pvvpd.exec:\pvvpd.exe47⤵
- Executes dropped EXE
PID:4172 -
\??\c:\pvvpd.exec:\pvvpd.exe48⤵
- Executes dropped EXE
PID:3532 -
\??\c:\lflfxxr.exec:\lflfxxr.exe49⤵
- Executes dropped EXE
PID:3624 -
\??\c:\bbhnbn.exec:\bbhnbn.exe50⤵
- Executes dropped EXE
PID:6088 -
\??\c:\jjvdd.exec:\jjvdd.exe51⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lrxrffx.exec:\lrxrffx.exe52⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xffrllr.exec:\xffrllr.exe53⤵
- Executes dropped EXE
PID:4692 -
\??\c:\thhttb.exec:\thhttb.exe54⤵
- Executes dropped EXE
PID:1880 -
\??\c:\dpppd.exec:\dpppd.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\rflfrlf.exec:\rflfrlf.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\btbtnb.exec:\btbtnb.exe57⤵
- Executes dropped EXE
PID:6032 -
\??\c:\vvddv.exec:\vvddv.exe58⤵
- Executes dropped EXE
PID:1988 -
\??\c:\3xfrrrl.exec:\3xfrrrl.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nbhbnn.exec:\nbhbnn.exe60⤵
- Executes dropped EXE
PID:5424 -
\??\c:\htnnht.exec:\htnnht.exe61⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vdjdd.exec:\vdjdd.exe62⤵
- Executes dropped EXE
PID:3492 -
\??\c:\flfllxl.exec:\flfllxl.exe63⤵
- Executes dropped EXE
PID:3044 -
\??\c:\fflxrxx.exec:\fflxrxx.exe64⤵
- Executes dropped EXE
PID:4128 -
\??\c:\9ntttt.exec:\9ntttt.exe65⤵
- Executes dropped EXE
PID:4528 -
\??\c:\9dvjd.exec:\9dvjd.exe66⤵PID:5160
-
\??\c:\lfxrrlr.exec:\lfxrrlr.exe67⤵PID:5544
-
\??\c:\9xlfffx.exec:\9xlfffx.exe68⤵PID:4580
-
\??\c:\nbtbnh.exec:\nbtbnh.exe69⤵PID:392
-
\??\c:\pjpdv.exec:\pjpdv.exe70⤵PID:2092
-
\??\c:\9rxrrrf.exec:\9rxrrrf.exe71⤵PID:5020
-
\??\c:\bbhhbt.exec:\bbhhbt.exe72⤵PID:1876
-
\??\c:\nnnbtt.exec:\nnnbtt.exe73⤵PID:2268
-
\??\c:\vvjvp.exec:\vvjvp.exe74⤵PID:1096
-
\??\c:\5rfxrlf.exec:\5rfxrlf.exe75⤵PID:4696
-
\??\c:\rllffff.exec:\rllffff.exe76⤵PID:1208
-
\??\c:\5hbnhh.exec:\5hbnhh.exe77⤵PID:5992
-
\??\c:\dppjd.exec:\dppjd.exe78⤵PID:3012
-
\??\c:\djdpv.exec:\djdpv.exe79⤵PID:2448
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe80⤵PID:6084
-
\??\c:\3hhbtt.exec:\3hhbtt.exe81⤵PID:5492
-
\??\c:\9hnnnn.exec:\9hnnnn.exe82⤵PID:5740
-
\??\c:\vjdvd.exec:\vjdvd.exe83⤵PID:1912
-
\??\c:\1xlrrfl.exec:\1xlrrfl.exe84⤵PID:1124
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe85⤵PID:4496
-
\??\c:\nhbtbt.exec:\nhbtbt.exe86⤵PID:836
-
\??\c:\5pjdv.exec:\5pjdv.exe87⤵PID:1944
-
\??\c:\rxxrffx.exec:\rxxrffx.exe88⤵PID:4480
-
\??\c:\rxxllxx.exec:\rxxllxx.exe89⤵PID:4672
-
\??\c:\nhtnhb.exec:\nhtnhb.exe90⤵PID:4208
-
\??\c:\btbbtn.exec:\btbbtn.exe91⤵PID:1404
-
\??\c:\7hbtnh.exec:\7hbtnh.exe92⤵PID:1012
-
\??\c:\pdpjd.exec:\pdpjd.exe93⤵PID:2364
-
\??\c:\dppjv.exec:\dppjv.exe94⤵PID:2980
-
\??\c:\9lrfxrr.exec:\9lrfxrr.exe95⤵PID:4372
-
\??\c:\ttnntt.exec:\ttnntt.exe96⤵PID:452
-
\??\c:\3hnntt.exec:\3hnntt.exe97⤵PID:424
-
\??\c:\ppvpd.exec:\ppvpd.exe98⤵PID:1588
-
\??\c:\rrrllrr.exec:\rrrllrr.exe99⤵PID:6092
-
\??\c:\3nnbtt.exec:\3nnbtt.exe100⤵PID:1824
-
\??\c:\hhhbbb.exec:\hhhbbb.exe101⤵PID:4044
-
\??\c:\1pppd.exec:\1pppd.exe102⤵PID:5724
-
\??\c:\rfflfll.exec:\rfflfll.exe103⤵PID:5808
-
\??\c:\tbnhbb.exec:\tbnhbb.exe104⤵PID:884
-
\??\c:\nnbnhh.exec:\nnbnhh.exe105⤵PID:1816
-
\??\c:\vdjdj.exec:\vdjdj.exe106⤵PID:5376
-
\??\c:\rrxlxxr.exec:\rrxlxxr.exe107⤵PID:3848
-
\??\c:\lfflrrl.exec:\lfflrrl.exe108⤵PID:4048
-
\??\c:\hnthhh.exec:\hnthhh.exe109⤵PID:5356
-
\??\c:\jjddd.exec:\jjddd.exe110⤵PID:4212
-
\??\c:\xfrrllx.exec:\xfrrllx.exe111⤵PID:4084
-
\??\c:\xxrrffl.exec:\xxrrffl.exe112⤵PID:4004
-
\??\c:\nhbbbn.exec:\nhbbbn.exe113⤵PID:3488
-
\??\c:\jpjpd.exec:\jpjpd.exe114⤵PID:5672
-
\??\c:\xffrlfx.exec:\xffrlfx.exe115⤵PID:3688
-
\??\c:\rxxrlff.exec:\rxxrlff.exe116⤵PID:5616
-
\??\c:\nbbbbb.exec:\nbbbbb.exe117⤵PID:5788
-
\??\c:\9ppdp.exec:\9ppdp.exe118⤵PID:4100
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe119⤵PID:1752
-
\??\c:\3llllll.exec:\3llllll.exe120⤵PID:3644
-
\??\c:\1nhnhh.exec:\1nhnhh.exe121⤵PID:3132
-
\??\c:\ppjvv.exec:\ppjvv.exe122⤵PID:5644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-