Analysis
- max time kernel
150s - max time network
52s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 04:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe
- Size 273KB
- Sample240614-ey3c7aveja
- SHA256 c94b0d13fadbf86e83dbbb453ecd392ccd9b957cfc4c586a3d6a11e34035e734
- MD5 a1ccad9bb0c76f6659888897de842240
- SHA1 6b71df17c4f3e5cbdd031d269af6d0e503a1910f
- SHA512 2601026ff6bd34f3c4c28550f90cecc0b9d3bb89eb64e214df8d48fd47a5daa18549967759eea0a7d5f3fb7ff7ea4c604e6dfc10fe6685319d14e648e62fb1dd
- SSDEEP 3072:8hOm2sI93UufdC67cimD5t251UrRE9TTFD:8cm7ImGddXmNt251UriZFD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/716-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2332-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4804-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/612-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3784-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4456-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2920-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4112-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3172-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2444-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1092-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4316-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1276-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4820-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3660-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5072-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3804-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1524-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1504-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4416-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2680-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2384-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4896-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4844-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4872-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4544-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1532-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1152-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2600-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4852-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1456-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1540-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3156-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4488-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/224-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2652-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/860-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1032-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1996-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/556-573-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4864-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1108-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1688-732-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2684-910-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-911-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3852-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4196-1155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2300-1172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2332 1fllfff.exe 1860 hnhhbb.exe 4804 7vjjj.exe 3008 bbbnhn.exe 372 9rffrfr.exe 612 tbbhnb.exe 3784 xrrrrxx.exe 4456 rrxllxx.exe 2920 xxflrfx.exe 4872 vjppp.exe 3172 pvppp.exe 5080 bbhbnh.exe 1580 vvppd.exe 4112 rfflfrr.exe 1532 hbhhhn.exe 4480 jjvvv.exe 4576 rlfffff.exe 2652 3ttttb.exe 2108 jpddj.exe 2444 fffxlrl.exe 1092 bttttn.exe 4316 vjvpp.exe 3224 jdpdd.exe 1276 xxlxrff.exe 4852 hbhtbb.exe 4820 jjvvj.exe 4216 rffrrlx.exe 4344 ttnntt.exe 3660 ppppp.exe 4700 1lrrfll.exe 5072 nnnttt.exe 1252 ddvvv.exe 4864 5lrrlll.exe 3804 nhnthn.exe 1524 jjjjj.exe 3176 xffxxxx.exe 1504 1xlfrxf.exe 3492 bbhhhh.exe 2768 ddddv.exe 3944 jjvdp.exe 1968 bbhnnt.exe 4416 bbnttb.exe 2948 7pdvj.exe 2680 lxfffxl.exe 4920 3xffxxx.exe 2384 bnbbbh.exe 796 jdpvv.exe 1064 pjpvp.exe 4896 lfxrrfl.exe 4204 bnnttb.exe 4844 3tbttb.exe 3144 pdjjd.exe 1184 xxxfflf.exe 1172 rrrrrxx.exe 3160 tnhbbh.exe 4872 vjjdd.exe 1068 xfxxxfx.exe 2292 frffxff.exe 3040 hhnntt.exe 2268 jpddj.exe 4544 llxrxrf.exe 4816 3xfxrfx.exe 1532 1bbtnh.exe 4296 jjpjj.exe -
resource yara_rule behavioral2/memory/716-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2332-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1860-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4804-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/612-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/612-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3784-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2920-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4112-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3172-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2444-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1092-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4316-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3224-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1276-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4820-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3660-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5072-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1252-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4864-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3804-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1524-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1504-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4416-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2680-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2384-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1064-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4896-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4844-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4872-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2292-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3040-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4544-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1532-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4900-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1152-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2600-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4852-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1456-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1540-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3156-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4488-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/224-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2652-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/860-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1032-519-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 2332 716 a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe 81 PID 716 wrote to memory of 2332 716 a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe 81 PID 716 wrote to memory of 2332 716 a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe 81 PID 2332 wrote to memory of 1860 2332 1fllfff.exe 82 PID 2332 wrote to memory of 1860 2332 1fllfff.exe 82 PID 2332 wrote to memory of 1860 2332 1fllfff.exe 82 PID 1860 wrote to memory of 4804 1860 hnhhbb.exe 83 PID 1860 wrote to memory of 4804 1860 hnhhbb.exe 83 PID 1860 wrote to memory of 4804 1860 hnhhbb.exe 83 PID 4804 wrote to memory of 3008 4804 7vjjj.exe 84 PID 4804 wrote to memory of 3008 4804 7vjjj.exe 84 PID 4804 wrote to memory of 3008 4804 7vjjj.exe 84 PID 3008 wrote to memory of 372 3008 bbbnhn.exe 85 PID 3008 wrote to memory of 372 3008 bbbnhn.exe 85 PID 3008 wrote to memory of 372 3008 bbbnhn.exe 85 PID 372 wrote to memory of 612 372 9rffrfr.exe 86 PID 372 wrote to memory of 612 372 9rffrfr.exe 86 PID 372 wrote to memory of 612 372 9rffrfr.exe 86 PID 612 wrote to memory of 3784 612 tbbhnb.exe 87 PID 612 wrote to memory of 3784 612 tbbhnb.exe 87 PID 612 wrote to memory of 3784 612 tbbhnb.exe 87 PID 3784 wrote to memory of 4456 3784 xrrrrxx.exe 88 PID 3784 wrote to memory of 4456 3784 xrrrrxx.exe 88 PID 3784 wrote to memory of 4456 3784 xrrrrxx.exe 88 PID 4456 wrote to memory of 2920 4456 rrxllxx.exe 90 PID 4456 wrote to memory of 2920 4456 rrxllxx.exe 90 PID 4456 wrote to memory of 2920 4456 rrxllxx.exe 90 PID 2920 wrote to memory of 4872 2920 xxflrfx.exe 92 PID 2920 wrote to memory of 4872 2920 xxflrfx.exe 92 PID 2920 wrote to memory of 4872 2920 xxflrfx.exe 92 PID 4872 wrote to memory of 3172 4872 vjppp.exe 93 PID 4872 wrote to memory of 3172 4872 vjppp.exe 93 PID 4872 wrote to memory of 3172 4872 vjppp.exe 93 PID 3172 wrote to memory of 5080 3172 pvppp.exe 94 PID 3172 wrote to memory of 5080 3172 pvppp.exe 94 PID 3172 wrote to memory of 5080 3172 pvppp.exe 94 PID 5080 wrote to memory of 1580 5080 bbhbnh.exe 95 PID 5080 wrote to memory of 1580 5080 bbhbnh.exe 95 PID 5080 wrote to memory of 1580 5080 bbhbnh.exe 95 PID 1580 wrote to memory of 4112 1580 vvppd.exe 96 PID 1580 wrote to memory of 4112 1580 vvppd.exe 96 PID 1580 wrote to memory of 4112 1580 vvppd.exe 96 PID 4112 wrote to memory of 1532 4112 rfflfrr.exe 98 PID 4112 wrote to memory of 1532 4112 rfflfrr.exe 98 PID 4112 wrote to memory of 1532 4112 rfflfrr.exe 98 PID 1532 wrote to memory of 4480 1532 hbhhhn.exe 99 PID 1532 wrote to memory of 4480 1532 hbhhhn.exe 99 PID 1532 wrote to memory of 4480 1532 hbhhhn.exe 99 PID 4480 wrote to memory of 4576 4480 jjvvv.exe 100 PID 4480 wrote to memory of 4576 4480 jjvvv.exe 100 PID 4480 wrote to memory of 4576 4480 jjvvv.exe 100 PID 4576 wrote to memory of 2652 4576 rlfffff.exe 101 PID 4576 wrote to memory of 2652 4576 rlfffff.exe 101 PID 4576 wrote to memory of 2652 4576 rlfffff.exe 101 PID 2652 wrote to memory of 2108 2652 3ttttb.exe 102 PID 2652 wrote to memory of 2108 2652 3ttttb.exe 102 PID 2652 wrote to memory of 2108 2652 3ttttb.exe 102 PID 2108 wrote to memory of 2444 2108 jpddj.exe 103 PID 2108 wrote to memory of 2444 2108 jpddj.exe 103 PID 2108 wrote to memory of 2444 2108 jpddj.exe 103 PID 2444 wrote to memory of 1092 2444 fffxlrl.exe 104 PID 2444 wrote to memory of 1092 2444 fffxlrl.exe 104 PID 2444 wrote to memory of 1092 2444 fffxlrl.exe 104 PID 1092 wrote to memory of 4316 1092 bttttn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1ccad9bb0c76f6659888897de842240_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\1fllfff.exec:\1fllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hnhhbb.exec:\hnhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\7vjjj.exec:\7vjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\bbbnhn.exec:\bbbnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9rffrfr.exec:\9rffrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\tbbhnb.exec:\tbbhnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\rrxllxx.exec:\rrxllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\xxflrfx.exec:\xxflrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vjppp.exec:\vjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\pvppp.exec:\pvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\bbhbnh.exec:\bbhbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\vvppd.exec:\vvppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\rfflfrr.exec:\rfflfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\hbhhhn.exec:\hbhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jjvvv.exec:\jjvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\rlfffff.exec:\rlfffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\3ttttb.exec:\3ttttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jpddj.exec:\jpddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\fffxlrl.exec:\fffxlrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\bttttn.exec:\bttttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vjvpp.exec:\vjvpp.exe23⤵
- Executes dropped EXE
PID:4316 -
\??\c:\jdpdd.exec:\jdpdd.exe24⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xxlxrff.exec:\xxlxrff.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbhtbb.exec:\hbhtbb.exe26⤵
- Executes dropped EXE
PID:4852 -
\??\c:\jjvvj.exec:\jjvvj.exe27⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rffrrlx.exec:\rffrrlx.exe28⤵
- Executes dropped EXE
PID:4216 -
\??\c:\ttnntt.exec:\ttnntt.exe29⤵
- Executes dropped EXE
PID:4344 -
\??\c:\ppppp.exec:\ppppp.exe30⤵
- Executes dropped EXE
PID:3660 -
\??\c:\1lrrfll.exec:\1lrrfll.exe31⤵
- Executes dropped EXE
PID:4700 -
\??\c:\nnnttt.exec:\nnnttt.exe32⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ddvvv.exec:\ddvvv.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5lrrlll.exec:\5lrrlll.exe34⤵
- Executes dropped EXE
PID:4864 -
\??\c:\nhnthn.exec:\nhnthn.exe35⤵
- Executes dropped EXE
PID:3804 -
\??\c:\jjjjj.exec:\jjjjj.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\xffxxxx.exec:\xffxxxx.exe37⤵
- Executes dropped EXE
PID:3176 -
\??\c:\1xlfrxf.exec:\1xlfrxf.exe38⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bbhhhh.exec:\bbhhhh.exe39⤵
- Executes dropped EXE
PID:3492 -
\??\c:\ddddv.exec:\ddddv.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jjvdp.exec:\jjvdp.exe41⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lfllffx.exec:\lfllffx.exe42⤵PID:5048
-
\??\c:\bbhnnt.exec:\bbhnnt.exe43⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bbnttb.exec:\bbnttb.exe44⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7pdvj.exec:\7pdvj.exe45⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lxfffxl.exec:\lxfffxl.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\3xffxxx.exec:\3xffxxx.exe47⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bnbbbh.exec:\bnbbbh.exe48⤵
- Executes dropped EXE
PID:2384 -
\??\c:\jdpvv.exec:\jdpvv.exe49⤵
- Executes dropped EXE
PID:796 -
\??\c:\pjpvp.exec:\pjpvp.exe50⤵
- Executes dropped EXE
PID:1064 -
\??\c:\lfxrrfl.exec:\lfxrrfl.exe51⤵
- Executes dropped EXE
PID:4896 -
\??\c:\bnnttb.exec:\bnnttb.exe52⤵
- Executes dropped EXE
PID:4204 -
\??\c:\3tbttb.exec:\3tbttb.exe53⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pdjjd.exec:\pdjjd.exe54⤵
- Executes dropped EXE
PID:3144 -
\??\c:\xxxfflf.exec:\xxxfflf.exe55⤵
- Executes dropped EXE
PID:1184 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe56⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tnhbbh.exec:\tnhbbh.exe57⤵
- Executes dropped EXE
PID:3160 -
\??\c:\vjjdd.exec:\vjjdd.exe58⤵
- Executes dropped EXE
PID:4872 -
\??\c:\xfxxxfx.exec:\xfxxxfx.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\frffxff.exec:\frffxff.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hhnntt.exec:\hhnntt.exe61⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jpddj.exec:\jpddj.exe62⤵
- Executes dropped EXE
PID:2268 -
\??\c:\llxrxrf.exec:\llxrxrf.exe63⤵
- Executes dropped EXE
PID:4544 -
\??\c:\3xfxrfx.exec:\3xfxrfx.exe64⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1bbtnh.exec:\1bbtnh.exe65⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jjpjj.exec:\jjpjj.exe66⤵
- Executes dropped EXE
PID:4296 -
\??\c:\dvddp.exec:\dvddp.exe67⤵PID:4388
-
\??\c:\ffllrxx.exec:\ffllrxx.exe68⤵PID:4900
-
\??\c:\htbnnh.exec:\htbnnh.exe69⤵PID:2184
-
\??\c:\pjjjd.exec:\pjjjd.exe70⤵PID:2132
-
\??\c:\7jvpp.exec:\7jvpp.exe71⤵PID:1152
-
\??\c:\fflllrl.exec:\fflllrl.exe72⤵PID:4308
-
\??\c:\btbbbh.exec:\btbbbh.exe73⤵PID:2600
-
\??\c:\tnbhhb.exec:\tnbhhb.exe74⤵PID:2872
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:1416
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe76⤵PID:1568
-
\??\c:\lrxxfxr.exec:\lrxxfxr.exe77⤵PID:3224
-
\??\c:\nbnnhh.exec:\nbnnhh.exe78⤵PID:2700
-
\??\c:\jjjdd.exec:\jjjdd.exe79⤵PID:3808
-
\??\c:\dppjj.exec:\dppjj.exe80⤵PID:4852
-
\??\c:\flrrrrr.exec:\flrrrrr.exe81⤵PID:1012
-
\??\c:\nhtnhh.exec:\nhtnhh.exe82⤵PID:1456
-
\??\c:\3nnnhh.exec:\3nnnhh.exe83⤵PID:1540
-
\??\c:\dvpjj.exec:\dvpjj.exe84⤵PID:4672
-
\??\c:\dvpjd.exec:\dvpjd.exe85⤵PID:3660
-
\??\c:\rlffxxx.exec:\rlffxxx.exe86⤵PID:3156
-
\??\c:\3nbbbh.exec:\3nbbbh.exe87⤵PID:5012
-
\??\c:\hnnbhb.exec:\hnnbhb.exe88⤵PID:1424
-
\??\c:\jdjjd.exec:\jdjjd.exe89⤵PID:952
-
\??\c:\ffrlflf.exec:\ffrlflf.exe90⤵PID:4864
-
\??\c:\xrxfllx.exec:\xrxfllx.exe91⤵PID:4528
-
\??\c:\bhtbnn.exec:\bhtbnn.exe92⤵PID:924
-
\??\c:\hbhbbb.exec:\hbhbbb.exe93⤵PID:640
-
\??\c:\pddjd.exec:\pddjd.exe94⤵PID:3308
-
\??\c:\5fxxrrr.exec:\5fxxrrr.exe95⤵PID:3852
-
\??\c:\1ffffrf.exec:\1ffffrf.exe96⤵PID:3492
-
\??\c:\hhhnnn.exec:\hhhnnn.exe97⤵PID:2768
-
\??\c:\pjdvv.exec:\pjdvv.exe98⤵PID:4488
-
\??\c:\3dppv.exec:\3dppv.exe99⤵PID:2476
-
\??\c:\llxrrrr.exec:\llxrrrr.exe100⤵PID:3580
-
\??\c:\nhhhhn.exec:\nhhhhn.exe101⤵PID:1860
-
\??\c:\9rrlffx.exec:\9rrlffx.exe102⤵PID:2344
-
\??\c:\tnbttb.exec:\tnbttb.exe103⤵PID:336
-
\??\c:\nhhttt.exec:\nhhttt.exe104⤵PID:4028
-
\??\c:\xllffff.exec:\xllffff.exe105⤵PID:3008
-
\??\c:\1htnnn.exec:\1htnnn.exe106⤵PID:4800
-
\??\c:\htbbtb.exec:\htbbtb.exe107⤵PID:4912
-
\??\c:\jdvpj.exec:\jdvpj.exe108⤵PID:1836
-
\??\c:\lxffxff.exec:\lxffxff.exe109⤵PID:2388
-
\??\c:\htbtnh.exec:\htbtnh.exe110⤵PID:32
-
\??\c:\9ttnbt.exec:\9ttnbt.exe111⤵PID:4456
-
\??\c:\1ddvd.exec:\1ddvd.exe112⤵PID:3684
-
\??\c:\vjpjj.exec:\vjpjj.exe113⤵PID:3672
-
\??\c:\fxxrffr.exec:\fxxrffr.exe114⤵PID:396
-
\??\c:\vpvjv.exec:\vpvjv.exe115⤵PID:208
-
\??\c:\dvvpj.exec:\dvvpj.exe116⤵PID:824
-
\??\c:\lxxxrff.exec:\lxxxrff.exe117⤵PID:3172
-
\??\c:\hhnbht.exec:\hhnbht.exe118⤵PID:2292
-
\??\c:\nbtnbb.exec:\nbtnbb.exe119⤵PID:5036
-
\??\c:\pvpjv.exec:\pvpjv.exe120⤵PID:3472
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe121⤵PID:224
-
\??\c:\lfllrrx.exec:\lfllrrx.exe122⤵PID:4472
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-