Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
15/06/2024, 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe
- Size 487KB
- Sample240615-3tapdazele
- SHA256 eed460b50f36d8b9962a300e6f5ab71cddccf1d0a9731c9f2e30c7829f0324fd
- MD5 c396dcdaf089bd6209eb37df46636a20
- SHA1 c85c66314be9e4020ab96c05a76100efc64f644f
- SHA512 e78c0c792886515b8d457066ec0ea3df122691e3ba86f3a8b51a12748799b56dea855ae286423755e3913d6ef13602bfef645ceda4a27321f55bbf5328e1b768
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPBV:q7Tc2NYHUrAwqzQ7PPr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1152-4-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/992-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3980-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4916-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2308-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3196-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/264-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/408-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2192-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2108-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4680-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4576-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2012-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4164-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/412-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2580-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4500-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1948-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/664-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3724-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3564-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3060-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2128-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4684-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3548-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1596-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1244-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2140-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1308-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4264-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2604-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3440-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4512-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4368-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5080-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4304-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4792-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1916-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3100-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2640-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4180-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2396-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3996-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3704-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3600-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5008-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4340-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1804-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2568-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1416-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/552-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4420-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1196-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1364-565-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2204-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3792-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3904-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4324-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2304-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 992 nhhbbb.exe 264 nnhbnn.exe 3196 ppvpj.exe 2308 xllfxxr.exe 4916 hthbbt.exe 3980 tbnbtn.exe 408 vppjd.exe 2192 jpdvd.exe 2108 ppdvd.exe 4448 vdjjd.exe 4680 tnbbhn.exe 4576 pvjdd.exe 2012 9hnhhh.exe 5080 ppddv.exe 4164 xrxxrrl.exe 412 rrxrrrl.exe 4500 bbbbtt.exe 2580 vjvvp.exe 2504 nntnnn.exe 1948 nhhhtb.exe 4760 pvjvd.exe 664 fxllffl.exe 3724 nntttt.exe 2304 djpjj.exe 968 lflfflf.exe 3564 xxllfff.exe 2124 vvvvd.exe 3268 hnhnnt.exe 3060 5hthbt.exe 3796 rxrxxff.exe 2128 thhnhn.exe 3036 xrfllrx.exe 2528 7dppp.exe 1896 xxlrrxx.exe 4684 5tbbbh.exe 3548 9jvpv.exe 1596 xrxlrxx.exe 1244 xffxlrr.exe 5008 tbntbh.exe 2140 3dppp.exe 1308 flrxxxf.exe 4552 rrrrxll.exe 5108 hbnnnt.exe 4352 5vjdj.exe 4340 9lrllrl.exe 3756 tbttnb.exe 3940 ppppj.exe 4120 fllffff.exe 264 bhtbnn.exe 2308 pdjjj.exe 4436 vpvpd.exe 2948 rxlrxfl.exe 4064 nnttbb.exe 4016 vdvpp.exe 3328 jjppp.exe 1772 lrffrrf.exe 2892 tththn.exe 4568 pjddd.exe 4980 5rrllll.exe 4264 xfrflxf.exe 2604 btbbtt.exe 2196 vvddd.exe 3440 fxfxxrr.exe 1164 lrfxxxx.exe -
resource yara_rule behavioral2/memory/1152-4-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/992-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3980-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4916-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2308-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/264-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/408-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2192-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4448-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2108-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4680-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4576-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2012-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4164-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/412-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2580-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4500-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1948-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/664-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2304-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3724-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3564-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3060-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2128-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1896-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4684-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3548-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1596-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1244-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2140-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1308-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4264-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2604-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3440-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4512-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4368-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5080-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4304-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4792-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1916-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3100-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2640-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4180-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2396-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3996-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3704-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3600-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5008-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5036-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4340-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3328-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4568-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1804-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2532-496-0x0000000000400000-0x000000000042A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 992 1152 c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe 82 PID 1152 wrote to memory of 992 1152 c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe 82 PID 1152 wrote to memory of 992 1152 c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe 82 PID 992 wrote to memory of 264 992 nhhbbb.exe 83 PID 992 wrote to memory of 264 992 nhhbbb.exe 83 PID 992 wrote to memory of 264 992 nhhbbb.exe 83 PID 264 wrote to memory of 3196 264 nnhbnn.exe 84 PID 264 wrote to memory of 3196 264 nnhbnn.exe 84 PID 264 wrote to memory of 3196 264 nnhbnn.exe 84 PID 3196 wrote to memory of 2308 3196 ppvpj.exe 85 PID 3196 wrote to memory of 2308 3196 ppvpj.exe 85 PID 3196 wrote to memory of 2308 3196 ppvpj.exe 85 PID 2308 wrote to memory of 4916 2308 xllfxxr.exe 86 PID 2308 wrote to memory of 4916 2308 xllfxxr.exe 86 PID 2308 wrote to memory of 4916 2308 xllfxxr.exe 86 PID 4916 wrote to memory of 3980 4916 hthbbt.exe 87 PID 4916 wrote to memory of 3980 4916 hthbbt.exe 87 PID 4916 wrote to memory of 3980 4916 hthbbt.exe 87 PID 3980 wrote to memory of 408 3980 tbnbtn.exe 88 PID 3980 wrote to memory of 408 3980 tbnbtn.exe 88 PID 3980 wrote to memory of 408 3980 tbnbtn.exe 88 PID 408 wrote to memory of 2192 408 vppjd.exe 89 PID 408 wrote to memory of 2192 408 vppjd.exe 89 PID 408 wrote to memory of 2192 408 vppjd.exe 89 PID 2192 wrote to memory of 2108 2192 jpdvd.exe 90 PID 2192 wrote to memory of 2108 2192 jpdvd.exe 90 PID 2192 wrote to memory of 2108 2192 jpdvd.exe 90 PID 2108 wrote to memory of 4448 2108 ppdvd.exe 92 PID 2108 wrote to memory of 4448 2108 ppdvd.exe 92 PID 2108 wrote to memory of 4448 2108 ppdvd.exe 92 PID 4448 wrote to memory of 4680 4448 vdjjd.exe 94 PID 4448 wrote to memory of 4680 4448 vdjjd.exe 94 PID 4448 wrote to memory of 4680 4448 vdjjd.exe 94 PID 4680 wrote to memory of 4576 4680 tnbbhn.exe 95 PID 4680 wrote to memory of 4576 4680 tnbbhn.exe 95 PID 4680 wrote to memory of 4576 4680 tnbbhn.exe 95 PID 4576 wrote to memory of 2012 4576 pvjdd.exe 96 PID 4576 wrote to memory of 2012 4576 pvjdd.exe 96 PID 4576 wrote to memory of 2012 4576 pvjdd.exe 96 PID 2012 wrote to memory of 5080 2012 9hnhhh.exe 97 PID 2012 wrote to memory of 5080 2012 9hnhhh.exe 97 PID 2012 wrote to memory of 5080 2012 9hnhhh.exe 97 PID 5080 wrote to memory of 4164 5080 ppddv.exe 98 PID 5080 wrote to memory of 4164 5080 ppddv.exe 98 PID 5080 wrote to memory of 4164 5080 ppddv.exe 98 PID 4164 wrote to memory of 412 4164 xrxxrrl.exe 99 PID 4164 wrote to memory of 412 4164 xrxxrrl.exe 99 PID 4164 wrote to memory of 412 4164 xrxxrrl.exe 99 PID 412 wrote to memory of 4500 412 rrxrrrl.exe 100 PID 412 wrote to memory of 4500 412 rrxrrrl.exe 100 PID 412 wrote to memory of 4500 412 rrxrrrl.exe 100 PID 4500 wrote to memory of 2580 4500 bbbbtt.exe 102 PID 4500 wrote to memory of 2580 4500 bbbbtt.exe 102 PID 4500 wrote to memory of 2580 4500 bbbbtt.exe 102 PID 2580 wrote to memory of 2504 2580 vjvvp.exe 103 PID 2580 wrote to memory of 2504 2580 vjvvp.exe 103 PID 2580 wrote to memory of 2504 2580 vjvvp.exe 103 PID 2504 wrote to memory of 1948 2504 nntnnn.exe 104 PID 2504 wrote to memory of 1948 2504 nntnnn.exe 104 PID 2504 wrote to memory of 1948 2504 nntnnn.exe 104 PID 1948 wrote to memory of 4760 1948 nhhhtb.exe 105 PID 1948 wrote to memory of 4760 1948 nhhhtb.exe 105 PID 1948 wrote to memory of 4760 1948 nhhhtb.exe 105 PID 4760 wrote to memory of 664 4760 pvjvd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c396dcdaf089bd6209eb37df46636a20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\nhhbbb.exec:\nhhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\nnhbnn.exec:\nnhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\ppvpj.exec:\ppvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\xllfxxr.exec:\xllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hthbbt.exec:\hthbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\tbnbtn.exec:\tbnbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\vppjd.exec:\vppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\jpdvd.exec:\jpdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ppdvd.exec:\ppdvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vdjjd.exec:\vdjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\tnbbhn.exec:\tnbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pvjdd.exec:\pvjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\9hnhhh.exec:\9hnhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\ppddv.exec:\ppddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\xrxxrrl.exec:\xrxxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\bbbbtt.exec:\bbbbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\vjvvp.exec:\vjvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nntnnn.exec:\nntnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\nhhhtb.exec:\nhhhtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pvjvd.exec:\pvjvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\fxllffl.exec:\fxllffl.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\nntttt.exec:\nntttt.exe24⤵
- Executes dropped EXE
PID:3724 -
\??\c:\djpjj.exec:\djpjj.exe25⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lflfflf.exec:\lflfflf.exe26⤵
- Executes dropped EXE
PID:968 -
\??\c:\xxllfff.exec:\xxllfff.exe27⤵
- Executes dropped EXE
PID:3564 -
\??\c:\vvvvd.exec:\vvvvd.exe28⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnhnnt.exec:\hnhnnt.exe29⤵
- Executes dropped EXE
PID:3268 -
\??\c:\5hthbt.exec:\5hthbt.exe30⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rxrxxff.exec:\rxrxxff.exe31⤵
- Executes dropped EXE
PID:3796 -
\??\c:\thhnhn.exec:\thhnhn.exe32⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrfllrx.exec:\xrfllrx.exe33⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7dppp.exec:\7dppp.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xxlrrxx.exec:\xxlrrxx.exe35⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5tbbbh.exec:\5tbbbh.exe36⤵
- Executes dropped EXE
PID:4684 -
\??\c:\9jvpv.exec:\9jvpv.exe37⤵
- Executes dropped EXE
PID:3548 -
\??\c:\xrxlrxx.exec:\xrxlrxx.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xffxlrr.exec:\xffxlrr.exe39⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tbntbh.exec:\tbntbh.exe40⤵
- Executes dropped EXE
PID:5008 -
\??\c:\3dppp.exec:\3dppp.exe41⤵
- Executes dropped EXE
PID:2140 -
\??\c:\flrxxxf.exec:\flrxxxf.exe42⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rrrrxll.exec:\rrrrxll.exe43⤵
- Executes dropped EXE
PID:4552 -
\??\c:\hbnnnt.exec:\hbnnnt.exe44⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5vjdj.exec:\5vjdj.exe45⤵
- Executes dropped EXE
PID:4352 -
\??\c:\9lrllrl.exec:\9lrllrl.exe46⤵
- Executes dropped EXE
PID:4340 -
\??\c:\tbttnb.exec:\tbttnb.exe47⤵
- Executes dropped EXE
PID:3756 -
\??\c:\ppppj.exec:\ppppj.exe48⤵
- Executes dropped EXE
PID:3940 -
\??\c:\fllffff.exec:\fllffff.exe49⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bhtbnn.exec:\bhtbnn.exe50⤵
- Executes dropped EXE
PID:264 -
\??\c:\pdjjj.exec:\pdjjj.exe51⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpvpd.exec:\vpvpd.exe52⤵
- Executes dropped EXE
PID:4436 -
\??\c:\rxlrxfl.exec:\rxlrxfl.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnttbb.exec:\nnttbb.exe54⤵
- Executes dropped EXE
PID:4064 -
\??\c:\vdvpp.exec:\vdvpp.exe55⤵
- Executes dropped EXE
PID:4016 -
\??\c:\jjppp.exec:\jjppp.exe56⤵
- Executes dropped EXE
PID:3328 -
\??\c:\lrffrrf.exec:\lrffrrf.exe57⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tththn.exec:\tththn.exe58⤵
- Executes dropped EXE
PID:2892 -
\??\c:\pjddd.exec:\pjddd.exe59⤵
- Executes dropped EXE
PID:4568 -
\??\c:\5rrllll.exec:\5rrllll.exe60⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xfrflxf.exec:\xfrflxf.exe61⤵
- Executes dropped EXE
PID:4264 -
\??\c:\btbbtt.exec:\btbbtt.exe62⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vvddd.exec:\vvddd.exe63⤵
- Executes dropped EXE
PID:2196 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe64⤵
- Executes dropped EXE
PID:3440 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe65⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bthttb.exec:\bthttb.exe66⤵PID:4512
-
\??\c:\5pddj.exec:\5pddj.exe67⤵PID:4368
-
\??\c:\1xfffxl.exec:\1xfffxl.exe68⤵PID:5080
-
\??\c:\hhnnnn.exec:\hhnnnn.exe69⤵PID:4948
-
\??\c:\5vjjj.exec:\5vjjj.exe70⤵PID:2176
-
\??\c:\flxxllf.exec:\flxxllf.exe71⤵PID:436
-
\??\c:\nbbbbb.exec:\nbbbbb.exe72⤵PID:4304
-
\??\c:\tttnnn.exec:\tttnnn.exe73⤵PID:4792
-
\??\c:\ddddj.exec:\ddddj.exe74⤵PID:4524
-
\??\c:\fllrfll.exec:\fllrfll.exe75⤵PID:1080
-
\??\c:\xxrllfx.exec:\xxrllfx.exe76⤵PID:1916
-
\??\c:\nnbttt.exec:\nnbttt.exe77⤵PID:2504
-
\??\c:\rlllfxr.exec:\rlllfxr.exe78⤵PID:4992
-
\??\c:\btbthb.exec:\btbthb.exe79⤵PID:3100
-
\??\c:\dvvpd.exec:\dvvpd.exe80⤵PID:4960
-
\??\c:\lllfxrl.exec:\lllfxrl.exe81⤵PID:3724
-
\??\c:\hbnnhh.exec:\hbnnhh.exe82⤵PID:1056
-
\??\c:\bbthbn.exec:\bbthbn.exe83⤵PID:2640
-
\??\c:\vjdvv.exec:\vjdvv.exe84⤵PID:3520
-
\??\c:\9rlfxfx.exec:\9rlfxfx.exe85⤵PID:4180
-
\??\c:\nnhhhh.exec:\nnhhhh.exe86⤵PID:4676
-
\??\c:\7jjdj.exec:\7jjdj.exe87⤵PID:4452
-
\??\c:\dvppj.exec:\dvppj.exe88⤵PID:2396
-
\??\c:\frrxrlx.exec:\frrxrlx.exe89⤵PID:4964
-
\??\c:\5btnhh.exec:\5btnhh.exe90⤵PID:3060
-
\??\c:\pvpdv.exec:\pvpdv.exe91⤵PID:3412
-
\??\c:\rllfxrl.exec:\rllfxrl.exe92⤵PID:3996
-
\??\c:\ffxrlxr.exec:\ffxrlxr.exe93⤵PID:4660
-
\??\c:\hbnbhb.exec:\hbnbhb.exe94⤵PID:3740
-
\??\c:\pvjdv.exec:\pvjdv.exe95⤵PID:1944
-
\??\c:\jjpjd.exec:\jjpjd.exe96⤵PID:3704
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe97⤵PID:1156
-
\??\c:\ttnhbb.exec:\ttnhbb.exe98⤵PID:3548
-
\??\c:\dvpjd.exec:\dvpjd.exe99⤵PID:3296
-
\??\c:\9lrlrlf.exec:\9lrlrlf.exe100⤵PID:3600
-
\??\c:\fffxrll.exec:\fffxrll.exe101⤵PID:5008
-
\??\c:\djpjp.exec:\djpjp.exe102⤵PID:4908
-
\??\c:\lxlrlrx.exec:\lxlrlrx.exe103⤵PID:5036
-
\??\c:\xrxrllf.exec:\xrxrllf.exe104⤵PID:4552
-
\??\c:\htnhbt.exec:\htnhbt.exe105⤵PID:5108
-
\??\c:\3ppdv.exec:\3ppdv.exe106⤵PID:4352
-
\??\c:\rrxxfll.exec:\rrxxfll.exe107⤵PID:4340
-
\??\c:\bhtnnn.exec:\bhtnnn.exe108⤵PID:4492
-
\??\c:\vpvdd.exec:\vpvdd.exe109⤵PID:3940
-
\??\c:\xrfffxx.exec:\xrfffxx.exe110⤵PID:3172
-
\??\c:\rxfxrrf.exec:\rxfxrrf.exe111⤵PID:3436
-
\??\c:\hhhnhb.exec:\hhhnhb.exe112⤵PID:2308
-
\??\c:\dpddp.exec:\dpddp.exe113⤵PID:2596
-
\??\c:\dvppp.exec:\dvppp.exe114⤵PID:2712
-
\??\c:\fxxxxff.exec:\fxxxxff.exe115⤵PID:4064
-
\??\c:\tthbbh.exec:\tthbbh.exe116⤵PID:4016
-
\??\c:\vvvvj.exec:\vvvvj.exe117⤵PID:3328
-
\??\c:\rlrlrll.exec:\rlrlrll.exe118⤵PID:4456
-
\??\c:\rlrlffr.exec:\rlrlffr.exe119⤵PID:2892
-
\??\c:\nhbttb.exec:\nhbttb.exe120⤵PID:4568
-
\??\c:\vvpjj.exec:\vvpjj.exe121⤵PID:1484
-
\??\c:\xrrrrlr.exec:\xrrrrlr.exe122⤵PID:1804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-