Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 02:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe
-
Size
488KB
-
MD5
0b572bc2e5f9f415f5af633466fe2190
-
SHA1
17232d031da47854e5c5762b4566f60c740c14a7
-
SHA256
232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4
-
SHA512
d5efbffa60ebc2118c4e4cb39bd0ac04282e0f5ae4ca20572c5b0aeb161b3c8f8839bc9f542c434f2be785ef2a1dd8d4482b41e1c1ea732da4eda08f2e60b1d1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwu1b26X1wjdgyPPB0:q7Tc2NYHUrAwqzQ7PP2
Malware Config
Signatures
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/1208-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4540-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4068-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4848-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3824-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/824-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4940-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2036-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/372-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/524-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5028-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4660-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2232-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3632-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1552-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1452-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4464-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4008-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3756-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4560-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/212-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1988-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4612-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1744-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2280-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1980-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1056-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4392-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2356-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2268-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4120-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2924-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1472-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/608-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2100-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1004-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3464-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2312-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2236-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1632-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2952-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2380-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4772-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3880-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1580-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2708-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/968-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5032-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4768-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4172-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3912-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2828-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3248-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1860-913-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/516-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4468-1050-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4540 lfxxlxl.exe 3824 hnnbnb.exe 4848 btntbh.exe 4068 jjjvp.exe 824 rfxrfxr.exe 2272 ppppd.exe 4172 hnntbt.exe 4456 jpjvj.exe 4940 fxfxxrl.exe 3196 vjpdp.exe 2036 fxfrrll.exe 372 thhtht.exe 524 9rlxlfx.exe 1396 bbbthb.exe 5028 dvvjv.exe 1472 dddpd.exe 4660 1lfrrlx.exe 32 pddpj.exe 3644 1rxlxrf.exe 2232 bnhthb.exe 4796 vdjdj.exe 3128 3lxlfrf.exe 2880 ddpjd.exe 2000 rxfxrlf.exe 3392 9nhtnn.exe 3632 pjjdv.exe 2236 3ppjd.exe 2828 rxfxrlf.exe 1552 btbbtt.exe 1452 nbthtn.exe 4464 bbthbb.exe 4008 dvpvj.exe 4976 bnnbtn.exe 3756 pvdpd.exe 4560 3rlxlfx.exe 1840 tbhtht.exe 212 jjdpd.exe 4440 xfxlfxr.exe 4636 1bbnnh.exe 724 pvvjp.exe 1920 pdjvp.exe 1988 9lfrffr.exe 920 1hbnbh.exe 2508 pvvjv.exe 4612 vjpdp.exe 1744 5fxlxrf.exe 1984 5vdjv.exe 4056 rxfxlfr.exe 1032 1xfrfxl.exe 652 bhbtnh.exe 2280 vpvjv.exe 1980 lxrfxrl.exe 1056 lrlxlfl.exe 2036 vppvd.exe 4392 fxxlxrx.exe 2356 rfrrffr.exe 2524 1nnbtn.exe 2268 3jjjv.exe 4120 3vpjv.exe 1396 7rrfrlx.exe 2924 htnbnb.exe 444 dpdvj.exe 1472 3llxfxx.exe 608 bnhthb.exe -
resource yara_rule behavioral2/memory/1208-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4540-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4068-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4848-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3824-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/824-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4172-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4456-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4940-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3196-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2036-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/372-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/524-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5028-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4660-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2232-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3632-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1552-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1452-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4464-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4008-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3756-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4560-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/212-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1988-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4612-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1744-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2280-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1980-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1056-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4392-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2356-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2268-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4120-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2924-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1472-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/608-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2100-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1004-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3464-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2312-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2236-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1632-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2952-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2380-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/920-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2916-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4772-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1944-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3880-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1580-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2708-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/968-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5032-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4388-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4768-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1920-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4984-542-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1208 wrote to memory of 4540 1208 232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe 83 PID 1208 wrote to memory of 4540 1208 232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe 83 PID 1208 wrote to memory of 4540 1208 232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe 83 PID 4540 wrote to memory of 3824 4540 lfxxlxl.exe 84 PID 4540 wrote to memory of 3824 4540 lfxxlxl.exe 84 PID 4540 wrote to memory of 3824 4540 lfxxlxl.exe 84 PID 3824 wrote to memory of 4848 3824 hnnbnb.exe 85 PID 3824 wrote to memory of 4848 3824 hnnbnb.exe 85 PID 3824 wrote to memory of 4848 3824 hnnbnb.exe 85 PID 4848 wrote to memory of 4068 4848 btntbh.exe 86 PID 4848 wrote to memory of 4068 4848 btntbh.exe 86 PID 4848 wrote to memory of 4068 4848 btntbh.exe 86 PID 4068 wrote to memory of 824 4068 jjjvp.exe 87 PID 4068 wrote to memory of 824 4068 jjjvp.exe 87 PID 4068 wrote to memory of 824 4068 jjjvp.exe 87 PID 824 wrote to memory of 2272 824 rfxrfxr.exe 88 PID 824 wrote to memory of 2272 824 rfxrfxr.exe 88 PID 824 wrote to memory of 2272 824 rfxrfxr.exe 88 PID 2272 wrote to memory of 4172 2272 ppppd.exe 89 PID 2272 wrote to memory of 4172 2272 ppppd.exe 89 PID 2272 wrote to memory of 4172 2272 ppppd.exe 89 PID 4172 wrote to memory of 4456 4172 hnntbt.exe 90 PID 4172 wrote to memory of 4456 4172 hnntbt.exe 90 PID 4172 wrote to memory of 4456 4172 hnntbt.exe 90 PID 4456 wrote to memory of 4940 4456 jpjvj.exe 91 PID 4456 wrote to memory of 4940 4456 jpjvj.exe 91 PID 4456 wrote to memory of 4940 4456 jpjvj.exe 91 PID 4940 wrote to memory of 3196 4940 fxfxxrl.exe 93 PID 4940 wrote to memory of 3196 4940 fxfxxrl.exe 93 PID 4940 wrote to memory of 3196 4940 fxfxxrl.exe 93 PID 3196 wrote to memory of 2036 3196 vjpdp.exe 94 PID 3196 wrote to memory of 2036 3196 vjpdp.exe 94 PID 3196 wrote to memory of 2036 3196 vjpdp.exe 94 PID 2036 wrote to memory of 372 2036 fxfrrll.exe 95 PID 2036 wrote to memory of 372 2036 fxfrrll.exe 95 PID 2036 wrote to memory of 372 2036 fxfrrll.exe 95 PID 372 wrote to memory of 524 372 thhtht.exe 97 PID 372 wrote to memory of 524 372 thhtht.exe 97 PID 372 wrote to memory of 524 372 thhtht.exe 97 PID 524 wrote to memory of 1396 524 9rlxlfx.exe 98 PID 524 wrote to memory of 1396 524 9rlxlfx.exe 98 PID 524 wrote to memory of 1396 524 9rlxlfx.exe 98 PID 1396 wrote to memory of 5028 1396 bbbthb.exe 99 PID 1396 wrote to memory of 5028 1396 bbbthb.exe 99 PID 1396 wrote to memory of 5028 1396 bbbthb.exe 99 PID 5028 wrote to memory of 1472 5028 dvvjv.exe 100 PID 5028 wrote to memory of 1472 5028 dvvjv.exe 100 PID 5028 wrote to memory of 1472 5028 dvvjv.exe 100 PID 1472 wrote to memory of 4660 1472 dddpd.exe 102 PID 1472 wrote to memory of 4660 1472 dddpd.exe 102 PID 1472 wrote to memory of 4660 1472 dddpd.exe 102 PID 4660 wrote to memory of 32 4660 1lfrrlx.exe 103 PID 4660 wrote to memory of 32 4660 1lfrrlx.exe 103 PID 4660 wrote to memory of 32 4660 1lfrrlx.exe 103 PID 32 wrote to memory of 3644 32 pddpj.exe 104 PID 32 wrote to memory of 3644 32 pddpj.exe 104 PID 32 wrote to memory of 3644 32 pddpj.exe 104 PID 3644 wrote to memory of 2232 3644 1rxlxrf.exe 105 PID 3644 wrote to memory of 2232 3644 1rxlxrf.exe 105 PID 3644 wrote to memory of 2232 3644 1rxlxrf.exe 105 PID 2232 wrote to memory of 4796 2232 bnhthb.exe 106 PID 2232 wrote to memory of 4796 2232 bnhthb.exe 106 PID 2232 wrote to memory of 4796 2232 bnhthb.exe 106 PID 4796 wrote to memory of 3128 4796 vdjdj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\232f8fa5c726aec4d18f29637d68b37aa44785c447ccf20521f7ca4e430b7af4_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\lfxxlxl.exec:\lfxxlxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\hnnbnb.exec:\hnnbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\btntbh.exec:\btntbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\jjjvp.exec:\jjjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\ppppd.exec:\ppppd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\hnntbt.exec:\hnntbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\jpjvj.exec:\jpjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\vjpdp.exec:\vjpdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\fxfrrll.exec:\fxfrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\thhtht.exec:\thhtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\9rlxlfx.exec:\9rlxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\bbbthb.exec:\bbbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\dvvjv.exec:\dvvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\dddpd.exec:\dddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\1lfrrlx.exec:\1lfrrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\pddpj.exec:\pddpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\1rxlxrf.exec:\1rxlxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\bnhthb.exec:\bnhthb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\vdjdj.exec:\vdjdj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\3lxlfrf.exec:\3lxlfrf.exe23⤵
- Executes dropped EXE
PID:3128 -
\??\c:\ddpjd.exec:\ddpjd.exe24⤵
- Executes dropped EXE
PID:2880 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe25⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9nhtnn.exec:\9nhtnn.exe26⤵
- Executes dropped EXE
PID:3392 -
\??\c:\pjjdv.exec:\pjjdv.exe27⤵
- Executes dropped EXE
PID:3632 -
\??\c:\3ppjd.exec:\3ppjd.exe28⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe29⤵
- Executes dropped EXE
PID:2828 -
\??\c:\btbbtt.exec:\btbbtt.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nbthtn.exec:\nbthtn.exe31⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbthbb.exec:\bbthbb.exe32⤵
- Executes dropped EXE
PID:4464 -
\??\c:\dvpvj.exec:\dvpvj.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\bnnbtn.exec:\bnnbtn.exe34⤵
- Executes dropped EXE
PID:4976 -
\??\c:\pvdpd.exec:\pvdpd.exe35⤵
- Executes dropped EXE
PID:3756 -
\??\c:\3rlxlfx.exec:\3rlxlfx.exe36⤵
- Executes dropped EXE
PID:4560 -
\??\c:\tbhtht.exec:\tbhtht.exe37⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jjdpd.exec:\jjdpd.exe38⤵
- Executes dropped EXE
PID:212 -
\??\c:\xfxlfxr.exec:\xfxlfxr.exe39⤵
- Executes dropped EXE
PID:4440 -
\??\c:\1bbnnh.exec:\1bbnnh.exe40⤵
- Executes dropped EXE
PID:4636 -
\??\c:\pvvjp.exec:\pvvjp.exe41⤵
- Executes dropped EXE
PID:724 -
\??\c:\pdjvp.exec:\pdjvp.exe42⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9lfrffr.exec:\9lfrffr.exe43⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1hbnbh.exec:\1hbnbh.exe44⤵
- Executes dropped EXE
PID:920 -
\??\c:\pvvjv.exec:\pvvjv.exe45⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vjpdp.exec:\vjpdp.exe46⤵
- Executes dropped EXE
PID:4612 -
\??\c:\5fxlxrf.exec:\5fxlxrf.exe47⤵
- Executes dropped EXE
PID:1744 -
\??\c:\5vdjv.exec:\5vdjv.exe48⤵
- Executes dropped EXE
PID:1984 -
\??\c:\rxfxlfr.exec:\rxfxlfr.exe49⤵
- Executes dropped EXE
PID:4056 -
\??\c:\1xfrfxl.exec:\1xfrfxl.exe50⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bhbtnh.exec:\bhbtnh.exe51⤵
- Executes dropped EXE
PID:652 -
\??\c:\vpvjv.exec:\vpvjv.exe52⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lxrfxrl.exec:\lxrfxrl.exe53⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lrlxlfl.exec:\lrlxlfl.exe54⤵
- Executes dropped EXE
PID:1056 -
\??\c:\vppvd.exec:\vppvd.exe55⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fxxlxrx.exec:\fxxlxrx.exe56⤵
- Executes dropped EXE
PID:4392 -
\??\c:\rfrrffr.exec:\rfrrffr.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1nnbtn.exec:\1nnbtn.exe58⤵
- Executes dropped EXE
PID:2524 -
\??\c:\3jjjv.exec:\3jjjv.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3vpjv.exec:\3vpjv.exe60⤵
- Executes dropped EXE
PID:4120 -
\??\c:\7rrfrlx.exec:\7rrfrlx.exe61⤵
- Executes dropped EXE
PID:1396 -
\??\c:\htnbnb.exec:\htnbnb.exe62⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dpdvj.exec:\dpdvj.exe63⤵
- Executes dropped EXE
PID:444 -
\??\c:\3llxfxx.exec:\3llxfxx.exe64⤵
- Executes dropped EXE
PID:1472 -
\??\c:\bnhthb.exec:\bnhthb.exe65⤵
- Executes dropped EXE
PID:608 -
\??\c:\nhbnbn.exec:\nhbnbn.exe66⤵PID:4552
-
\??\c:\dvjpj.exec:\dvjpj.exe67⤵PID:2100
-
\??\c:\rrrrfrf.exec:\rrrrfrf.exe68⤵PID:3920
-
\??\c:\btttnn.exec:\btttnn.exe69⤵PID:4564
-
\??\c:\9tnbnh.exec:\9tnbnh.exe70⤵PID:1384
-
\??\c:\jpjvj.exec:\jpjvj.exe71⤵PID:1004
-
\??\c:\fxrlrrr.exec:\fxrlrrr.exe72⤵PID:1860
-
\??\c:\ddjdd.exec:\ddjdd.exe73⤵PID:968
-
\??\c:\5jdvj.exec:\5jdvj.exe74⤵PID:1076
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe75⤵PID:4620
-
\??\c:\bnnbtt.exec:\bnnbtt.exe76⤵PID:3464
-
\??\c:\9jpjp.exec:\9jpjp.exe77⤵PID:2312
-
\??\c:\rllxlrr.exec:\rllxlrr.exe78⤵PID:2236
-
\??\c:\nbtthn.exec:\nbtthn.exe79⤵PID:3120
-
\??\c:\hhnhtt.exec:\hhnhtt.exe80⤵PID:1260
-
\??\c:\vjjdd.exec:\vjjdd.exe81⤵PID:1452
-
\??\c:\lffxrll.exec:\lffxrll.exe82⤵PID:4464
-
\??\c:\bntnhb.exec:\bntnhb.exe83⤵PID:1588
-
\??\c:\pvvvp.exec:\pvvvp.exe84⤵PID:1632
-
\??\c:\dpjdv.exec:\dpjdv.exe85⤵PID:2576
-
\??\c:\xrxrrlx.exec:\xrxrrlx.exe86⤵PID:2952
-
\??\c:\bhnhtn.exec:\bhnhtn.exe87⤵PID:612
-
\??\c:\1ppjd.exec:\1ppjd.exe88⤵PID:2320
-
\??\c:\jddpd.exec:\jddpd.exe89⤵PID:1808
-
\??\c:\rllfffx.exec:\rllfffx.exe90⤵PID:3552
-
\??\c:\hnttnn.exec:\hnttnn.exe91⤵PID:4128
-
\??\c:\djddv.exec:\djddv.exe92⤵PID:2380
-
\??\c:\frxxxxr.exec:\frxxxxr.exe93⤵PID:2876
-
\??\c:\btnhbb.exec:\btnhbb.exe94⤵PID:920
-
\??\c:\nbbbtb.exec:\nbbbtb.exe95⤵PID:2508
-
\??\c:\jddvp.exec:\jddvp.exe96⤵PID:3304
-
\??\c:\xfllfff.exec:\xfllfff.exe97⤵PID:908
-
\??\c:\rrlfflf.exec:\rrlfflf.exe98⤵PID:2916
-
\??\c:\ntbbtt.exec:\ntbbtt.exe99⤵PID:4772
-
\??\c:\jjdvp.exec:\jjdvp.exe100⤵PID:1944
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe101⤵PID:2348
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe102⤵PID:524
-
\??\c:\thbtnn.exec:\thbtnn.exe103⤵PID:3880
-
\??\c:\3pjdd.exec:\3pjdd.exe104⤵PID:4092
-
\??\c:\9xrfrlx.exec:\9xrfrlx.exe105⤵PID:4120
-
\??\c:\nbbnhb.exec:\nbbnhb.exe106⤵PID:1396
-
\??\c:\bnnhtt.exec:\bnnhtt.exe107⤵PID:2472
-
\??\c:\pdvpj.exec:\pdvpj.exe108⤵PID:444
-
\??\c:\7xrlfff.exec:\7xrlfff.exe109⤵PID:1472
-
\??\c:\9fxrlfx.exec:\9fxrlfx.exe110⤵PID:1580
-
\??\c:\7tnhhh.exec:\7tnhhh.exe111⤵PID:4724
-
\??\c:\jpdpp.exec:\jpdpp.exe112⤵PID:1332
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe113⤵PID:1604
-
\??\c:\7tnhtb.exec:\7tnhtb.exe114⤵PID:1304
-
\??\c:\jddvp.exec:\jddvp.exe115⤵PID:3128
-
\??\c:\pjvjv.exec:\pjvjv.exe116⤵PID:1848
-
\??\c:\btthtn.exec:\btthtn.exe117⤵PID:1004
-
\??\c:\3pdvv.exec:\3pdvv.exe118⤵PID:2708
-
\??\c:\rrlfrlx.exec:\rrlfrlx.exe119⤵PID:968
-
\??\c:\1hbnbt.exec:\1hbnbt.exe120⤵PID:1464
-
\??\c:\vdjdd.exec:\vdjdd.exe121⤵PID:3752
-
\??\c:\xxrlfxx.exec:\xxrlfxx.exe122⤵PID:3996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-