Analysis
-
max time kernel
72s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 21:47
Behavioral task
behavioral1
Sample
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe
-
Size
234KB
-
MD5
6186641f31b66060ed80257a9e30ec90
-
SHA1
e53f3be89641de8cacf5f27e05e7899e4775be11
-
SHA256
1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54
-
SHA512
ca33f9a18c3bc47e6158d6233192b930d01e60201aac229f44fc4ac22e204ddc5efc75071be859e0001254b3b549e24282730a97d1e54496009cc8bd88b682da
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2aD:y4wFHoSSGpJwGeeFmFTNAp2+
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3540-38-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2716-55-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4264-85-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2112-102-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2404-110-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4612-191-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4904-216-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2848-239-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2628-245-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/384-256-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4696-255-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2280-264-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3276-287-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2024-347-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4256-357-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4928-378-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4240-390-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2000-423-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1700-464-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2324-562-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1188-576-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4964-983-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3480-967-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/632-942-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4880-883-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2060-744-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/856-694-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1448-552-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2104-503-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2824-493-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4280-459-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4884-440-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1308-419-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2236-415-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4888-379-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4216-368-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3040-364-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4676-334-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/432-322-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/852-320-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/792-297-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3304-268-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2280-260-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1948-232-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4880-228-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3392-213-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2560-209-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/640-202-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4556-197-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1188-180-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1872-168-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4864-160-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/452-154-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/388-142-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2912-116-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/632-105-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/668-95-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3464-74-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/792-72-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3816-63-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4852-45-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3600-46-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2312-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1012-25-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 740 3rlfrfl.exe 1700 thttht.exe 1012 jvpvd.exe 2312 rxfxxrf.exe 3540 hbbtth.exe 4852 jpvpd.exe 3600 xfxllff.exe 2716 thbbnt.exe 3068 dddvj.exe 3816 lfrrlll.exe 792 xrxlfll.exe 3464 tnthtt.exe 4264 jpdpp.exe 656 fxlfxlx.exe 668 jppdp.exe 2112 xfllrfl.exe 632 lxrlxlx.exe 2404 jvjdp.exe 2912 fxlrrfr.exe 2864 bhbntn.exe 2252 jjddd.exe 1144 vjppj.exe 848 nbbnnb.exe 388 thbbnb.exe 1372 frlxfrx.exe 452 hhbnbh.exe 4864 vvddd.exe 1872 rlflrxf.exe 4848 tntnnn.exe 1720 jdjdj.exe 1188 dvdjp.exe 4612 xffxxlf.exe 4488 bnnhbb.exe 4556 pddpp.exe 640 jdddp.exe 3396 xlfxrfr.exe 2560 tbbbth.exe 3392 bbnhbb.exe 4904 vvpjp.exe 4680 xffxllx.exe 5016 htbbbh.exe 4448 lfffxxx.exe 4880 nbbbbb.exe 1948 bbbtbb.exe 224 vdjdv.exe 2848 lxfxlxx.exe 4892 nhbntt.exe 2628 dpvvd.exe 4324 rfxffxx.exe 1424 ttbbbt.exe 4696 nbnnhh.exe 384 lrlfxrf.exe 2280 bbbntn.exe 2552 3pvpp.exe 3304 ddpdj.exe 2596 lrrfxxx.exe 3956 btbbhh.exe 4752 thbtnt.exe 980 vjpjp.exe 3276 ddddd.exe 3896 rffxxxx.exe 1516 hhbnnb.exe 792 jpvpv.exe 4076 pvddv.exe -
resource yara_rule behavioral2/memory/1700-14-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x00070000000233e2-20.dat upx behavioral2/files/0x00070000000233e3-26.dat upx behavioral2/files/0x00070000000233e4-32.dat upx behavioral2/memory/3540-38-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x00070000000233e7-51.dat upx behavioral2/files/0x00070000000233e8-54.dat upx behavioral2/memory/2716-55-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x00070000000233e9-61.dat upx behavioral2/files/0x00070000000233ea-67.dat upx behavioral2/files/0x00070000000233ec-79.dat upx behavioral2/memory/4264-85-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x00070000000233ed-83.dat upx behavioral2/files/0x00070000000233ee-90.dat upx behavioral2/memory/2112-97-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2112-102-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2404-110-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x00080000000233de-145.dat upx behavioral2/files/0x00070000000233f9-151.dat upx behavioral2/files/0x00070000000233fb-164.dat upx behavioral2/memory/4612-191-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4904-216-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2848-239-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2628-245-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/384-256-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4696-255-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2280-264-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3276-287-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2024-347-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4256-357-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4928-378-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3236-383-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4240-390-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2000-423-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1888-427-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1700-464-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2324-562-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1188-576-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/5116-802-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2196-838-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1316-910-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2584-1020-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4964-983-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3480-967-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/632-942-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2276-926-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4880-883-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4796-842-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4268-825-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3176-812-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1188-771-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1720-761-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3516-745-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2060-744-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/432-731-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/856-694-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4548-684-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3576-671-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3760-667-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4880-627-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4692-620-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1336-592-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1188-572-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1448-552-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2152 wrote to memory of 740 2152 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 532 PID 2152 wrote to memory of 740 2152 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 532 PID 2152 wrote to memory of 740 2152 1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe 532 PID 740 wrote to memory of 1700 740 3rlfrfl.exe 81 PID 740 wrote to memory of 1700 740 3rlfrfl.exe 81 PID 740 wrote to memory of 1700 740 3rlfrfl.exe 81 PID 1700 wrote to memory of 1012 1700 thttht.exe 82 PID 1700 wrote to memory of 1012 1700 thttht.exe 82 PID 1700 wrote to memory of 1012 1700 thttht.exe 82 PID 1012 wrote to memory of 2312 1012 jvpvd.exe 83 PID 1012 wrote to memory of 2312 1012 jvpvd.exe 83 PID 1012 wrote to memory of 2312 1012 jvpvd.exe 83 PID 2312 wrote to memory of 3540 2312 rxfxxrf.exe 84 PID 2312 wrote to memory of 3540 2312 rxfxxrf.exe 84 PID 2312 wrote to memory of 3540 2312 rxfxxrf.exe 84 PID 3540 wrote to memory of 4852 3540 hbbtth.exe 85 PID 3540 wrote to memory of 4852 3540 hbbtth.exe 85 PID 3540 wrote to memory of 4852 3540 hbbtth.exe 85 PID 4852 wrote to memory of 3600 4852 jpvpd.exe 86 PID 4852 wrote to memory of 3600 4852 jpvpd.exe 86 PID 4852 wrote to memory of 3600 4852 jpvpd.exe 86 PID 3600 wrote to memory of 2716 3600 xfxllff.exe 87 PID 3600 wrote to memory of 2716 3600 xfxllff.exe 87 PID 3600 wrote to memory of 2716 3600 xfxllff.exe 87 PID 2716 wrote to memory of 3068 2716 thbbnt.exe 88 PID 2716 wrote to memory of 3068 2716 thbbnt.exe 88 PID 2716 wrote to memory of 3068 2716 thbbnt.exe 88 PID 3068 wrote to memory of 3816 3068 dddvj.exe 89 PID 3068 wrote to memory of 3816 3068 dddvj.exe 89 PID 3068 wrote to memory of 3816 3068 dddvj.exe 89 PID 3816 wrote to memory of 792 3816 lfrrlll.exe 90 PID 3816 wrote to memory of 792 3816 lfrrlll.exe 90 PID 3816 wrote to memory of 792 3816 lfrrlll.exe 90 PID 792 wrote to memory of 3464 792 xrxlfll.exe 91 PID 792 wrote to memory of 3464 792 xrxlfll.exe 91 PID 792 wrote to memory of 3464 792 xrxlfll.exe 91 PID 3464 wrote to memory of 4264 3464 tnthtt.exe 92 PID 3464 wrote to memory of 4264 3464 tnthtt.exe 92 PID 3464 wrote to memory of 4264 3464 tnthtt.exe 92 PID 4264 wrote to memory of 656 4264 jpdpp.exe 93 PID 4264 wrote to memory of 656 4264 jpdpp.exe 93 PID 4264 wrote to memory of 656 4264 jpdpp.exe 93 PID 656 wrote to memory of 668 656 fxlfxlx.exe 94 PID 656 wrote to memory of 668 656 fxlfxlx.exe 94 PID 656 wrote to memory of 668 656 fxlfxlx.exe 94 PID 668 wrote to memory of 2112 668 jppdp.exe 95 PID 668 wrote to memory of 2112 668 jppdp.exe 95 PID 668 wrote to memory of 2112 668 jppdp.exe 95 PID 2112 wrote to memory of 632 2112 xfllrfl.exe 96 PID 2112 wrote to memory of 632 2112 xfllrfl.exe 96 PID 2112 wrote to memory of 632 2112 xfllrfl.exe 96 PID 632 wrote to memory of 2404 632 lxrlxlx.exe 97 PID 632 wrote to memory of 2404 632 lxrlxlx.exe 97 PID 632 wrote to memory of 2404 632 lxrlxlx.exe 97 PID 2404 wrote to memory of 2912 2404 jvjdp.exe 98 PID 2404 wrote to memory of 2912 2404 jvjdp.exe 98 PID 2404 wrote to memory of 2912 2404 jvjdp.exe 98 PID 2912 wrote to memory of 2864 2912 fxlrrfr.exe 1038 PID 2912 wrote to memory of 2864 2912 fxlrrfr.exe 1038 PID 2912 wrote to memory of 2864 2912 fxlrrfr.exe 1038 PID 2864 wrote to memory of 2252 2864 bhbntn.exe 3422 PID 2864 wrote to memory of 2252 2864 bhbntn.exe 3422 PID 2864 wrote to memory of 2252 2864 bhbntn.exe 3422 PID 2252 wrote to memory of 1144 2252 jjddd.exe 566
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c8b1690cf1b4ce4004e120f8f634507d7cdde0e33e5c22072c207c8dc191b54_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\3rlfrfl.exec:\3rlfrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\thttht.exec:\thttht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\jvpvd.exec:\jvpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\rxfxxrf.exec:\rxfxxrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hbbtth.exec:\hbbtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\jpvpd.exec:\jpvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\xfxllff.exec:\xfxllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\thbbnt.exec:\thbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\dddvj.exec:\dddvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\lfrrlll.exec:\lfrrlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\xrxlfll.exec:\xrxlfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\tnthtt.exec:\tnthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\jpdpp.exec:\jpdpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\fxlfxlx.exec:\fxlfxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\jppdp.exec:\jppdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\xfllrfl.exec:\xfllrfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\lxrlxlx.exec:\lxrlxlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\jvjdp.exec:\jvjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\fxlrrfr.exec:\fxlrrfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bhbntn.exec:\bhbntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\jjddd.exec:\jjddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vjppj.exec:\vjppj.exe23⤵
- Executes dropped EXE
PID:1144 -
\??\c:\nbbnnb.exec:\nbbnnb.exe24⤵
- Executes dropped EXE
PID:848 -
\??\c:\thbbnb.exec:\thbbnb.exe25⤵
- Executes dropped EXE
PID:388 -
\??\c:\frlxfrx.exec:\frlxfrx.exe26⤵
- Executes dropped EXE
PID:1372 -
\??\c:\hhbnbh.exec:\hhbnbh.exe27⤵
- Executes dropped EXE
PID:452 -
\??\c:\vvddd.exec:\vvddd.exe28⤵
- Executes dropped EXE
PID:4864 -
\??\c:\rlflrxf.exec:\rlflrxf.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tntnnn.exec:\tntnnn.exe30⤵
- Executes dropped EXE
PID:4848 -
\??\c:\jdjdj.exec:\jdjdj.exe31⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dvdjp.exec:\dvdjp.exe32⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xffxxlf.exec:\xffxxlf.exe33⤵
- Executes dropped EXE
PID:4612 -
\??\c:\bnnhbb.exec:\bnnhbb.exe34⤵
- Executes dropped EXE
PID:4488 -
\??\c:\pddpp.exec:\pddpp.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\jdddp.exec:\jdddp.exe36⤵
- Executes dropped EXE
PID:640 -
\??\c:\xlfxrfr.exec:\xlfxrfr.exe37⤵
- Executes dropped EXE
PID:3396 -
\??\c:\tbbbth.exec:\tbbbth.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bbnhbb.exec:\bbnhbb.exe39⤵
- Executes dropped EXE
PID:3392 -
\??\c:\vvpjp.exec:\vvpjp.exe40⤵
- Executes dropped EXE
PID:4904 -
\??\c:\xffxllx.exec:\xffxllx.exe41⤵
- Executes dropped EXE
PID:4680 -
\??\c:\htbbbh.exec:\htbbbh.exe42⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lfffxxx.exec:\lfffxxx.exe43⤵
- Executes dropped EXE
PID:4448 -
\??\c:\nbbbbb.exec:\nbbbbb.exe44⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bbbtbb.exec:\bbbtbb.exe45⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vdjdv.exec:\vdjdv.exe46⤵
- Executes dropped EXE
PID:224 -
\??\c:\lxfxlxx.exec:\lxfxlxx.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhbntt.exec:\nhbntt.exe48⤵
- Executes dropped EXE
PID:4892 -
\??\c:\dpvvd.exec:\dpvvd.exe49⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rfxffxx.exec:\rfxffxx.exe50⤵
- Executes dropped EXE
PID:4324 -
\??\c:\ttbbbt.exec:\ttbbbt.exe51⤵
- Executes dropped EXE
PID:1424 -
\??\c:\nbnnhh.exec:\nbnnhh.exe52⤵
- Executes dropped EXE
PID:4696 -
\??\c:\lrlfxrf.exec:\lrlfxrf.exe53⤵
- Executes dropped EXE
PID:384 -
\??\c:\bbbntn.exec:\bbbntn.exe54⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3pvpp.exec:\3pvpp.exe55⤵
- Executes dropped EXE
PID:2552 -
\??\c:\ddpdj.exec:\ddpdj.exe56⤵
- Executes dropped EXE
PID:3304 -
\??\c:\lrrfxxx.exec:\lrrfxxx.exe57⤵
- Executes dropped EXE
PID:2596 -
\??\c:\btbbhh.exec:\btbbhh.exe58⤵
- Executes dropped EXE
PID:3956 -
\??\c:\thbtnt.exec:\thbtnt.exe59⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vjpjp.exec:\vjpjp.exe60⤵
- Executes dropped EXE
PID:980 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:3276 -
\??\c:\rffxxxx.exec:\rffxxxx.exe62⤵
- Executes dropped EXE
PID:3896 -
\??\c:\hhbnnb.exec:\hhbnnb.exe63⤵
- Executes dropped EXE
PID:1516 -
\??\c:\jpvpv.exec:\jpvpv.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\pvddv.exec:\pvddv.exe65⤵
- Executes dropped EXE
PID:4076 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe66⤵PID:1960
-
\??\c:\nhhtht.exec:\nhhtht.exe67⤵PID:2420
-
\??\c:\nbbntt.exec:\nbbntt.exe68⤵PID:4028
-
\??\c:\9jdvj.exec:\9jdvj.exe69⤵PID:1908
-
\??\c:\vpvvv.exec:\vpvvv.exe70⤵PID:1240
-
\??\c:\lflrrrl.exec:\lflrrrl.exe71⤵PID:852
-
\??\c:\5hnnhb.exec:\5hnnhb.exe72⤵PID:432
-
\??\c:\7thhhh.exec:\7thhhh.exe73⤵PID:3620
-
\??\c:\ppvvp.exec:\ppvvp.exe74⤵PID:2912
-
\??\c:\xxxfxrf.exec:\xxxfxrf.exe75⤵PID:4676
-
\??\c:\rrrfrfx.exec:\rrrfrfx.exe76⤵PID:4588
-
\??\c:\bhbtbt.exec:\bhbtbt.exe77⤵PID:4384
-
\??\c:\7pddp.exec:\7pddp.exe78⤵PID:3752
-
\??\c:\jpdjp.exec:\jpdjp.exe79⤵PID:2024
-
\??\c:\5rlxlfr.exec:\5rlxlfr.exe80⤵PID:4004
-
\??\c:\hbhbbt.exec:\hbhbbt.exe81⤵PID:2232
-
\??\c:\bhhbnn.exec:\bhhbnn.exe82⤵PID:4256
-
\??\c:\xflxrrx.exec:\xflxrrx.exe83⤵PID:3876
-
\??\c:\ntnttn.exec:\ntnttn.exe84⤵PID:3040
-
\??\c:\pjpvd.exec:\pjpvd.exe85⤵PID:4216
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe86⤵PID:4464
-
\??\c:\hnhhbb.exec:\hnhhbb.exe87⤵PID:1460
-
\??\c:\pjddd.exec:\pjddd.exe88⤵PID:4928
-
\??\c:\vvppp.exec:\vvppp.exe89⤵PID:4888
-
\??\c:\lllllll.exec:\lllllll.exe90⤵PID:3236
-
\??\c:\tntttb.exec:\tntttb.exe91⤵PID:4600
-
\??\c:\bnttnn.exec:\bnttnn.exe92⤵PID:4240
-
\??\c:\ppvpp.exec:\ppvpp.exe93⤵PID:5092
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe94⤵PID:2556
-
\??\c:\rrllxxr.exec:\rrllxxr.exe95⤵PID:4876
-
\??\c:\bnbhht.exec:\bnbhht.exe96⤵PID:1160
-
\??\c:\vdjjd.exec:\vdjjd.exe97⤵PID:540
-
\??\c:\pjppj.exec:\pjppj.exe98⤵PID:4680
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe99⤵PID:2236
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe100⤵PID:5016
-
\??\c:\tbnnnn.exec:\tbnnnn.exe101⤵PID:1308
-
\??\c:\vjdvv.exec:\vjdvv.exe102⤵PID:2000
-
\??\c:\pjppd.exec:\pjppd.exe103⤵PID:1888
-
\??\c:\rlflxxl.exec:\rlflxxl.exe104⤵PID:3000
-
\??\c:\bhbnbn.exec:\bhbnbn.exe105⤵PID:224
-
\??\c:\bntnnh.exec:\bntnnh.exe106⤵PID:4884
-
\??\c:\pvdpd.exec:\pvdpd.exe107⤵PID:2352
-
\??\c:\rrxxfxl.exec:\rrxxfxl.exe108⤵PID:4564
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe109⤵PID:4320
-
\??\c:\nhhtnh.exec:\nhhtnh.exe110⤵PID:2152
-
\??\c:\dddpj.exec:\dddpj.exe111⤵PID:1540
-
\??\c:\vjpdv.exec:\vjpdv.exe112⤵PID:4280
-
\??\c:\rxlxffr.exec:\rxlxffr.exe113⤵PID:1700
-
\??\c:\ffrxxff.exec:\ffrxxff.exe114⤵PID:1012
-
\??\c:\bhbbbh.exec:\bhbbbh.exe115⤵PID:2312
-
\??\c:\nnnthh.exec:\nnnthh.exe116⤵PID:3264
-
\??\c:\ppppv.exec:\ppppv.exe117⤵PID:2364
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:4608
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe119⤵PID:3932
-
\??\c:\3rrffff.exec:\3rrffff.exe120⤵PID:680
-
\??\c:\7hhtnb.exec:\7hhtnb.exe121⤵PID:856
-
\??\c:\btbhtb.exec:\btbhtb.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-