Analysis
- max time kernel
151s - max time network
126s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
18/05/2024, 00:58
Behavioral task
behavioral1
Sample
652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
- Target 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe
- Size 464KB
- Sample240518-bbg7yscc4x
- SHA256 7ba6e366baa2b94fa08942d82f75ab900964be3a90b5ab82726245da1e190b87
- MD5 652a714169341d3ca92b741068ae73b0
- SHA1 18668e9b9bf28586ac96e0b71927033879529f10
- SHA512 2a0bdc5e58c3022911a964719d01275247190222505edd0572971b41d9867b50ebfcfd4dd9e7cab631f13ab107de061a949af3e5a3751ce5751e828c77292ac1
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VB:VeR0oykayRFp3lztP+OKaf1VB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1412-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/848-10-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2820-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3028-44-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2912-42-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2912-39-0x0000000000440000-0x000000000047A000-memory.dmp family_blackmoon behavioral1/memory/2936-60-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2600-69-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2768-83-0x00000000003B0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2768-89-0x00000000003B0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2768-88-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2512-79-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2624-98-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3008-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1512-143-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1036-145-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2280-161-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2036-178-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2440-190-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2484-215-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/568-235-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/112-265-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/736-283-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2824-326-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2948-358-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2916-377-0x00000000003C0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2244-427-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1036-466-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2140-480-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2888-345-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1728-487-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1524-319-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/632-564-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/632-561-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/632-560-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1232-619-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2396-724-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1720-806-0x0000000000540000-0x000000000057A000-memory.dmp family_blackmoon behavioral1/memory/1636-870-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1768-877-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2832-935-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2528-966-0x00000000003C0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2988-980-0x0000000000260000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/2772-992-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/1412-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1412-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0009000000016c90-5.dat family_berbew behavioral1/memory/848-10-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0009000000016cf0-19.dat family_berbew behavioral1/memory/2820-20-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2820-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2912-33-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0008000000016d4a-31.dat family_berbew behavioral1/memory/3028-44-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000016d4f-43.dat family_berbew behavioral1/memory/2912-42-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2912-39-0x0000000000440000-0x000000000047A000-memory.dmp family_berbew behavioral1/files/0x0009000000016d55-51.dat family_berbew behavioral1/memory/2936-52-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0008000000016d84-62.dat family_berbew behavioral1/memory/2936-60-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0007000000018b42-70.dat family_berbew behavioral1/memory/2600-69-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2512-72-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0009000000016d24-80.dat family_berbew behavioral1/memory/2768-83-0x00000000003B0000-0x00000000003EA000-memory.dmp family_berbew behavioral1/files/0x00050000000194ef-90.dat family_berbew behavioral1/memory/2768-88-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2512-79-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000194f2-99.dat family_berbew behavioral1/memory/2624-98-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000194f4-107.dat family_berbew behavioral1/memory/2456-108-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3008-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000500000001950c-116.dat family_berbew behavioral1/files/0x0005000000019521-127.dat family_berbew behavioral1/memory/3008-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0005000000019547-134.dat family_berbew behavioral1/memory/1512-143-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0005000000019570-141.dat family_berbew behavioral1/memory/1036-145-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000500000001959c-153.dat family_berbew behavioral1/memory/2280-161-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x000500000001959e-162.dat family_berbew behavioral1/files/0x00050000000195a2-169.dat family_berbew behavioral1/files/0x00050000000195a4-180.dat family_berbew behavioral1/memory/2036-178-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195a6-187.dat family_berbew behavioral1/memory/2440-190-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195a7-196.dat family_berbew behavioral1/memory/2704-198-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195a8-205.dat family_berbew behavioral1/files/0x00050000000195a9-214.dat family_berbew behavioral1/memory/2484-215-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195aa-224.dat family_berbew behavioral1/memory/1504-223-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195ba-233.dat family_berbew behavioral1/memory/568-235-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x00050000000195ff-241.dat family_berbew behavioral1/files/0x0005000000019646-249.dat family_berbew behavioral1/files/0x00050000000196d8-258.dat family_berbew behavioral1/files/0x000500000001996e-266.dat family_berbew behavioral1/memory/1160-267-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0005000000019bd6-275.dat family_berbew behavioral1/memory/112-265-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0005000000019bd7-284.dat family_berbew behavioral1/memory/736-283-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/files/0x0005000000019bd8-292.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 848 hnddjtp.exe 2820 lhfjn.exe 2912 fjxnv.exe 3028 fxvtt.exe 2936 trthp.exe 2600 lxfhvtr.exe 2512 nhpbr.exe 2768 hrvfr.exe 2624 rvndxlf.exe 2576 bjvtbdd.exe 2456 xfxlhtr.exe 3008 jlxdh.exe 2364 djltfb.exe 1512 dlvpj.exe 1036 rjbvnnr.exe 2280 jvjnhr.exe 1644 nnnbrv.exe 2036 lrdjp.exe 764 vlvxxnj.exe 2440 vfpdh.exe 2704 nxplrb.exe 2716 lhvbh.exe 2484 tbfnj.exe 1504 hdbbjx.exe 568 brhlb.exe 824 jldtjj.exe 1500 tpdjf.exe 112 tntjtfr.exe 1160 nvhblx.exe 736 rrxvxr.exe 696 xdvrn.exe 2972 fpbfrp.exe 1996 hbfln.exe 2976 nbplbt.exe 1664 rbtrnhx.exe 1524 dplldt.exe 2824 fhvlb.exe 2272 rvrxrpj.exe 2888 nxlvvdd.exe 2820 lvjdln.exe 2948 pnndtfv.exe 3016 jjxvn.exe 2488 nhdpf.exe 2916 dtjrhh.exe 2784 btdtdh.exe 2600 vprlpn.exe 1428 lbhlfn.exe 2404 hjtrjld.exe 2520 xvbtt.exe 2392 fhnjrjv.exe 2552 vjdtnj.exe 2244 hljljjf.exe 2456 pfprbfj.exe 2448 btvddhd.exe 1020 jbphh.exe 1032 vbljvvd.exe 1956 djtpnl.exe 1036 hvjnbx.exe 2344 htdth.exe 2140 rxxtln.exe 1728 xblvj.exe 660 jfxbvb.exe 476 nptdr.exe 2684 xpxxdjf.exe -
resource yara_rule behavioral1/memory/1412-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1412-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000016c90-5.dat upx behavioral1/memory/848-10-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000016cf0-19.dat upx behavioral1/memory/2820-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/848-16-0x00000000002C0000-0x00000000002FA000-memory.dmp upx behavioral1/memory/2820-30-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2912-33-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0008000000016d4a-31.dat upx behavioral1/memory/3028-44-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000016d4f-43.dat upx behavioral1/memory/2912-42-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000016d55-51.dat upx behavioral1/memory/2936-52-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0008000000016d84-62.dat upx behavioral1/memory/2936-60-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0007000000018b42-70.dat upx behavioral1/memory/2600-69-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2512-72-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0009000000016d24-80.dat upx behavioral1/files/0x00050000000194ef-90.dat upx behavioral1/memory/2768-88-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2512-79-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000194f2-99.dat upx behavioral1/memory/2624-98-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000194f4-107.dat upx behavioral1/memory/2456-108-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3008-117-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000500000001950c-116.dat upx behavioral1/files/0x0005000000019521-127.dat upx behavioral1/memory/3008-125-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0005000000019547-134.dat upx behavioral1/memory/1512-143-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0005000000019570-141.dat upx behavioral1/memory/1036-145-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000500000001959c-153.dat upx behavioral1/memory/2280-161-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x000500000001959e-162.dat upx behavioral1/files/0x00050000000195a2-169.dat upx behavioral1/files/0x00050000000195a4-180.dat upx behavioral1/memory/2036-178-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195a6-187.dat upx behavioral1/memory/2440-190-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195a7-196.dat upx behavioral1/memory/2704-198-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195a8-205.dat upx behavioral1/files/0x00050000000195a9-214.dat upx behavioral1/memory/2484-215-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195aa-224.dat upx behavioral1/memory/1504-223-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195ba-233.dat upx behavioral1/memory/568-235-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x00050000000195ff-241.dat upx behavioral1/files/0x0005000000019646-249.dat upx behavioral1/files/0x00050000000196d8-258.dat upx behavioral1/files/0x000500000001996e-266.dat upx behavioral1/memory/1160-267-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0005000000019bd6-275.dat upx behavioral1/memory/112-265-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0005000000019bd7-284.dat upx behavioral1/memory/736-283-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/files/0x0005000000019bd8-292.dat upx behavioral1/memory/1996-300-0x0000000000400000-0x000000000043A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1412 wrote to memory of 848 1412 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 848 1412 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 848 1412 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 28 PID 1412 wrote to memory of 848 1412 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 28 PID 848 wrote to memory of 2820 848 hnddjtp.exe 29 PID 848 wrote to memory of 2820 848 hnddjtp.exe 29 PID 848 wrote to memory of 2820 848 hnddjtp.exe 29 PID 848 wrote to memory of 2820 848 hnddjtp.exe 29 PID 2820 wrote to memory of 2912 2820 lhfjn.exe 30 PID 2820 wrote to memory of 2912 2820 lhfjn.exe 30 PID 2820 wrote to memory of 2912 2820 lhfjn.exe 30 PID 2820 wrote to memory of 2912 2820 lhfjn.exe 30 PID 2912 wrote to memory of 3028 2912 fjxnv.exe 31 PID 2912 wrote to memory of 3028 2912 fjxnv.exe 31 PID 2912 wrote to memory of 3028 2912 fjxnv.exe 31 PID 2912 wrote to memory of 3028 2912 fjxnv.exe 31 PID 3028 wrote to memory of 2936 3028 fxvtt.exe 32 PID 3028 wrote to memory of 2936 3028 fxvtt.exe 32 PID 3028 wrote to memory of 2936 3028 fxvtt.exe 32 PID 3028 wrote to memory of 2936 3028 fxvtt.exe 32 PID 2936 wrote to memory of 2600 2936 trthp.exe 33 PID 2936 wrote to memory of 2600 2936 trthp.exe 33 PID 2936 wrote to memory of 2600 2936 trthp.exe 33 PID 2936 wrote to memory of 2600 2936 trthp.exe 33 PID 2600 wrote to memory of 2512 2600 lxfhvtr.exe 34 PID 2600 wrote to memory of 2512 2600 lxfhvtr.exe 34 PID 2600 wrote to memory of 2512 2600 lxfhvtr.exe 34 PID 2600 wrote to memory of 2512 2600 lxfhvtr.exe 34 PID 2512 wrote to memory of 2768 2512 nhpbr.exe 35 PID 2512 wrote to memory of 2768 2512 nhpbr.exe 35 PID 2512 wrote to memory of 2768 2512 nhpbr.exe 35 PID 2512 wrote to memory of 2768 2512 nhpbr.exe 35 PID 2768 wrote to memory of 2624 2768 hrvfr.exe 36 PID 2768 wrote to memory of 2624 2768 hrvfr.exe 36 PID 2768 wrote to memory of 2624 2768 hrvfr.exe 36 PID 2768 wrote to memory of 2624 2768 hrvfr.exe 36 PID 2624 wrote to memory of 2576 2624 rvndxlf.exe 37 PID 2624 wrote to memory of 2576 2624 rvndxlf.exe 37 PID 2624 wrote to memory of 2576 2624 rvndxlf.exe 37 PID 2624 wrote to memory of 2576 2624 rvndxlf.exe 37 PID 2576 wrote to memory of 2456 2576 bjvtbdd.exe 38 PID 2576 wrote to memory of 2456 2576 bjvtbdd.exe 38 PID 2576 wrote to memory of 2456 2576 bjvtbdd.exe 38 PID 2576 wrote to memory of 2456 2576 bjvtbdd.exe 38 PID 2456 wrote to memory of 3008 2456 xfxlhtr.exe 39 PID 2456 wrote to memory of 3008 2456 xfxlhtr.exe 39 PID 2456 wrote to memory of 3008 2456 xfxlhtr.exe 39 PID 2456 wrote to memory of 3008 2456 xfxlhtr.exe 39 PID 3008 wrote to memory of 2364 3008 jlxdh.exe 40 PID 3008 wrote to memory of 2364 3008 jlxdh.exe 40 PID 3008 wrote to memory of 2364 3008 jlxdh.exe 40 PID 3008 wrote to memory of 2364 3008 jlxdh.exe 40 PID 2364 wrote to memory of 1512 2364 djltfb.exe 41 PID 2364 wrote to memory of 1512 2364 djltfb.exe 41 PID 2364 wrote to memory of 1512 2364 djltfb.exe 41 PID 2364 wrote to memory of 1512 2364 djltfb.exe 41 PID 1512 wrote to memory of 1036 1512 dlvpj.exe 85 PID 1512 wrote to memory of 1036 1512 dlvpj.exe 85 PID 1512 wrote to memory of 1036 1512 dlvpj.exe 85 PID 1512 wrote to memory of 1036 1512 dlvpj.exe 85 PID 1036 wrote to memory of 2280 1036 rjbvnnr.exe 43 PID 1036 wrote to memory of 2280 1036 rjbvnnr.exe 43 PID 1036 wrote to memory of 2280 1036 rjbvnnr.exe 43 PID 1036 wrote to memory of 2280 1036 rjbvnnr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\hnddjtp.exec:\hnddjtp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\lhfjn.exec:\lhfjn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\fjxnv.exec:\fjxnv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\fxvtt.exec:\fxvtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\trthp.exec:\trthp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\lxfhvtr.exec:\lxfhvtr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhpbr.exec:\nhpbr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hrvfr.exec:\hrvfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rvndxlf.exec:\rvndxlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\bjvtbdd.exec:\bjvtbdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\xfxlhtr.exec:\xfxlhtr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jlxdh.exec:\jlxdh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\djltfb.exec:\djltfb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\dlvpj.exec:\dlvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\rjbvnnr.exec:\rjbvnnr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\jvjnhr.exec:\jvjnhr.exe17⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nnnbrv.exec:\nnnbrv.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lrdjp.exec:\lrdjp.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vlvxxnj.exec:\vlvxxnj.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\vfpdh.exec:\vfpdh.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nxplrb.exec:\nxplrb.exe22⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lhvbh.exec:\lhvbh.exe23⤵
- Executes dropped EXE
PID:2716 -
\??\c:\tbfnj.exec:\tbfnj.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hdbbjx.exec:\hdbbjx.exe25⤵
- Executes dropped EXE
PID:1504 -
\??\c:\brhlb.exec:\brhlb.exe26⤵
- Executes dropped EXE
PID:568 -
\??\c:\jldtjj.exec:\jldtjj.exe27⤵
- Executes dropped EXE
PID:824 -
\??\c:\tpdjf.exec:\tpdjf.exe28⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tntjtfr.exec:\tntjtfr.exe29⤵
- Executes dropped EXE
PID:112 -
\??\c:\nvhblx.exec:\nvhblx.exe30⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rrxvxr.exec:\rrxvxr.exe31⤵
- Executes dropped EXE
PID:736 -
\??\c:\xdvrn.exec:\xdvrn.exe32⤵
- Executes dropped EXE
PID:696 -
\??\c:\fpbfrp.exec:\fpbfrp.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbfln.exec:\hbfln.exe34⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nbplbt.exec:\nbplbt.exe35⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rbtrnhx.exec:\rbtrnhx.exe36⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dplldt.exec:\dplldt.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fhvlb.exec:\fhvlb.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rvrxrpj.exec:\rvrxrpj.exe39⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nxlvvdd.exec:\nxlvvdd.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lvjdln.exec:\lvjdln.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\pnndtfv.exec:\pnndtfv.exe42⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jjxvn.exec:\jjxvn.exe43⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhdpf.exec:\nhdpf.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dtjrhh.exec:\dtjrhh.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\btdtdh.exec:\btdtdh.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vprlpn.exec:\vprlpn.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lbhlfn.exec:\lbhlfn.exe48⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hjtrjld.exec:\hjtrjld.exe49⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xvbtt.exec:\xvbtt.exe50⤵
- Executes dropped EXE
PID:2520 -
\??\c:\fhnjrjv.exec:\fhnjrjv.exe51⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vjdtnj.exec:\vjdtnj.exe52⤵
- Executes dropped EXE
PID:2552 -
\??\c:\hljljjf.exec:\hljljjf.exe53⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pfprbfj.exec:\pfprbfj.exe54⤵
- Executes dropped EXE
PID:2456 -
\??\c:\btvddhd.exec:\btvddhd.exe55⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jbphh.exec:\jbphh.exe56⤵
- Executes dropped EXE
PID:1020 -
\??\c:\vbljvvd.exec:\vbljvvd.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\djtpnl.exec:\djtpnl.exe58⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hvjnbx.exec:\hvjnbx.exe59⤵
- Executes dropped EXE
PID:1036 -
\??\c:\htdth.exec:\htdth.exe60⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rxxtln.exec:\rxxtln.exe61⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xblvj.exec:\xblvj.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jfxbvb.exec:\jfxbvb.exe63⤵
- Executes dropped EXE
PID:660 -
\??\c:\nptdr.exec:\nptdr.exe64⤵
- Executes dropped EXE
PID:476 -
\??\c:\xpxxdjf.exec:\xpxxdjf.exe65⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xfjrp.exec:\xfjrp.exe66⤵PID:336
-
\??\c:\vfxhlx.exec:\vfxhlx.exe67⤵PID:2084
-
\??\c:\bbhjxf.exec:\bbhjxf.exe68⤵PID:2688
-
\??\c:\vhddr.exec:\vhddr.exe69⤵PID:2232
-
\??\c:\djrjxvt.exec:\djrjxvt.exe70⤵PID:320
-
\??\c:\hjftrbx.exec:\hjftrbx.exe71⤵PID:1504
-
\??\c:\pvdrdxl.exec:\pvdrdxl.exe72⤵PID:1920
-
\??\c:\vrprxr.exec:\vrprxr.exe73⤵PID:976
-
\??\c:\vhlhbf.exec:\vhlhbf.exe74⤵PID:632
-
\??\c:\vpdrt.exec:\vpdrt.exe75⤵PID:2736
-
\??\c:\btvjbj.exec:\btvjbj.exe76⤵PID:832
-
\??\c:\bnnrnrd.exec:\bnnrnrd.exe77⤵PID:996
-
\??\c:\nrtrjd.exec:\nrtrjd.exe78⤵PID:3032
-
\??\c:\nldnvxh.exec:\nldnvxh.exe79⤵PID:1620
-
\??\c:\bffrvjd.exec:\bffrvjd.exe80⤵PID:1840
-
\??\c:\xxpjvpp.exec:\xxpjvpp.exe81⤵PID:2136
-
\??\c:\bthbxn.exec:\bthbxn.exe82⤵PID:1548
-
\??\c:\rhrvrvv.exec:\rhrvrvv.exe83⤵PID:1232
-
\??\c:\dvfpl.exec:\dvfpl.exe84⤵PID:2212
-
\??\c:\ldvrdj.exec:\ldvrdj.exe85⤵PID:2300
-
\??\c:\pvbddd.exec:\pvbddd.exe86⤵PID:2836
-
\??\c:\dvhtbr.exec:\dvhtbr.exe87⤵PID:2304
-
\??\c:\bfnhf.exec:\bfnhf.exe88⤵PID:2932
-
\??\c:\hfrvv.exec:\hfrvv.exe89⤵PID:2296
-
\??\c:\bfxlbfx.exec:\bfxlbfx.exe90⤵PID:2852
-
\??\c:\jrhhttp.exec:\jrhhttp.exe91⤵PID:2948
-
\??\c:\llrljfj.exec:\llrljfj.exe92⤵PID:2532
-
\??\c:\fvrjrnf.exec:\fvrjrnf.exe93⤵PID:2612
-
\??\c:\pdvlvb.exec:\pdvlvb.exe94⤵PID:2916
-
\??\c:\jxnnrxb.exec:\jxnnrxb.exe95⤵PID:2784
-
\??\c:\xnttrph.exec:\xnttrph.exe96⤵PID:2600
-
\??\c:\ntfrh.exec:\ntfrh.exe97⤵PID:2508
-
\??\c:\llvnthl.exec:\llvnthl.exe98⤵PID:2408
-
\??\c:\fjxvrl.exec:\fjxvrl.exe99⤵PID:2668
-
\??\c:\hnxnj.exec:\hnxnj.exe100⤵PID:2396
-
\??\c:\jjjnjv.exec:\jjjnjv.exe101⤵PID:2552
-
\??\c:\nnhnv.exec:\nnhnv.exe102⤵PID:2860
-
\??\c:\dvjnhl.exec:\dvjnhl.exe103⤵PID:604
-
\??\c:\djbpr.exec:\djbpr.exe104⤵PID:2448
-
\??\c:\ndjvb.exec:\ndjvb.exe105⤵PID:1892
-
\??\c:\bvnfnb.exec:\bvnfnb.exe106⤵PID:1732
-
\??\c:\xxbhdfh.exec:\xxbhdfh.exe107⤵PID:1720
-
\??\c:\rnrrhpr.exec:\rnrrhpr.exe108⤵PID:2220
-
\??\c:\dxfdp.exec:\dxfdp.exe109⤵PID:1644
-
\??\c:\fddpjf.exec:\fddpjf.exe110⤵PID:1868
-
\??\c:\rhrnjd.exec:\rhrnjd.exe111⤵PID:2132
-
\??\c:\rnxfj.exec:\rnxfj.exe112⤵PID:804
-
\??\c:\ldrfn.exec:\ldrfn.exe113⤵PID:548
-
\??\c:\bjdvft.exec:\bjdvft.exe114⤵PID:2724
-
\??\c:\hvfnbxx.exec:\hvfnbxx.exe115⤵PID:588
-
\??\c:\bbbxddn.exec:\bbbxddn.exe116⤵PID:2708
-
\??\c:\hjvnvbn.exec:\hjvnvbn.exe117⤵PID:1136
-
\??\c:\tndnpx.exec:\tndnpx.exe118⤵PID:2120
-
\??\c:\txhjrln.exec:\txhjrln.exe119⤵PID:552
-
\??\c:\trdnp.exec:\trdnp.exe120⤵PID:852
-
\??\c:\rdlpx.exec:\rdlpx.exe121⤵PID:1376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-