Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 16:33
Behavioral task
behavioral1
Sample
ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe
-
Size
293KB
-
MD5
ed524ca67a10a5b071f54363d61bc8b0
-
SHA1
83b0125993fc45f43b8f10932b257d79e7cad306
-
SHA256
5d00982cebfbff5df222a2ed71d685e21039114fa7dd5098bedc8c84e15d32b1
-
SHA512
5f0192689e5b0ac98036ed4883449802a7af7837fb047aaa7e3a88e1730752a2e34d8dca01d57404a9a4bbf93a2752f6b3587bf8d06b865092134dd5442f427e
-
SSDEEP
6144:ccm4FmowdHoSQkuObHq9ltAszBd+za/p1slTjZXvEQo9dftOm:K4wFHoSQkuUHk1zBR/pMT9XvEhdfT
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/1056-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2248-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2128-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2464-55-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2336-74-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2800-90-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2780-99-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1308-112-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1092-110-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1308-119-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1920-130-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1616-153-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1360-162-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/944-173-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1756-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3020-210-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3020-209-0x00000000003A0000-0x00000000003D4000-memory.dmp family_blackmoon behavioral1/memory/2420-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1636-237-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1968-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/908-281-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3000-289-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/3000-290-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2260-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2816-342-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2816-341-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2680-349-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2492-378-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1840-442-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1840-444-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1780-501-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2428-514-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/936-534-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon behavioral1/memory/1208-559-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2916-569-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/976-568-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1668-589-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2992-614-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1716-645-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2992-646-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2840-665-0x0000000000260000-0x0000000000294000-memory.dmp family_blackmoon behavioral1/memory/1556-672-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2632-723-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/112-738-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/696-751-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/112-771-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/2044-784-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/2044-810-0x0000000000440000-0x0000000000474000-memory.dmp family_blackmoon behavioral1/memory/2384-818-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1756-837-0x00000000002A0000-0x00000000002D4000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule C:\ttxrt.exe family_berbew \??\c:\nnndxnf.exe family_berbew C:\nvxddxx.exe family_berbew \??\c:\rdxvpj.exe family_berbew C:\frtnxnd.exe family_berbew C:\vvpxxv.exe family_berbew C:\xffnt.exe family_berbew C:\rfrhd.exe family_berbew \??\c:\hbltrln.exe family_berbew C:\tflthjh.exe family_berbew \??\c:\xvjlpnr.exe family_berbew \??\c:\dvbvb.exe family_berbew C:\rbvlhj.exe family_berbew \??\c:\xjbhdf.exe family_berbew \??\c:\txlnbx.exe family_berbew \??\c:\nntfpj.exe family_berbew C:\djhjjlh.exe family_berbew C:\xrndvnx.exe family_berbew C:\lfjfj.exe family_berbew \??\c:\thdjpvn.exe family_berbew C:\xxbnv.exe family_berbew C:\thvll.exe family_berbew C:\pvftdhj.exe family_berbew C:\jvxbhf.exe family_berbew \??\c:\jfbdh.exe family_berbew C:\lftfnh.exe family_berbew C:\dhpvdpv.exe family_berbew C:\vxhprlx.exe family_berbew C:\vblfttv.exe family_berbew \??\c:\fplltd.exe family_berbew C:\xvfvp.exe family_berbew C:\jnbnbv.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ttxrt.exennndxnf.exenvxddxx.exerdxvpj.exefrtnxnd.exevvpxxv.exexffnt.exehbltrln.exerfrhd.exetflthjh.exexvjlpnr.exedvbvb.exerbvlhj.exexjbhdf.exetxlnbx.exenntfpj.exedjhjjlh.exexrndvnx.exelfjfj.exethdjpvn.exexxbnv.exethvll.exepvftdhj.exejfbdh.exejvxbhf.exelftfnh.exedhpvdpv.exevxhprlx.exevblfttv.exefplltd.exexvfvp.exejnbnbv.exepvjfr.exejtjpbnr.exedlrpntn.exednpjfl.exebfxffn.exepthnhr.exepprhl.exeblvhp.exerpfdv.exebltnr.exexdxdd.exejrflf.exexfxxf.exerxhhbj.exepffpfjb.exetjrvdx.exejlrrxn.exelnvtlhh.exefnxrvl.exevdlbvft.exetfpphv.exexvfvf.exejrjdll.exetfhfhtd.exettrfb.exexpdpdxd.exexjbnpn.exedhxxjjf.exenbfrfl.exedxrhjl.exeftxlt.exerljrb.exepid process 2248 ttxrt.exe 1324 nnndxnf.exe 2128 nvxddxx.exe 2568 rdxvpj.exe 2464 frtnxnd.exe 1540 vvpxxv.exe 2468 xffnt.exe 2336 hbltrln.exe 2800 rfrhd.exe 2780 tflthjh.exe 1092 xvjlpnr.exe 1308 dvbvb.exe 1428 rbvlhj.exe 1920 xjbhdf.exe 2288 txlnbx.exe 1616 nntfpj.exe 1360 djhjjlh.exe 944 xrndvnx.exe 956 lfjfj.exe 1756 thdjpvn.exe 1944 xxbnv.exe 3020 thvll.exe 2420 pvftdhj.exe 2724 jfbdh.exe 1636 jvxbhf.exe 1816 lftfnh.exe 1988 dhpvdpv.exe 1700 vxhprlx.exe 1968 vblfttv.exe 908 fplltd.exe 3000 xvfvp.exe 1508 jnbnbv.exe 1436 pvjfr.exe 2260 jtjpbnr.exe 1164 dlrpntn.exe 2036 dnpjfl.exe 1612 bfxffn.exe 2816 pthnhr.exe 2680 pprhl.exe 2932 blvhp.exe 2612 rpfdv.exe 2620 bltnr.exe 2492 xdxdd.exe 2660 jrflf.exe 2380 xfxxf.exe 2348 rxhhbj.exe 2388 pffpfjb.exe 2988 tjrvdx.exe 528 jlrrxn.exe 2316 lnvtlhh.exe 1052 fnxrvl.exe 1308 vdlbvft.exe 1840 tfpphv.exe 2144 xvfvf.exe 2184 jrjdll.exe 1832 tfhfhtd.exe 2044 ttrfb.exe 1960 xpdpdxd.exe 2020 xjbnpn.exe 1708 dhxxjjf.exe 936 nbfrfl.exe 1780 dxrhjl.exe 2320 ftxlt.exe 2428 rljrb.exe -
Processes:
resource yara_rule behavioral1/memory/1056-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1056-3-0x0000000000220000-0x0000000000254000-memory.dmp upx C:\ttxrt.exe upx behavioral1/memory/1056-8-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2248-12-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\nnndxnf.exe upx behavioral1/memory/1324-19-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\nvxddxx.exe upx behavioral1/memory/2128-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2128-37-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\rdxvpj.exe upx C:\frtnxnd.exe upx C:\vvpxxv.exe upx behavioral1/memory/2464-55-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xffnt.exe upx behavioral1/memory/2336-74-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rfrhd.exe upx \??\c:\hbltrln.exe upx C:\tflthjh.exe upx behavioral1/memory/2780-91-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2800-90-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2780-99-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xvjlpnr.exe upx behavioral1/memory/1092-101-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1308-112-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\dvbvb.exe upx behavioral1/memory/1092-110-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\rbvlhj.exe upx behavioral1/memory/1308-119-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1920-130-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\xjbhdf.exe upx \??\c:\txlnbx.exe upx \??\c:\nntfpj.exe upx C:\djhjjlh.exe upx behavioral1/memory/1616-153-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xrndvnx.exe upx behavioral1/memory/1360-162-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/944-165-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lfjfj.exe upx behavioral1/memory/944-173-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\thdjpvn.exe upx behavioral1/memory/1756-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1944-193-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\xxbnv.exe upx C:\thvll.exe upx behavioral1/memory/3020-210-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\pvftdhj.exe upx C:\jvxbhf.exe upx \??\c:\jfbdh.exe upx behavioral1/memory/2724-221-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2420-219-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\lftfnh.exe upx behavioral1/memory/1816-239-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\dhpvdpv.exe upx C:\vxhprlx.exe upx C:\vblfttv.exe upx behavioral1/memory/1968-271-0x0000000000400000-0x0000000000434000-memory.dmp upx \??\c:\fplltd.exe upx C:\xvfvp.exe upx behavioral1/memory/908-281-0x0000000000400000-0x0000000000434000-memory.dmp upx C:\jnbnbv.exe upx behavioral1/memory/3000-290-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1436-299-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2260-306-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exettxrt.exennndxnf.exenvxddxx.exerdxvpj.exefrtnxnd.exevvpxxv.exexffnt.exehbltrln.exerfrhd.exetflthjh.exexvjlpnr.exedvbvb.exerbvlhj.exexjbhdf.exetxlnbx.exedescription pid process target process PID 1056 wrote to memory of 2248 1056 ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe ttxrt.exe PID 1056 wrote to memory of 2248 1056 ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe ttxrt.exe PID 1056 wrote to memory of 2248 1056 ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe ttxrt.exe PID 1056 wrote to memory of 2248 1056 ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe ttxrt.exe PID 2248 wrote to memory of 1324 2248 ttxrt.exe nnndxnf.exe PID 2248 wrote to memory of 1324 2248 ttxrt.exe nnndxnf.exe PID 2248 wrote to memory of 1324 2248 ttxrt.exe nnndxnf.exe PID 2248 wrote to memory of 1324 2248 ttxrt.exe nnndxnf.exe PID 1324 wrote to memory of 2128 1324 nnndxnf.exe nvxddxx.exe PID 1324 wrote to memory of 2128 1324 nnndxnf.exe nvxddxx.exe PID 1324 wrote to memory of 2128 1324 nnndxnf.exe nvxddxx.exe PID 1324 wrote to memory of 2128 1324 nnndxnf.exe nvxddxx.exe PID 2128 wrote to memory of 2568 2128 nvxddxx.exe rdxvpj.exe PID 2128 wrote to memory of 2568 2128 nvxddxx.exe rdxvpj.exe PID 2128 wrote to memory of 2568 2128 nvxddxx.exe rdxvpj.exe PID 2128 wrote to memory of 2568 2128 nvxddxx.exe rdxvpj.exe PID 2568 wrote to memory of 2464 2568 rdxvpj.exe frtnxnd.exe PID 2568 wrote to memory of 2464 2568 rdxvpj.exe frtnxnd.exe PID 2568 wrote to memory of 2464 2568 rdxvpj.exe frtnxnd.exe PID 2568 wrote to memory of 2464 2568 rdxvpj.exe frtnxnd.exe PID 2464 wrote to memory of 1540 2464 frtnxnd.exe vvpxxv.exe PID 2464 wrote to memory of 1540 2464 frtnxnd.exe vvpxxv.exe PID 2464 wrote to memory of 1540 2464 frtnxnd.exe vvpxxv.exe PID 2464 wrote to memory of 1540 2464 frtnxnd.exe vvpxxv.exe PID 1540 wrote to memory of 2468 1540 vvpxxv.exe xffnt.exe PID 1540 wrote to memory of 2468 1540 vvpxxv.exe xffnt.exe PID 1540 wrote to memory of 2468 1540 vvpxxv.exe xffnt.exe PID 1540 wrote to memory of 2468 1540 vvpxxv.exe xffnt.exe PID 2468 wrote to memory of 2336 2468 xffnt.exe hbltrln.exe PID 2468 wrote to memory of 2336 2468 xffnt.exe hbltrln.exe PID 2468 wrote to memory of 2336 2468 xffnt.exe hbltrln.exe PID 2468 wrote to memory of 2336 2468 xffnt.exe hbltrln.exe PID 2336 wrote to memory of 2800 2336 hbltrln.exe rfrhd.exe PID 2336 wrote to memory of 2800 2336 hbltrln.exe rfrhd.exe PID 2336 wrote to memory of 2800 2336 hbltrln.exe rfrhd.exe PID 2336 wrote to memory of 2800 2336 hbltrln.exe rfrhd.exe PID 2800 wrote to memory of 2780 2800 rfrhd.exe tflthjh.exe PID 2800 wrote to memory of 2780 2800 rfrhd.exe tflthjh.exe PID 2800 wrote to memory of 2780 2800 rfrhd.exe tflthjh.exe PID 2800 wrote to memory of 2780 2800 rfrhd.exe tflthjh.exe PID 2780 wrote to memory of 1092 2780 tflthjh.exe xvjlpnr.exe PID 2780 wrote to memory of 1092 2780 tflthjh.exe xvjlpnr.exe PID 2780 wrote to memory of 1092 2780 tflthjh.exe xvjlpnr.exe PID 2780 wrote to memory of 1092 2780 tflthjh.exe xvjlpnr.exe PID 1092 wrote to memory of 1308 1092 xvjlpnr.exe dvbvb.exe PID 1092 wrote to memory of 1308 1092 xvjlpnr.exe dvbvb.exe PID 1092 wrote to memory of 1308 1092 xvjlpnr.exe dvbvb.exe PID 1092 wrote to memory of 1308 1092 xvjlpnr.exe dvbvb.exe PID 1308 wrote to memory of 1428 1308 dvbvb.exe rbvlhj.exe PID 1308 wrote to memory of 1428 1308 dvbvb.exe rbvlhj.exe PID 1308 wrote to memory of 1428 1308 dvbvb.exe rbvlhj.exe PID 1308 wrote to memory of 1428 1308 dvbvb.exe rbvlhj.exe PID 1428 wrote to memory of 1920 1428 rbvlhj.exe xjbhdf.exe PID 1428 wrote to memory of 1920 1428 rbvlhj.exe xjbhdf.exe PID 1428 wrote to memory of 1920 1428 rbvlhj.exe xjbhdf.exe PID 1428 wrote to memory of 1920 1428 rbvlhj.exe xjbhdf.exe PID 1920 wrote to memory of 2288 1920 xjbhdf.exe txlnbx.exe PID 1920 wrote to memory of 2288 1920 xjbhdf.exe txlnbx.exe PID 1920 wrote to memory of 2288 1920 xjbhdf.exe txlnbx.exe PID 1920 wrote to memory of 2288 1920 xjbhdf.exe txlnbx.exe PID 2288 wrote to memory of 1616 2288 txlnbx.exe nntfpj.exe PID 2288 wrote to memory of 1616 2288 txlnbx.exe nntfpj.exe PID 2288 wrote to memory of 1616 2288 txlnbx.exe nntfpj.exe PID 2288 wrote to memory of 1616 2288 txlnbx.exe nntfpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ed524ca67a10a5b071f54363d61bc8b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\ttxrt.exec:\ttxrt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nnndxnf.exec:\nnndxnf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\nvxddxx.exec:\nvxddxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rdxvpj.exec:\rdxvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\frtnxnd.exec:\frtnxnd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\vvpxxv.exec:\vvpxxv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\xffnt.exec:\xffnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\hbltrln.exec:\hbltrln.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rfrhd.exec:\rfrhd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tflthjh.exec:\tflthjh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\xvjlpnr.exec:\xvjlpnr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\dvbvb.exec:\dvbvb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\rbvlhj.exec:\rbvlhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\xjbhdf.exec:\xjbhdf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\txlnbx.exec:\txlnbx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nntfpj.exec:\nntfpj.exe17⤵
- Executes dropped EXE
PID:1616 -
\??\c:\djhjjlh.exec:\djhjjlh.exe18⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xrndvnx.exec:\xrndvnx.exe19⤵
- Executes dropped EXE
PID:944 -
\??\c:\lfjfj.exec:\lfjfj.exe20⤵
- Executes dropped EXE
PID:956 -
\??\c:\thdjpvn.exec:\thdjpvn.exe21⤵
- Executes dropped EXE
PID:1756 -
\??\c:\xxbnv.exec:\xxbnv.exe22⤵
- Executes dropped EXE
PID:1944 -
\??\c:\thvll.exec:\thvll.exe23⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pvftdhj.exec:\pvftdhj.exe24⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jfbdh.exec:\jfbdh.exe25⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jvxbhf.exec:\jvxbhf.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lftfnh.exec:\lftfnh.exe27⤵
- Executes dropped EXE
PID:1816 -
\??\c:\dhpvdpv.exec:\dhpvdpv.exe28⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vxhprlx.exec:\vxhprlx.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vblfttv.exec:\vblfttv.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\fplltd.exec:\fplltd.exe31⤵
- Executes dropped EXE
PID:908 -
\??\c:\xvfvp.exec:\xvfvp.exe32⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jnbnbv.exec:\jnbnbv.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pvjfr.exec:\pvjfr.exe34⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jtjpbnr.exec:\jtjpbnr.exe35⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dlrpntn.exec:\dlrpntn.exe36⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dnpjfl.exec:\dnpjfl.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bfxffn.exec:\bfxffn.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pthnhr.exec:\pthnhr.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pprhl.exec:\pprhl.exe40⤵
- Executes dropped EXE
PID:2680 -
\??\c:\blvhp.exec:\blvhp.exe41⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rpfdv.exec:\rpfdv.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bltnr.exec:\bltnr.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xdxdd.exec:\xdxdd.exe44⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jrflf.exec:\jrflf.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xfxxf.exec:\xfxxf.exe46⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxhhbj.exec:\rxhhbj.exe47⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pffpfjb.exec:\pffpfjb.exe48⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tjrvdx.exec:\tjrvdx.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jlrrxn.exec:\jlrrxn.exe50⤵
- Executes dropped EXE
PID:528 -
\??\c:\lnvtlhh.exec:\lnvtlhh.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fnxrvl.exec:\fnxrvl.exe52⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vdlbvft.exec:\vdlbvft.exe53⤵
- Executes dropped EXE
PID:1308 -
\??\c:\tfpphv.exec:\tfpphv.exe54⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xvfvf.exec:\xvfvf.exe55⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jrjdll.exec:\jrjdll.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tfhfhtd.exec:\tfhfhtd.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ttrfb.exec:\ttrfb.exe58⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xpdpdxd.exec:\xpdpdxd.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xjbnpn.exec:\xjbnpn.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dhxxjjf.exec:\dhxxjjf.exe61⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nbfrfl.exec:\nbfrfl.exe62⤵
- Executes dropped EXE
PID:936 -
\??\c:\dxrhjl.exec:\dxrhjl.exe63⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ftxlt.exec:\ftxlt.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rljrb.exec:\rljrb.exe65⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bxhbrlp.exec:\bxhbrlp.exe66⤵PID:2796
-
\??\c:\rfbvt.exec:\rfbvt.exe67⤵PID:2644
-
\??\c:\vxhhnv.exec:\vxhhnv.exe68⤵PID:2600
-
\??\c:\xvfdjpn.exec:\xvfdjpn.exe69⤵PID:2916
-
\??\c:\lprhlvl.exec:\lprhlvl.exe70⤵PID:1288
-
\??\c:\njhhphb.exec:\njhhphb.exe71⤵PID:1828
-
\??\c:\hnrvpft.exec:\hnrvpft.exe72⤵PID:1208
-
\??\c:\rjljt.exec:\rjljt.exe73⤵PID:976
-
\??\c:\hhvdhjv.exec:\hhvdhjv.exe74⤵PID:2512
-
\??\c:\drjvxxt.exec:\drjvxxt.exe75⤵PID:2984
-
\??\c:\phhpjjf.exec:\phhpjjf.exe76⤵PID:1668
-
\??\c:\vlpfltt.exec:\vlpfltt.exe77⤵PID:1740
-
\??\c:\rthtl.exec:\rthtl.exe78⤵PID:2688
-
\??\c:\prvjhx.exec:\prvjhx.exe79⤵PID:1808
-
\??\c:\tnhvlj.exec:\tnhvlj.exe80⤵PID:2992
-
\??\c:\lnfflfx.exec:\lnfflfx.exe81⤵PID:2272
-
\??\c:\fpxbb.exec:\fpxbb.exe82⤵PID:1744
-
\??\c:\ndbxrv.exec:\ndbxrv.exe83⤵PID:2212
-
\??\c:\ndppbb.exec:\ndppbb.exe84⤵PID:1496
-
\??\c:\ptrpfb.exec:\ptrpfb.exe85⤵PID:1716
-
\??\c:\nvjltvh.exec:\nvjltvh.exe86⤵PID:2216
-
\??\c:\bjttvb.exec:\bjttvb.exe87⤵PID:2424
-
\??\c:\pbxtp.exec:\pbxtp.exe88⤵PID:2840
-
\??\c:\rffpl.exec:\rffpl.exe89⤵PID:2488
-
\??\c:\lpxbhxb.exec:\lpxbhxb.exe90⤵PID:1556
-
\??\c:\dfrdphn.exec:\dfrdphn.exe91⤵PID:2340
-
\??\c:\dbtpxdl.exec:\dbtpxdl.exe92⤵PID:2492
-
\??\c:\vfbxrjp.exec:\vfbxrjp.exe93⤵PID:2368
-
\??\c:\rtlhpv.exec:\rtlhpv.exe94⤵PID:2468
-
\??\c:\ptjvnrh.exec:\ptjvnrh.exe95⤵PID:2944
-
\??\c:\rrhhh.exec:\rrhhh.exe96⤵PID:2188
-
\??\c:\hxdhx.exec:\hxdhx.exe97⤵PID:2632
-
\??\c:\xhnnp.exec:\xhnnp.exe98⤵PID:776
-
\??\c:\bftpvr.exec:\bftpvr.exe99⤵PID:112
-
\??\c:\fhldhx.exec:\fhldhx.exe100⤵PID:460
-
\??\c:\rlllrj.exec:\rlllrj.exe101⤵PID:696
-
\??\c:\hrjpb.exec:\hrjpb.exe102⤵PID:1840
-
\??\c:\nhpth.exec:\nhpth.exe103⤵PID:2032
-
\??\c:\lnpdp.exec:\lnpdp.exe104⤵PID:2176
-
\??\c:\jfnrpjt.exec:\jfnrpjt.exe105⤵PID:2000
-
\??\c:\ptrth.exec:\ptrth.exe106⤵PID:2044
-
\??\c:\nxhrhh.exec:\nxhrhh.exe107⤵PID:1960
-
\??\c:\djxnhd.exec:\djxnhd.exe108⤵PID:940
-
\??\c:\jlvdj.exec:\jlvdj.exe109⤵PID:1112
-
\??\c:\vnhhdtb.exec:\vnhhdtb.exe110⤵PID:1756
-
\??\c:\hvlhffd.exec:\hvlhffd.exe111⤵PID:2384
-
\??\c:\xbxbv.exec:\xbxbv.exe112⤵PID:2788
-
\??\c:\hdndhd.exec:\hdndhd.exe113⤵PID:2244
-
\??\c:\tjnbtp.exec:\tjnbtp.exe114⤵PID:2668
-
\??\c:\pvfbb.exec:\pvfbb.exe115⤵PID:2420
-
\??\c:\fpnvb.exec:\fpnvb.exe116⤵PID:2904
-
\??\c:\htppt.exec:\htppt.exe117⤵PID:1636
-
\??\c:\xdhxnv.exec:\xdhxnv.exe118⤵PID:2112
-
\??\c:\ltthln.exec:\ltthln.exe119⤵PID:1768
-
\??\c:\fppnjpd.exec:\fppnjpd.exe120⤵PID:328
-
\??\c:\ntlhtpp.exec:\ntlhtpp.exe121⤵PID:1972
-
\??\c:\fbxpn.exec:\fbxpn.exe122⤵PID:604
-
\??\c:\drrnh.exec:\drrnh.exe123⤵PID:368
-
\??\c:\jnfbdb.exec:\jnfbdb.exe124⤵PID:2976
-
\??\c:\vbbvbj.exec:\vbbvbj.exe125⤵PID:1740
-
\??\c:\bjjrxdh.exec:\bjjrxdh.exe126⤵PID:1184
-
\??\c:\jjrfhf.exec:\jjrfhf.exe127⤵PID:2116
-
\??\c:\vxfxh.exec:\vxfxh.exe128⤵PID:2928
-
\??\c:\hbnxx.exec:\hbnxx.exe129⤵PID:2092
-
\??\c:\nhjlb.exec:\nhjlb.exe130⤵PID:1608
-
\??\c:\nxpxx.exec:\nxpxx.exe131⤵PID:1588
-
\??\c:\tjhdpfd.exec:\tjhdpfd.exe132⤵PID:3016
-
\??\c:\dvnvbv.exec:\dvnvbv.exe133⤵PID:2816
-
\??\c:\hjvbf.exec:\hjvbf.exe134⤵PID:2216
-
\??\c:\pdpnbb.exec:\pdpnbb.exe135⤵PID:2572
-
\??\c:\ddjxn.exec:\ddjxn.exe136⤵PID:2544
-
\??\c:\rjnxn.exec:\rjnxn.exe137⤵PID:2604
-
\??\c:\btrvxhl.exec:\btrvxhl.exe138⤵PID:2556
-
\??\c:\rpfjddp.exec:\rpfjddp.exe139⤵PID:2356
-
\??\c:\hvblxhv.exec:\hvblxhv.exe140⤵PID:2392
-
\??\c:\nlxjxt.exec:\nlxjxt.exe141⤵PID:2336
-
\??\c:\frjtrp.exec:\frjtrp.exe142⤵PID:2396
-
\??\c:\dtbfjtj.exec:\dtbfjtj.exe143⤵PID:2388
-
\??\c:\jrrnbp.exec:\jrrnbp.exe144⤵PID:2988
-
\??\c:\rppjvxv.exec:\rppjvxv.exe145⤵PID:1096
-
\??\c:\rnhtll.exec:\rnhtll.exe146⤵PID:1092
-
\??\c:\hnvpjf.exec:\hnvpjf.exe147⤵PID:1412
-
\??\c:\hlhhnn.exec:\hlhhnn.exe148⤵PID:2196
-
\??\c:\nfxtjh.exec:\nfxtjh.exe149⤵PID:1168
-
\??\c:\plntv.exec:\plntv.exe150⤵PID:1840
-
\??\c:\pttdnpb.exec:\pttdnpb.exe151⤵PID:2004
-
\??\c:\xlbjpj.exec:\xlbjpj.exe152⤵PID:1664
-
\??\c:\jbvdnnp.exec:\jbvdnnp.exe153⤵PID:1928
-
\??\c:\xpnrj.exec:\xpnrj.exe154⤵PID:2164
-
\??\c:\rfdrl.exec:\rfdrl.exe155⤵PID:884
-
\??\c:\hlnvdv.exec:\hlnvdv.exe156⤵PID:2140
-
\??\c:\pvvhf.exec:\pvvhf.exe157⤵PID:1596
-
\??\c:\jprhj.exec:\jprhj.exe158⤵PID:2656
-
\??\c:\bjhpxnr.exec:\bjhpxnr.exe159⤵PID:2384
-
\??\c:\xtfdrfd.exec:\xtfdrfd.exe160⤵PID:3020
-
\??\c:\xpvhntj.exec:\xpvhntj.exe161⤵PID:2576
-
\??\c:\pfdrv.exec:\pfdrv.exe162⤵PID:2648
-
\??\c:\xpthj.exec:\xpthj.exe163⤵PID:2724
-
\??\c:\trtvfh.exec:\trtvfh.exe164⤵PID:2916
-
\??\c:\ldpxxd.exec:\ldpxxd.exe165⤵PID:436
-
\??\c:\rxvpbn.exec:\rxvpbn.exe166⤵PID:1160
-
\??\c:\ljrrfjb.exec:\ljrrfjb.exe167⤵PID:1988
-
\??\c:\vhvfxt.exec:\vhvfxt.exe168⤵PID:1208
-
\??\c:\pvtrtr.exec:\pvtrtr.exe169⤵PID:328
-
\??\c:\prvdtvv.exec:\prvdtvv.exe170⤵PID:1972
-
\??\c:\rdxxb.exec:\rdxxb.exe171⤵PID:2124
-
\??\c:\vvlhfl.exec:\vvlhfl.exe172⤵PID:568
-
\??\c:\jhvbvf.exec:\jhvbvf.exe173⤵PID:3004
-
\??\c:\dhttd.exec:\dhttd.exe174⤵PID:2888
-
\??\c:\fvddl.exec:\fvddl.exe175⤵PID:3028
-
\??\c:\lpnvh.exec:\lpnvh.exe176⤵PID:1536
-
\??\c:\hxlxxd.exec:\hxlxxd.exe177⤵PID:2272
-
\??\c:\jnjbxbp.exec:\jnjbxbp.exe178⤵PID:2264
-
\??\c:\rddfd.exec:\rddfd.exe179⤵PID:2212
-
\??\c:\vrnnrr.exec:\vrnnrr.exe180⤵PID:1692
-
\??\c:\tnfjbpv.exec:\tnfjbpv.exe181⤵PID:2148
-
\??\c:\jdxxdt.exec:\jdxxdt.exe182⤵PID:2472
-
\??\c:\hfphf.exec:\hfphf.exe183⤵PID:2520
-
\??\c:\vdbtnj.exec:\vdbtnj.exe184⤵PID:2484
-
\??\c:\rjptvdd.exec:\rjptvdd.exe185⤵PID:2616
-
\??\c:\dlfndnt.exec:\dlfndnt.exe186⤵PID:2544
-
\??\c:\phtvvhn.exec:\phtvvhn.exe187⤵PID:2604
-
\??\c:\jtflhd.exec:\jtflhd.exe188⤵PID:2640
-
\??\c:\fpbtv.exec:\fpbtv.exe189⤵PID:2496
-
\??\c:\vjpjljj.exec:\vjpjljj.exe190⤵PID:2380
-
\??\c:\hxnphvl.exec:\hxnphvl.exe191⤵PID:2348
-
\??\c:\nfrlxfv.exec:\nfrlxfv.exe192⤵PID:2408
-
\??\c:\fbxpjtd.exec:\fbxpjtd.exe193⤵PID:2632
-
\??\c:\vbptpv.exec:\vbptpv.exe194⤵PID:576
-
\??\c:\vbjfvvn.exec:\vbjfvvn.exe195⤵PID:2096
-
\??\c:\xxfpfn.exec:\xxfpfn.exe196⤵PID:1348
-
\??\c:\xfpjt.exec:\xfpjt.exe197⤵PID:828
-
\??\c:\hfhtfjp.exec:\hfhtfjp.exe198⤵PID:1412
-
\??\c:\jjpxlhx.exec:\jjpxlhx.exe199⤵PID:2196
-
\??\c:\fjjrbbt.exec:\fjjrbbt.exe200⤵PID:2200
-
\??\c:\vfxlpjd.exec:\vfxlpjd.exe201⤵PID:1936
-
\??\c:\jjlln.exec:\jjlln.exe202⤵PID:2176
-
\??\c:\frvvdn.exec:\frvvdn.exe203⤵PID:1108
-
\??\c:\tnhnnlp.exec:\tnhnnlp.exe204⤵PID:2044
-
\??\c:\pxhvx.exec:\pxhvx.exe205⤵PID:2020
-
\??\c:\tvrljrj.exec:\tvrljrj.exe206⤵PID:1688
-
\??\c:\xvbpvtj.exec:\xvbpvtj.exe207⤵PID:1780
-
\??\c:\jfjltb.exec:\jfjltb.exe208⤵PID:1956
-
\??\c:\rrpnl.exec:\rrpnl.exe209⤵PID:2584
-
\??\c:\rjvfd.exec:\rjvfd.exe210⤵PID:2384
-
\??\c:\jjvrnhb.exec:\jjvrnhb.exe211⤵PID:2796
-
\??\c:\nbfdf.exec:\nbfdf.exe212⤵PID:2508
-
\??\c:\xlxlt.exec:\xlxlt.exe213⤵PID:2756
-
\??\c:\pvtvvvh.exec:\pvtvvvh.exe214⤵PID:1572
-
\??\c:\dxvlhtl.exec:\dxvlhtl.exe215⤵PID:1136
-
\??\c:\jhpfddb.exec:\jhpfddb.exe216⤵PID:1984
-
\??\c:\bldftbf.exec:\bldftbf.exe217⤵PID:920
-
\??\c:\htxnlnp.exec:\htxnlnp.exe218⤵PID:1980
-
\??\c:\xtlpfn.exec:\xtlpfn.exe219⤵PID:2832
-
\??\c:\fjptxn.exec:\fjptxn.exe220⤵PID:2208
-
\??\c:\fpbtj.exec:\fpbtj.exe221⤵PID:1700
-
\??\c:\dtdhx.exec:\dtdhx.exe222⤵PID:1592
-
\??\c:\npntprv.exec:\npntprv.exe223⤵PID:2072
-
\??\c:\hpdtt.exec:\hpdtt.exe224⤵PID:2688
-
\??\c:\bnxhdtr.exec:\bnxhdtr.exe225⤵PID:1748
-
\??\c:\lnvfrjv.exec:\lnvfrjv.exe226⤵PID:1508
-
\??\c:\ptnpb.exec:\ptnpb.exe227⤵PID:2736
-
\??\c:\pvpxh.exec:\pvpxh.exe228⤵PID:892
-
\??\c:\flfflnf.exec:\flfflnf.exe229⤵PID:2892
-
\??\c:\rdthx.exec:\rdthx.exe230⤵PID:1608
-
\??\c:\rtjddxp.exec:\rtjddxp.exe231⤵PID:1056
-
\??\c:\ntfltnp.exec:\ntfltnp.exe232⤵PID:2896
-
\??\c:\vnfdhdn.exec:\vnfdhdn.exe233⤵PID:2248
-
\??\c:\bvbpt.exec:\bvbpt.exe234⤵PID:2216
-
\??\c:\xlxxhx.exec:\xlxxhx.exe235⤵PID:2840
-
\??\c:\pbldfdh.exec:\pbldfdh.exe236⤵PID:2460
-
\??\c:\xhxdfxn.exec:\xhxdfxn.exe237⤵PID:2620
-
\??\c:\vtnxj.exec:\vtnxj.exe238⤵PID:2372
-
\??\c:\jvrfnh.exec:\jvrfnh.exe239⤵PID:2260
-
\??\c:\btlddxt.exec:\btlddxt.exe240⤵PID:2368
-
\??\c:\nfvfb.exec:\nfvfb.exe241⤵PID:2468
-
\??\c:\xrvxv.exec:\xrvxv.exe242⤵PID:2404