Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:30
Behavioral task
behavioral1
Sample
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe
-
Size
169KB
-
MD5
d76caef928f4fa7d016bc20307422a90
-
SHA1
b8f4916bce06a246d223637e93716058fbcafc7a
-
SHA256
710ad4424f50f3202514b48546416bc3e7c8c619985eb778fbf0157281b79fb0
-
SHA512
e75b7d41100b827f87ffb7255a6e4b77d6895e84e567c2d16d6a3ea162a95a3385e62b5d312dd7bc770a02dc03ee4d184cf54d5b84fe0a1ac6e0da4346e3ce18
-
SSDEEP
1536:HvQBeOGtrYS3srx93UBWfwC6Ggnouy8CUYj7FK4O8A1o4XEc3YtxD8/Ai2A:HhOmTsF93UYfwC6GIoutX8Ki3c3YT8Vf
Score
10/10
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/2836-18-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1752-8-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2616-29-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2580-38-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2604-49-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2588-61-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2720-57-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2456-75-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1096-86-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2784-106-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/628-103-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2832-114-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1848-130-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/952-140-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1032-149-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1516-174-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1620-183-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2392-192-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2336-201-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2240-219-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/3032-211-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1356-228-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1148-232-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1356-230-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2036-249-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2176-266-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2176-268-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1724-301-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/888-309-0x0000000000310000-0x0000000000356000-memory.dmp family_blackmoon behavioral1/memory/2948-317-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1752-324-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2444-380-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1164-393-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2816-418-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2940-425-0x0000000000350000-0x0000000000396000-memory.dmp family_blackmoon behavioral1/memory/2672-432-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1168-439-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/2672-454-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1744-483-0x0000000000450000-0x0000000000496000-memory.dmp family_blackmoon behavioral1/memory/1520-496-0x0000000000450000-0x0000000000496000-memory.dmp family_blackmoon behavioral1/memory/3044-504-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1088-572-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/2016-603-0x0000000000400000-0x0000000000446000-memory.dmp family_blackmoon behavioral1/memory/1752-629-0x00000000001B0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/2848-661-0x0000000000220000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1752-668-0x00000000001B0000-0x00000000001F6000-memory.dmp family_blackmoon behavioral1/memory/2908-747-0x0000000000250000-0x0000000000296000-memory.dmp family_blackmoon behavioral1/memory/1888-880-0x0000000000450000-0x0000000000496000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lbblthd.exenfrvp.exevrrxlhh.exetdtprfn.exejdhpx.exebnjpt.exednvnj.exejrvnjhh.exepplhjp.exerpjdl.exelftpx.exehdfrhj.exefnjnl.exebnltdl.exerhfbl.exelfbrf.exehxjtr.exevbjrt.exepnxlvt.exelbjvp.exeftbtd.exepdvlrtr.exedrpfd.exevrtlj.exevdtxr.exerbfdnt.exexllbbtb.exexvjvnf.exepxhtl.exefrfpnh.exepbrhvtj.exexprhlj.exejxvxl.exenhrvhj.exennrjn.exehlnnxxl.exetxrxrr.exenbtpj.exedrxpbv.exerhfnjr.exerhfnrr.exeddnnf.exenrrvlb.exexbbtxrb.exexvrxxf.exepfrbl.exejbnfhd.exebfrpdh.exeffrpbr.exephhtv.exeldhtbr.exedfhhb.exexxttdrb.exexltpdv.exelddlv.exelrhvlv.exerhjbh.exedjxnr.exerfbtvhr.exehbfvrr.exenbrvd.exervbpt.exenfprh.exejbbrv.exepid process 2836 lbblthd.exe 2616 nfrvp.exe 2580 vrrxlhh.exe 2604 tdtprfn.exe 2720 jdhpx.exe 2588 bnjpt.exe 2456 dnvnj.exe 2924 jrvnjhh.exe 1096 pplhjp.exe 628 rpjdl.exe 2784 lftpx.exe 2832 hdfrhj.exe 1848 fnjnl.exe 952 bnltdl.exe 1032 rhfbl.exe 2412 lfbrf.exe 2744 hxjtr.exe 1516 vbjrt.exe 1620 pnxlvt.exe 2392 lbjvp.exe 2336 ftbtd.exe 3032 pdvlrtr.exe 2240 drpfd.exe 1356 vrtlj.exe 1148 vdtxr.exe 2036 rbfdnt.exe 1836 xllbbtb.exe 2176 xvjvnf.exe 320 pxhtl.exe 2132 frfpnh.exe 1668 pbrhvtj.exe 1724 xprhlj.exe 888 jxvxl.exe 2948 nhrvhj.exe 1752 nnrjn.exe 2632 hlnnxxl.exe 2692 txrxrr.exe 2984 nbtpj.exe 2616 drxpbv.exe 3008 rhfnjr.exe 2004 rhfnrr.exe 2448 ddnnf.exe 2424 nrrvlb.exe 2444 xbbtxrb.exe 2376 xvrxxf.exe 1164 pfrbl.exe 576 jbnfhd.exe 1964 bfrpdh.exe 2768 ffrpbr.exe 2816 phhtv.exe 2940 ldhtbr.exe 2672 dfhhb.exe 1168 xxttdrb.exe 1892 xltpdv.exe 1252 lddlv.exe 1484 lrhvlv.exe 2512 rhjbh.exe 1736 djxnr.exe 1520 rfbtvhr.exe 1744 hbfvrr.exe 2312 nbrvd.exe 3012 rvbpt.exe 3044 nfprh.exe 676 jbbrv.exe -
Processes:
resource yara_rule behavioral1/memory/1284-0-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lbblthd.exe upx behavioral1/memory/2836-12-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2616-20-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\nfrvp.exe upx behavioral1/memory/2836-18-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1752-8-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vrrxlhh.exe upx behavioral1/memory/2616-29-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2604-39-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2580-38-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\tdtprfn.exe upx \??\c:\jdhpx.exe upx behavioral1/memory/2604-49-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2588-61-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\bnjpt.exe upx behavioral1/memory/2720-57-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\dnvnj.exe upx behavioral1/memory/2456-75-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\jrvnjhh.exe upx behavioral1/memory/1096-86-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\pplhjp.exe upx C:\rpjdl.exe upx \??\c:\lftpx.exe upx behavioral1/memory/2784-106-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/628-103-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2832-114-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\fnjnl.exe upx behavioral1/memory/1848-122-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\hdfrhj.exe upx behavioral1/memory/1848-130-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\bnltdl.exe upx C:\rhfbl.exe upx C:\lfbrf.exe upx \??\c:\hxjtr.exe upx behavioral1/memory/2744-158-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vbjrt.exe upx behavioral1/memory/1516-174-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\pnxlvt.exe upx behavioral1/memory/1620-183-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\lbjvp.exe upx \??\c:\ftbtd.exe upx behavioral1/memory/2392-192-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\pdvlrtr.exe upx behavioral1/memory/2336-201-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\drpfd.exe upx behavioral1/memory/2240-219-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\vrtlj.exe upx behavioral1/memory/3032-211-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/1148-232-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\vdtxr.exe upx behavioral1/memory/1356-230-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\rbfdnt.exe upx \??\c:\xllbbtb.exe upx C:\xvjvnf.exe upx behavioral1/memory/2036-249-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\pxhtl.exe upx behavioral1/memory/2176-268-0x0000000000400000-0x0000000000446000-memory.dmp upx C:\frfpnh.exe upx C:\pbrhvtj.exe upx behavioral1/memory/1724-294-0x0000000000400000-0x0000000000446000-memory.dmp upx \??\c:\xprhlj.exe upx behavioral1/memory/1724-301-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/888-307-0x0000000000310000-0x0000000000356000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe -
Drops file in System32 directory 2 IoCs
Processes:
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exed76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exelbblthd.exenfrvp.exevrrxlhh.exetdtprfn.exejdhpx.exebnjpt.exednvnj.exejrvnjhh.exepplhjp.exerpjdl.exelftpx.exehdfrhj.exefnjnl.exebnltdl.exedescription pid process target process PID 1284 wrote to memory of 1752 1284 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe PID 1284 wrote to memory of 1752 1284 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe PID 1284 wrote to memory of 1752 1284 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe PID 1284 wrote to memory of 1752 1284 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe PID 1752 wrote to memory of 2836 1752 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe lbblthd.exe PID 1752 wrote to memory of 2836 1752 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe lbblthd.exe PID 1752 wrote to memory of 2836 1752 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe lbblthd.exe PID 1752 wrote to memory of 2836 1752 d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe lbblthd.exe PID 2836 wrote to memory of 2616 2836 lbblthd.exe nfrvp.exe PID 2836 wrote to memory of 2616 2836 lbblthd.exe nfrvp.exe PID 2836 wrote to memory of 2616 2836 lbblthd.exe nfrvp.exe PID 2836 wrote to memory of 2616 2836 lbblthd.exe nfrvp.exe PID 2616 wrote to memory of 2580 2616 nfrvp.exe vrrxlhh.exe PID 2616 wrote to memory of 2580 2616 nfrvp.exe vrrxlhh.exe PID 2616 wrote to memory of 2580 2616 nfrvp.exe vrrxlhh.exe PID 2616 wrote to memory of 2580 2616 nfrvp.exe vrrxlhh.exe PID 2580 wrote to memory of 2604 2580 vrrxlhh.exe tdtprfn.exe PID 2580 wrote to memory of 2604 2580 vrrxlhh.exe tdtprfn.exe PID 2580 wrote to memory of 2604 2580 vrrxlhh.exe tdtprfn.exe PID 2580 wrote to memory of 2604 2580 vrrxlhh.exe tdtprfn.exe PID 2604 wrote to memory of 2720 2604 tdtprfn.exe jdhpx.exe PID 2604 wrote to memory of 2720 2604 tdtprfn.exe jdhpx.exe PID 2604 wrote to memory of 2720 2604 tdtprfn.exe jdhpx.exe PID 2604 wrote to memory of 2720 2604 tdtprfn.exe jdhpx.exe PID 2720 wrote to memory of 2588 2720 jdhpx.exe bnjpt.exe PID 2720 wrote to memory of 2588 2720 jdhpx.exe bnjpt.exe PID 2720 wrote to memory of 2588 2720 jdhpx.exe bnjpt.exe PID 2720 wrote to memory of 2588 2720 jdhpx.exe bnjpt.exe PID 2588 wrote to memory of 2456 2588 bnjpt.exe dnvnj.exe PID 2588 wrote to memory of 2456 2588 bnjpt.exe dnvnj.exe PID 2588 wrote to memory of 2456 2588 bnjpt.exe dnvnj.exe PID 2588 wrote to memory of 2456 2588 bnjpt.exe dnvnj.exe PID 2456 wrote to memory of 2924 2456 dnvnj.exe jrvnjhh.exe PID 2456 wrote to memory of 2924 2456 dnvnj.exe jrvnjhh.exe PID 2456 wrote to memory of 2924 2456 dnvnj.exe jrvnjhh.exe PID 2456 wrote to memory of 2924 2456 dnvnj.exe jrvnjhh.exe PID 2924 wrote to memory of 1096 2924 jrvnjhh.exe pplhjp.exe PID 2924 wrote to memory of 1096 2924 jrvnjhh.exe pplhjp.exe PID 2924 wrote to memory of 1096 2924 jrvnjhh.exe pplhjp.exe PID 2924 wrote to memory of 1096 2924 jrvnjhh.exe pplhjp.exe PID 1096 wrote to memory of 628 1096 pplhjp.exe rpjdl.exe PID 1096 wrote to memory of 628 1096 pplhjp.exe rpjdl.exe PID 1096 wrote to memory of 628 1096 pplhjp.exe rpjdl.exe PID 1096 wrote to memory of 628 1096 pplhjp.exe rpjdl.exe PID 628 wrote to memory of 2784 628 rpjdl.exe lftpx.exe PID 628 wrote to memory of 2784 628 rpjdl.exe lftpx.exe PID 628 wrote to memory of 2784 628 rpjdl.exe lftpx.exe PID 628 wrote to memory of 2784 628 rpjdl.exe lftpx.exe PID 2784 wrote to memory of 2832 2784 lftpx.exe hdfrhj.exe PID 2784 wrote to memory of 2832 2784 lftpx.exe hdfrhj.exe PID 2784 wrote to memory of 2832 2784 lftpx.exe hdfrhj.exe PID 2784 wrote to memory of 2832 2784 lftpx.exe hdfrhj.exe PID 2832 wrote to memory of 1848 2832 hdfrhj.exe fnjnl.exe PID 2832 wrote to memory of 1848 2832 hdfrhj.exe fnjnl.exe PID 2832 wrote to memory of 1848 2832 hdfrhj.exe fnjnl.exe PID 2832 wrote to memory of 1848 2832 hdfrhj.exe fnjnl.exe PID 1848 wrote to memory of 952 1848 fnjnl.exe bnltdl.exe PID 1848 wrote to memory of 952 1848 fnjnl.exe bnltdl.exe PID 1848 wrote to memory of 952 1848 fnjnl.exe bnltdl.exe PID 1848 wrote to memory of 952 1848 fnjnl.exe bnltdl.exe PID 952 wrote to memory of 1032 952 bnltdl.exe rhfbl.exe PID 952 wrote to memory of 1032 952 bnltdl.exe rhfbl.exe PID 952 wrote to memory of 1032 952 bnltdl.exe rhfbl.exe PID 952 wrote to memory of 1032 952 bnltdl.exe rhfbl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d76caef928f4fa7d016bc20307422a90_NeikiAnalytics.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\lbblthd.exec:\lbblthd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\nfrvp.exec:\nfrvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\vrrxlhh.exec:\vrrxlhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\tdtprfn.exec:\tdtprfn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jdhpx.exec:\jdhpx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bnjpt.exec:\bnjpt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\dnvnj.exec:\dnvnj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jrvnjhh.exec:\jrvnjhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\pplhjp.exec:\pplhjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\rpjdl.exec:\rpjdl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\lftpx.exec:\lftpx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hdfrhj.exec:\hdfrhj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\fnjnl.exec:\fnjnl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\bnltdl.exec:\bnltdl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\rhfbl.exec:\rhfbl.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\lfbrf.exec:\lfbrf.exe19⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hxjtr.exec:\hxjtr.exe20⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vbjrt.exec:\vbjrt.exe21⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pnxlvt.exec:\pnxlvt.exe22⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lbjvp.exec:\lbjvp.exe23⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ftbtd.exec:\ftbtd.exe24⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pdvlrtr.exec:\pdvlrtr.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\drpfd.exec:\drpfd.exe26⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vrtlj.exec:\vrtlj.exe27⤵
- Executes dropped EXE
PID:1356 -
\??\c:\vdtxr.exec:\vdtxr.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\rbfdnt.exec:\rbfdnt.exe29⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xllbbtb.exec:\xllbbtb.exe30⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xvjvnf.exec:\xvjvnf.exe31⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pxhtl.exec:\pxhtl.exe32⤵
- Executes dropped EXE
PID:320 -
\??\c:\frfpnh.exec:\frfpnh.exe33⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pbrhvtj.exec:\pbrhvtj.exe34⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xprhlj.exec:\xprhlj.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jxvxl.exec:\jxvxl.exe36⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhrvhj.exec:\nhrvhj.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnrjn.exec:\nnrjn.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hlnnxxl.exec:\hlnnxxl.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\txrxrr.exec:\txrxrr.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbtpj.exec:\nbtpj.exe41⤵
- Executes dropped EXE
PID:2984 -
\??\c:\drxpbv.exec:\drxpbv.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rhfnjr.exec:\rhfnjr.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rhfnrr.exec:\rhfnrr.exe44⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ddnnf.exec:\ddnnf.exe45⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nrrvlb.exec:\nrrvlb.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xbbtxrb.exec:\xbbtxrb.exe47⤵
- Executes dropped EXE
PID:2444 -
\??\c:\xvrxxf.exec:\xvrxxf.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pfrbl.exec:\pfrbl.exe49⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jbnfhd.exec:\jbnfhd.exe50⤵
- Executes dropped EXE
PID:576 -
\??\c:\bfrpdh.exec:\bfrpdh.exe51⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ffrpbr.exec:\ffrpbr.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\phhtv.exec:\phhtv.exe53⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ldhtbr.exec:\ldhtbr.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dfhhb.exec:\dfhhb.exe55⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xxttdrb.exec:\xxttdrb.exe56⤵
- Executes dropped EXE
PID:1168 -
\??\c:\xltpdv.exec:\xltpdv.exe57⤵
- Executes dropped EXE
PID:1892 -
\??\c:\lddlv.exec:\lddlv.exe58⤵
- Executes dropped EXE
PID:1252 -
\??\c:\lrhvlv.exec:\lrhvlv.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rhjbh.exec:\rhjbh.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\djxnr.exec:\djxnr.exe61⤵
- Executes dropped EXE
PID:1736 -
\??\c:\rfbtvhr.exec:\rfbtvhr.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\hbfvrr.exec:\hbfvrr.exe63⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nbrvd.exec:\nbrvd.exe64⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rvbpt.exec:\rvbpt.exe65⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nfprh.exec:\nfprh.exe66⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jbbrv.exec:\jbbrv.exe67⤵
- Executes dropped EXE
PID:676 -
\??\c:\jjltbbj.exec:\jjltbbj.exe68⤵PID:2076
-
\??\c:\vrtbbd.exec:\vrtbbd.exe69⤵PID:2072
-
\??\c:\jvfhd.exec:\jvfhd.exe70⤵PID:856
-
\??\c:\pndjt.exec:\pndjt.exe71⤵PID:1852
-
\??\c:\fnnbbb.exec:\fnnbbb.exe72⤵PID:1384
-
\??\c:\rnptnbf.exec:\rnptnbf.exe73⤵PID:1588
-
\??\c:\hbbdvbj.exec:\hbbdvbj.exe74⤵PID:2088
-
\??\c:\hpldv.exec:\hpldv.exe75⤵PID:2156
-
\??\c:\fdrhxfx.exec:\fdrhxfx.exe76⤵PID:772
-
\??\c:\hnndhb.exec:\hnndhb.exe77⤵PID:1088
-
\??\c:\lbjxxdb.exec:\lbjxxdb.exe78⤵PID:1728
-
\??\c:\thvttvd.exec:\thvttvd.exe79⤵PID:2132
-
\??\c:\vdvfhfb.exec:\vdvfhfb.exe80⤵PID:1668
-
\??\c:\fbbvtr.exec:\fbbvtr.exe81⤵PID:1316
-
\??\c:\tbplb.exec:\tbplb.exe82⤵PID:2016
-
\??\c:\dlhlf.exec:\dlhlf.exe83⤵PID:2232
-
\??\c:\bvrnhj.exec:\bvrnhj.exe84⤵PID:2916
-
\??\c:\dpfrfv.exec:\dpfrfv.exe85⤵PID:2956
-
\??\c:\hrfdrf.exec:\hrfdrf.exe86⤵PID:1752
-
\??\c:\nvxpjlv.exec:\nvxpjlv.exe87⤵PID:2864
-
\??\c:\xbrtl.exec:\xbrtl.exe88⤵PID:2068
-
\??\c:\rfjhl.exec:\rfjhl.exe89⤵PID:2644
-
\??\c:\nfxljv.exec:\nfxljv.exe90⤵PID:2540
-
\??\c:\nxlpxfv.exec:\nxlpxfv.exe91⤵PID:2848
-
\??\c:\bhbpf.exec:\bhbpf.exe92⤵PID:2720
-
\??\c:\jxttnhp.exec:\jxttnhp.exe93⤵PID:2420
-
\??\c:\brvxfxh.exec:\brvxfxh.exe94⤵PID:2500
-
\??\c:\brpvlvt.exec:\brpvlvt.exe95⤵PID:2456
-
\??\c:\fbjbrjh.exec:\fbjbrjh.exe96⤵PID:2380
-
\??\c:\rfprdxp.exec:\rfprdxp.exe97⤵PID:1096
-
\??\c:\txxjfxx.exec:\txxjfxx.exe98⤵PID:2736
-
\??\c:\rxrpb.exec:\rxrpb.exe99⤵PID:2908
-
\??\c:\djrhdnl.exec:\djrhdnl.exe100⤵PID:3028
-
\??\c:\jflhdv.exec:\jflhdv.exe101⤵PID:1296
-
\??\c:\xlxlxdr.exec:\xlxlxdr.exe102⤵PID:2136
-
\??\c:\hpbdrl.exec:\hpbdrl.exe103⤵PID:1988
-
\??\c:\rrvnr.exec:\rrvnr.exe104⤵PID:2272
-
\??\c:\ftnjrr.exec:\ftnjrr.exe105⤵PID:276
-
\??\c:\pffhdb.exec:\pffhdb.exe106⤵PID:2600
-
\??\c:\btdnfvn.exec:\btdnfvn.exe107⤵PID:2744
-
\??\c:\jnlbb.exec:\jnlbb.exe108⤵PID:1664
-
\??\c:\jvflvh.exec:\jvflvh.exe109⤵PID:2244
-
\??\c:\nfvnv.exec:\nfvnv.exe110⤵PID:1732
-
\??\c:\rpvlnj.exec:\rpvlnj.exe111⤵PID:2872
-
\??\c:\bfnvf.exec:\bfnvf.exe112⤵PID:2336
-
\??\c:\jnhrvrb.exec:\jnhrvrb.exe113⤵PID:380
-
\??\c:\dnbvpdj.exec:\dnbvpdj.exe114⤵PID:988
-
\??\c:\dllvp.exec:\dllvp.exe115⤵PID:2044
-
\??\c:\bjtvjrj.exec:\bjtvjrj.exe116⤵PID:1116
-
\??\c:\pllnx.exec:\pllnx.exe117⤵PID:2352
-
\??\c:\djdrtx.exec:\djdrtx.exe118⤵PID:1112
-
\??\c:\rpdbbj.exec:\rpdbbj.exe119⤵PID:1128
-
\??\c:\fjvrp.exec:\fjvrp.exe120⤵PID:1888
-
\??\c:\drbprvj.exec:\drbprvj.exe121⤵PID:1812
-
\??\c:\djplrj.exec:\djplrj.exe122⤵PID:908
-
\??\c:\nprxrbl.exec:\nprxrbl.exe123⤵PID:2840
-
\??\c:\tnbvvx.exec:\tnbvvx.exe124⤵PID:1748
-
\??\c:\hnfnjxt.exec:\hnfnjxt.exe125⤵PID:2120
-
\??\c:\dxbxv.exec:\dxbxv.exe126⤵PID:588
-
\??\c:\jxhdvr.exec:\jxhdvr.exe127⤵PID:1724
-
\??\c:\bdvldx.exec:\bdvldx.exe128⤵PID:1828
-
\??\c:\vhxnbf.exec:\vhxnbf.exe129⤵PID:2320
-
\??\c:\dhjrv.exec:\dhjrv.exe130⤵PID:2356
-
\??\c:\hjltjnh.exec:\hjltjnh.exe131⤵PID:2276
-
\??\c:\jrfvjxd.exec:\jrfvjxd.exe132⤵PID:3004
-
\??\c:\nvllbft.exec:\nvllbft.exe133⤵PID:1512
-
\??\c:\lbrnb.exec:\lbrnb.exe134⤵PID:2628
-
\??\c:\tpnht.exec:\tpnht.exe135⤵PID:2068
-
\??\c:\vldjbxv.exec:\vldjbxv.exe136⤵PID:1568
-
\??\c:\bhbvn.exec:\bhbvn.exe137⤵PID:2584
-
\??\c:\hddvx.exec:\hddvx.exe138⤵PID:3008
-
\??\c:\lxjfd.exec:\lxjfd.exe139⤵PID:2448
-
\??\c:\tnfhj.exec:\tnfhj.exe140⤵PID:1808
-
\??\c:\dhjxtf.exec:\dhjxtf.exe141⤵PID:2444
-
\??\c:\ptjhhv.exec:\ptjhhv.exe142⤵PID:2992
-
\??\c:\bhbjr.exec:\bhbjr.exe143⤵PID:2380
-
\??\c:\ntfbx.exec:\ntfbx.exe144⤵PID:2268
-
\??\c:\dxhlrtn.exec:\dxhlrtn.exe145⤵PID:1020
-
\??\c:\pfrptfl.exec:\pfrptfl.exe146⤵PID:2792
-
\??\c:\nxxnxpj.exec:\nxxnxpj.exe147⤵PID:2736
-
\??\c:\fjdfndd.exec:\fjdfndd.exe148⤵PID:2832
-
\??\c:\hdrxlvv.exec:\hdrxlvv.exe149⤵PID:948
-
\??\c:\tpnnnrx.exec:\tpnnnrx.exe150⤵PID:956
-
\??\c:\tltbvnr.exec:\tltbvnr.exe151⤵PID:2136
-
\??\c:\bdvrvd.exec:\bdvrvd.exe152⤵PID:1376
-
\??\c:\nnbrrtd.exec:\nnbrrtd.exe153⤵PID:2484
-
\??\c:\thnfn.exec:\thnfn.exe154⤵PID:1032
-
\??\c:\jfvlhf.exec:\jfvlhf.exe155⤵PID:2708
-
\??\c:\brhhrnt.exec:\brhhrnt.exe156⤵PID:1736
-
\??\c:\bxjfft.exec:\bxjfft.exe157⤵PID:596
-
\??\c:\jbjpxb.exec:\jbjpxb.exe158⤵PID:2024
-
\??\c:\bpjvdj.exec:\bpjvdj.exe159⤵PID:528
-
\??\c:\pnbbx.exec:\pnbbx.exe160⤵PID:2868
-
\??\c:\jvhdft.exec:\jvhdft.exe161⤵PID:1680
-
\??\c:\dtpxtjf.exec:\dtpxtjf.exe162⤵PID:1304
-
\??\c:\brfxhv.exec:\brfxhv.exe163⤵PID:2248
-
\??\c:\pflppb.exec:\pflppb.exe164⤵PID:3068
-
\??\c:\frjxn.exec:\frjxn.exe165⤵PID:960
-
\??\c:\xxllrb.exec:\xxllrb.exe166⤵PID:1476
-
\??\c:\pjxtp.exec:\pjxtp.exe167⤵PID:1344
-
\??\c:\ttjhbt.exec:\ttjhbt.exe168⤵PID:1840
-
\??\c:\pvdnp.exec:\pvdnp.exe169⤵PID:828
-
\??\c:\hxptp.exec:\hxptp.exe170⤵PID:1140
-
\??\c:\rhbvx.exec:\rhbvx.exe171⤵PID:608
-
\??\c:\bnlxj.exec:\bnlxj.exe172⤵PID:844
-
\??\c:\nfnvl.exec:\nfnvl.exe173⤵PID:2840
-
\??\c:\rntrplj.exec:\rntrplj.exe174⤵PID:560
-
\??\c:\tbrdlp.exec:\tbrdlp.exe175⤵PID:1044
-
\??\c:\jdnbt.exec:\jdnbt.exe176⤵PID:2740
-
\??\c:\bbhrhbf.exec:\bbhrhbf.exe177⤵PID:616
-
\??\c:\rdtjlf.exec:\rdtjlf.exe178⤵PID:2172
-
\??\c:\htplj.exec:\htplj.exe179⤵PID:2952
-
\??\c:\bjxbjj.exec:\bjxbjj.exe180⤵PID:3064
-
\??\c:\lphnj.exec:\lphnj.exe181⤵PID:2264
-
\??\c:\hpdll.exec:\hpdll.exe182⤵PID:1708
-
\??\c:\djxfrfx.exec:\djxfrfx.exe183⤵PID:2620
-
\??\c:\jvfrbv.exec:\jvfrbv.exe184⤵PID:2684
-
\??\c:\dthnjb.exec:\dthnjb.exe185⤵PID:2984
-
\??\c:\hlfpv.exec:\hlfpv.exe186⤵PID:2604
-
\??\c:\hblplbh.exec:\hblplbh.exe187⤵PID:2468
-
\??\c:\flxhnv.exec:\flxhnv.exe188⤵PID:3008
-
\??\c:\lrvjx.exec:\lrvjx.exe189⤵PID:2544
-
\??\c:\xtnxr.exec:\xtnxr.exe190⤵PID:1808
-
\??\c:\blrjnx.exec:\blrjnx.exe191⤵PID:1056
-
\??\c:\jpptr.exec:\jpptr.exe192⤵PID:2928
-
\??\c:\hpnvdrx.exec:\hpnvdrx.exe193⤵PID:2924
-
\??\c:\jjbdvf.exec:\jjbdvf.exe194⤵PID:2268
-
\??\c:\fxvlln.exec:\fxvlln.exe195⤵PID:2784
-
\??\c:\bdhdl.exec:\bdhdl.exe196⤵PID:2760
-
\??\c:\fhpvnrb.exec:\fhpvnrb.exe197⤵PID:2804
-
\??\c:\rvjhrxl.exec:\rvjhrxl.exe198⤵PID:2908
-
\??\c:\fhvpvx.exec:\fhvpvx.exe199⤵PID:1168
-
\??\c:\xvhdf.exec:\xvhdf.exe200⤵PID:1296
-
\??\c:\plxtjf.exec:\plxtjf.exe201⤵PID:952
-
\??\c:\nflhbv.exec:\nflhbv.exe202⤵PID:804
-
\??\c:\hrnhr.exec:\hrnhr.exe203⤵PID:2484
-
\??\c:\bpdprx.exec:\bpdprx.exe204⤵PID:1660
-
\??\c:\hjphtv.exec:\hjphtv.exe205⤵PID:1036
-
\??\c:\djdhft.exec:\djdhft.exe206⤵PID:2288
-
\??\c:\lffjt.exec:\lffjt.exe207⤵PID:2244
-
\??\c:\lfbnxh.exec:\lfbnxh.exe208⤵PID:2308
-
\??\c:\hdpnrll.exec:\hdpnrll.exe209⤵PID:2872
-
\??\c:\tfxtbr.exec:\tfxtbr.exe210⤵PID:2336
-
\??\c:\xhrdfjb.exec:\xhrdfjb.exe211⤵PID:2060
-
\??\c:\ttxjxrl.exec:\ttxjxrl.exe212⤵PID:2212
-
\??\c:\dhjnpdd.exec:\dhjnpdd.exe213⤵PID:652
-
\??\c:\brdpvlh.exec:\brdpvlh.exe214⤵PID:3068
-
\??\c:\frbnrb.exec:\frbnrb.exe215⤵PID:980
-
\??\c:\ldvrhd.exec:\ldvrhd.exe216⤵PID:1440
-
\??\c:\fpdxdrj.exec:\fpdxdrj.exe217⤵PID:1984
-
\??\c:\txbbrv.exec:\txbbrv.exe218⤵PID:1756
-
\??\c:\dbpph.exec:\dbpph.exe219⤵PID:1816
-
\??\c:\xpbxflf.exec:\xpbxflf.exe220⤵PID:1940
-
\??\c:\btfnph.exec:\btfnph.exe221⤵PID:884
-
\??\c:\xhjfd.exec:\xhjfd.exe222⤵PID:1764
-
\??\c:\vxdjdlh.exec:\vxdjdlh.exe223⤵PID:1748
-
\??\c:\dxxpb.exec:\dxxpb.exe224⤵PID:1872
-
\??\c:\rxjfj.exec:\rxjfj.exe225⤵PID:2904
-
\??\c:\bddjph.exec:\bddjph.exe226⤵PID:588
-
\??\c:\vtrvj.exec:\vtrvj.exe227⤵PID:1828
-
\??\c:\thfxpj.exec:\thfxpj.exe228⤵PID:2888
-
\??\c:\hfnxrrh.exec:\hfnxrrh.exe229⤵PID:2668
-
\??\c:\nnvfpr.exec:\nnvfpr.exe230⤵PID:3024
-
\??\c:\nxlntp.exec:\nxlntp.exe231⤵PID:2652
-
\??\c:\pbxvll.exec:\pbxvll.exe232⤵PID:2688
-
\??\c:\bjlpn.exec:\bjlpn.exe233⤵PID:2628
-
\??\c:\djtxnjb.exec:\djtxnjb.exe234⤵PID:2724
-
\??\c:\vhbbp.exec:\vhbbp.exe235⤵PID:2644
-
\??\c:\jjfprx.exec:\jjfprx.exe236⤵PID:2584
-
\??\c:\fndrxb.exec:\fndrxb.exe237⤵PID:2848
-
\??\c:\vvfbph.exec:\vvfbph.exe238⤵PID:2028
-
\??\c:\thdtp.exec:\thdtp.exe239⤵PID:2588
-
\??\c:\vfrtvfd.exec:\vfrtvfd.exe240⤵PID:2920
-
\??\c:\fhlrt.exec:\fhlrt.exe241⤵PID:2472
-
\??\c:\tfxhfnn.exec:\tfxhfnn.exe242⤵PID:1880