Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 19:34
Behavioral task
behavioral1
Sample
f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe
-
Size
253KB
-
MD5
f4d04404ded651cda9dcc5ba42a1d150
-
SHA1
e509b5aec318a2d0b8dc6aabcde5784ba44e315b
-
SHA256
399dc491d2a951480ed0bac618c7922fc4430b162fc288000df974f71c9887b9
-
SHA512
d051106ae534134524285a1b8842c9e2b90c3a199f2587b690dc7e1289463ccb0323954cab1a983789cdc091fe40d960c4690167db13c8c57ec29e776320d2bd
-
SSDEEP
3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLpcgDE4JBuItR8pTsgZ9WT4iaz+THkm:ccm4FmowdHoSi9EIBftapTs4WZazeE1Y
Malware Config
Signatures
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2804-7-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2684-20-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2424-30-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2424-36-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/3064-40-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2444-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2376-83-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2856-87-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2700-85-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/680-102-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/576-111-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/576-114-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/576-112-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1840-131-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2176-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1840-167-0x0000000000260000-0x0000000000296000-memory.dmp family_blackmoon behavioral1/memory/1796-174-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1776-183-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/768-200-0x00000000003A0000-0x00000000003D6000-memory.dmp family_blackmoon behavioral1/memory/768-201-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2252-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2252-219-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2912-238-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1828-248-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/980-256-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/328-265-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon behavioral1/memory/1972-275-0x00000000005D0000-0x0000000000606000-memory.dmp family_blackmoon behavioral1/memory/2060-279-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2116-308-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2092-321-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2084-328-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2148-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2456-368-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-387-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2152-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2016-421-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1320-428-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/904-471-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1648-477-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1844-545-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1988-559-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/980-561-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1752-590-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/2744-687-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/964-735-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1112-790-0x0000000000440000-0x0000000000476000-memory.dmp family_blackmoon behavioral1/memory/3012-821-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1988-867-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2888-905-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1536-918-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2820-931-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2628-945-0x00000000001B0000-0x00000000001E6000-memory.dmp family_blackmoon behavioral1/memory/2844-952-0x00000000005D0000-0x0000000000606000-memory.dmp family_blackmoon behavioral1/memory/1848-1020-0x00000000003C0000-0x00000000003F6000-memory.dmp family_blackmoon behavioral1/memory/2772-1039-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/1476-1040-0x0000000000250000-0x0000000000286000-memory.dmp family_blackmoon behavioral1/memory/2176-1074-0x0000000000230000-0x0000000000266000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 35 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/files/0x000b000000014fe1-9.dat family_berbew behavioral1/files/0x00090000000155d9-19.dat family_berbew behavioral1/files/0x00090000000155e2-28.dat family_berbew behavioral1/memory/2424-36-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x0008000000015c23-38.dat family_berbew behavioral1/files/0x0007000000015c2f-46.dat family_berbew behavioral1/files/0x0007000000015c3c-58.dat family_berbew behavioral1/files/0x0009000000015c52-65.dat family_berbew behavioral1/files/0x0006000000016042-76.dat family_berbew behavioral1/files/0x000600000001604b-84.dat family_berbew behavioral1/memory/2700-85-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x000900000001560a-93.dat family_berbew behavioral1/files/0x0006000000016283-103.dat family_berbew behavioral1/memory/576-111-0x0000000000220000-0x0000000000256000-memory.dmp family_berbew behavioral1/files/0x0006000000016332-115.dat family_berbew behavioral1/files/0x0006000000016476-122.dat family_berbew behavioral1/files/0x00060000000165ae-130.dat family_berbew behavioral1/files/0x000600000001663d-139.dat family_berbew behavioral1/files/0x00060000000167db-148.dat family_berbew behavioral1/files/0x0006000000016b5e-157.dat family_berbew behavioral1/files/0x0006000000016b96-166.dat family_berbew behavioral1/files/0x0006000000016c10-175.dat family_berbew behavioral1/files/0x0006000000016c1a-185.dat family_berbew behavioral1/files/0x0006000000016c23-192.dat family_berbew behavioral1/files/0x0006000000016c90-202.dat family_berbew behavioral1/files/0x0006000000016ca9-210.dat family_berbew behavioral1/files/0x0006000000016ccf-222.dat family_berbew behavioral1/files/0x0006000000016cd4-230.dat family_berbew behavioral1/files/0x0006000000016cf0-240.dat family_berbew behavioral1/files/0x0006000000016d01-249.dat family_berbew behavioral1/files/0x0006000000016d11-258.dat family_berbew behavioral1/files/0x0006000000016d24-266.dat family_berbew behavioral1/files/0x0006000000016d36-277.dat family_berbew behavioral1/files/0x0006000000016d41-286.dat family_berbew behavioral1/files/0x0006000000016d4a-293.dat family_berbew -
Executes dropped EXE 64 IoCs
pid Process 2940 bxfjbbv.exe 2684 rnxxr.exe 2424 xrrvr.exe 3064 thlxhft.exe 2700 lvbbv.exe 2464 pttnrn.exe 2444 jxjhlp.exe 2376 lvhbd.exe 2856 blhbbbr.exe 680 jxjjr.exe 576 hblphjx.exe 1192 vbpvv.exe 1840 vtjlvlh.exe 624 prjvr.exe 2176 dxjlld.exe 2008 ptjvhh.exe 2136 htljvnn.exe 1796 rjbvnbf.exe 1776 lldrbf.exe 800 vfrblb.exe 768 pfjnt.exe 3012 xhfhd.exe 2252 flxppj.exe 2576 hfrjb.exe 2912 vxdtrj.exe 1828 pprfrfx.exe 980 xpljb.exe 328 nnnlp.exe 1972 btfhhbp.exe 2060 tttxp.exe 1088 hnhjlbd.exe 2088 tprthpt.exe 2116 tlhtvvh.exe 1760 njrvbbv.exe 2092 jvvlptp.exe 2084 nlxlp.exe 2148 frrvttn.exe 2680 vvdllj.exe 3056 hhbbvnb.exe 2204 xdjbr.exe 2868 nrnflbd.exe 2456 lpjtx.exe 2564 pxnpv.exe 2492 vbdrx.exe 2692 phdfpft.exe 2152 vtntbt.exe 2944 nxvrr.exe 2036 hbnjvr.exe 2856 fbfnp.exe 2016 nrdndh.exe 1320 frjjjr.exe 904 thxndjv.exe 572 bvljvx.exe 2192 nvrxjd.exe 2004 lvvphv.exe 1832 vrxjv.exe 1368 xfxrvh.exe 1648 ftrbjbv.exe 1928 pppbpf.exe 764 lptrnlv.exe 2432 pbhlv.exe 800 bldxb.exe 1956 hvvfnfh.exe 2796 lvrpdrx.exe -
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2804-8-0x0000000000440000-0x0000000000476000-memory.dmp upx behavioral1/files/0x000b000000014fe1-9.dat upx behavioral1/memory/2804-7-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2940-10-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2684-20-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00090000000155d9-19.dat upx behavioral1/files/0x00090000000155e2-28.dat upx behavioral1/memory/2424-30-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/3064-40-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0008000000015c23-38.dat upx behavioral1/files/0x0007000000015c2f-46.dat upx behavioral1/memory/2700-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2700-55-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0007000000015c3c-58.dat upx behavioral1/memory/2464-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0009000000015c52-65.dat upx behavioral1/memory/2444-66-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2444-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016042-76.dat upx behavioral1/memory/2376-83-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000600000001604b-84.dat upx behavioral1/memory/2856-87-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x000900000001560a-93.dat upx behavioral1/files/0x0006000000016283-103.dat upx behavioral1/memory/680-102-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/576-111-0x0000000000220000-0x0000000000256000-memory.dmp upx behavioral1/files/0x0006000000016332-115.dat upx behavioral1/memory/576-114-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016476-122.dat upx behavioral1/memory/1840-131-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x00060000000165ae-130.dat upx behavioral1/files/0x000600000001663d-139.dat upx behavioral1/files/0x00060000000167db-148.dat upx behavioral1/memory/2008-149-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2176-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2136-158-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016b5e-157.dat upx behavioral1/files/0x0006000000016b96-166.dat upx behavioral1/memory/1796-174-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c10-175.dat upx behavioral1/memory/1776-183-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016c1a-185.dat upx behavioral1/files/0x0006000000016c23-192.dat upx behavioral1/files/0x0006000000016c90-202.dat upx behavioral1/memory/768-201-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016ca9-210.dat upx behavioral1/files/0x0006000000016ccf-222.dat upx behavioral1/memory/2252-220-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cd4-230.dat upx behavioral1/memory/2912-238-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016cf0-240.dat upx behavioral1/memory/1828-248-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d01-249.dat upx behavioral1/files/0x0006000000016d11-258.dat upx behavioral1/memory/980-256-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/files/0x0006000000016d24-266.dat upx behavioral1/files/0x0006000000016d36-277.dat upx behavioral1/files/0x0006000000016d41-286.dat upx behavioral1/files/0x0006000000016d4a-293.dat upx behavioral1/memory/2060-279-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2116-308-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2084-328-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2148-335-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2804 wrote to memory of 2940 2804 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2940 2804 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2940 2804 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 28 PID 2804 wrote to memory of 2940 2804 f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe 28 PID 2940 wrote to memory of 2684 2940 bxfjbbv.exe 29 PID 2940 wrote to memory of 2684 2940 bxfjbbv.exe 29 PID 2940 wrote to memory of 2684 2940 bxfjbbv.exe 29 PID 2940 wrote to memory of 2684 2940 bxfjbbv.exe 29 PID 2684 wrote to memory of 2424 2684 rnxxr.exe 30 PID 2684 wrote to memory of 2424 2684 rnxxr.exe 30 PID 2684 wrote to memory of 2424 2684 rnxxr.exe 30 PID 2684 wrote to memory of 2424 2684 rnxxr.exe 30 PID 2424 wrote to memory of 3064 2424 xrrvr.exe 31 PID 2424 wrote to memory of 3064 2424 xrrvr.exe 31 PID 2424 wrote to memory of 3064 2424 xrrvr.exe 31 PID 2424 wrote to memory of 3064 2424 xrrvr.exe 31 PID 3064 wrote to memory of 2700 3064 thlxhft.exe 32 PID 3064 wrote to memory of 2700 3064 thlxhft.exe 32 PID 3064 wrote to memory of 2700 3064 thlxhft.exe 32 PID 3064 wrote to memory of 2700 3064 thlxhft.exe 32 PID 2700 wrote to memory of 2464 2700 lvbbv.exe 33 PID 2700 wrote to memory of 2464 2700 lvbbv.exe 33 PID 2700 wrote to memory of 2464 2700 lvbbv.exe 33 PID 2700 wrote to memory of 2464 2700 lvbbv.exe 33 PID 2464 wrote to memory of 2444 2464 pttnrn.exe 34 PID 2464 wrote to memory of 2444 2464 pttnrn.exe 34 PID 2464 wrote to memory of 2444 2464 pttnrn.exe 34 PID 2464 wrote to memory of 2444 2464 pttnrn.exe 34 PID 2444 wrote to memory of 2376 2444 jxjhlp.exe 35 PID 2444 wrote to memory of 2376 2444 jxjhlp.exe 35 PID 2444 wrote to memory of 2376 2444 jxjhlp.exe 35 PID 2444 wrote to memory of 2376 2444 jxjhlp.exe 35 PID 2376 wrote to memory of 2856 2376 lvhbd.exe 36 PID 2376 wrote to memory of 2856 2376 lvhbd.exe 36 PID 2376 wrote to memory of 2856 2376 lvhbd.exe 36 PID 2376 wrote to memory of 2856 2376 lvhbd.exe 36 PID 2856 wrote to memory of 680 2856 blhbbbr.exe 37 PID 2856 wrote to memory of 680 2856 blhbbbr.exe 37 PID 2856 wrote to memory of 680 2856 blhbbbr.exe 37 PID 2856 wrote to memory of 680 2856 blhbbbr.exe 37 PID 680 wrote to memory of 576 680 jxjjr.exe 38 PID 680 wrote to memory of 576 680 jxjjr.exe 38 PID 680 wrote to memory of 576 680 jxjjr.exe 38 PID 680 wrote to memory of 576 680 jxjjr.exe 38 PID 576 wrote to memory of 1192 576 hblphjx.exe 39 PID 576 wrote to memory of 1192 576 hblphjx.exe 39 PID 576 wrote to memory of 1192 576 hblphjx.exe 39 PID 576 wrote to memory of 1192 576 hblphjx.exe 39 PID 1192 wrote to memory of 1840 1192 vbpvv.exe 40 PID 1192 wrote to memory of 1840 1192 vbpvv.exe 40 PID 1192 wrote to memory of 1840 1192 vbpvv.exe 40 PID 1192 wrote to memory of 1840 1192 vbpvv.exe 40 PID 1840 wrote to memory of 624 1840 vtjlvlh.exe 41 PID 1840 wrote to memory of 624 1840 vtjlvlh.exe 41 PID 1840 wrote to memory of 624 1840 vtjlvlh.exe 41 PID 1840 wrote to memory of 624 1840 vtjlvlh.exe 41 PID 624 wrote to memory of 2176 624 prjvr.exe 42 PID 624 wrote to memory of 2176 624 prjvr.exe 42 PID 624 wrote to memory of 2176 624 prjvr.exe 42 PID 624 wrote to memory of 2176 624 prjvr.exe 42 PID 2176 wrote to memory of 2008 2176 dxjlld.exe 43 PID 2176 wrote to memory of 2008 2176 dxjlld.exe 43 PID 2176 wrote to memory of 2008 2176 dxjlld.exe 43 PID 2176 wrote to memory of 2008 2176 dxjlld.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f4d04404ded651cda9dcc5ba42a1d150_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bxfjbbv.exec:\bxfjbbv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\rnxxr.exec:\rnxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xrrvr.exec:\xrrvr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\thlxhft.exec:\thlxhft.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lvbbv.exec:\lvbbv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pttnrn.exec:\pttnrn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\jxjhlp.exec:\jxjhlp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lvhbd.exec:\lvhbd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\blhbbbr.exec:\blhbbbr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jxjjr.exec:\jxjjr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\hblphjx.exec:\hblphjx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\vbpvv.exec:\vbpvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\vtjlvlh.exec:\vtjlvlh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\prjvr.exec:\prjvr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\dxjlld.exec:\dxjlld.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\ptjvhh.exec:\ptjvhh.exe17⤵
- Executes dropped EXE
PID:2008 -
\??\c:\htljvnn.exec:\htljvnn.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rjbvnbf.exec:\rjbvnbf.exe19⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lldrbf.exec:\lldrbf.exe20⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vfrblb.exec:\vfrblb.exe21⤵
- Executes dropped EXE
PID:800 -
\??\c:\pfjnt.exec:\pfjnt.exe22⤵
- Executes dropped EXE
PID:768 -
\??\c:\xhfhd.exec:\xhfhd.exe23⤵
- Executes dropped EXE
PID:3012 -
\??\c:\flxppj.exec:\flxppj.exe24⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hfrjb.exec:\hfrjb.exe25⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vxdtrj.exec:\vxdtrj.exe26⤵
- Executes dropped EXE
PID:2912 -
\??\c:\pprfrfx.exec:\pprfrfx.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xpljb.exec:\xpljb.exe28⤵
- Executes dropped EXE
PID:980 -
\??\c:\nnnlp.exec:\nnnlp.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\btfhhbp.exec:\btfhhbp.exe30⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tttxp.exec:\tttxp.exe31⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hnhjlbd.exec:\hnhjlbd.exe32⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tprthpt.exec:\tprthpt.exe33⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tlhtvvh.exec:\tlhtvvh.exe34⤵
- Executes dropped EXE
PID:2116 -
\??\c:\njrvbbv.exec:\njrvbbv.exe35⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jvvlptp.exec:\jvvlptp.exe36⤵
- Executes dropped EXE
PID:2092 -
\??\c:\nlxlp.exec:\nlxlp.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\frrvttn.exec:\frrvttn.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vvdllj.exec:\vvdllj.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hhbbvnb.exec:\hhbbvnb.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xdjbr.exec:\xdjbr.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\nrnflbd.exec:\nrnflbd.exe42⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lpjtx.exec:\lpjtx.exe43⤵
- Executes dropped EXE
PID:2456 -
\??\c:\pxnpv.exec:\pxnpv.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vbdrx.exec:\vbdrx.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\phdfpft.exec:\phdfpft.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vtntbt.exec:\vtntbt.exe47⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nxvrr.exec:\nxvrr.exe48⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hbnjvr.exec:\hbnjvr.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fbfnp.exec:\fbfnp.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nrdndh.exec:\nrdndh.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frjjjr.exec:\frjjjr.exe52⤵
- Executes dropped EXE
PID:1320 -
\??\c:\thxndjv.exec:\thxndjv.exe53⤵
- Executes dropped EXE
PID:904 -
\??\c:\bvljvx.exec:\bvljvx.exe54⤵
- Executes dropped EXE
PID:572 -
\??\c:\nvrxjd.exec:\nvrxjd.exe55⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lvvphv.exec:\lvvphv.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vrxjv.exec:\vrxjv.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\xfxrvh.exec:\xfxrvh.exe58⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ftrbjbv.exec:\ftrbjbv.exe59⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pppbpf.exec:\pppbpf.exe60⤵
- Executes dropped EXE
PID:1928 -
\??\c:\lptrnlv.exec:\lptrnlv.exe61⤵
- Executes dropped EXE
PID:764 -
\??\c:\pbhlv.exec:\pbhlv.exe62⤵
- Executes dropped EXE
PID:2432 -
\??\c:\bldxb.exec:\bldxb.exe63⤵
- Executes dropped EXE
PID:800 -
\??\c:\hvvfnfh.exec:\hvvfnfh.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lvrpdrx.exec:\lvrpdrx.exe65⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rtrff.exec:\rtrff.exe66⤵PID:2788
-
\??\c:\nnnnh.exec:\nnnnh.exe67⤵PID:2120
-
\??\c:\pvdfdt.exec:\pvdfdt.exe68⤵PID:632
-
\??\c:\vbdfnr.exec:\vbdfnr.exe69⤵PID:1292
-
\??\c:\nvpjp.exec:\nvpjp.exe70⤵PID:1844
-
\??\c:\jlvtxtl.exec:\jlvtxtl.exe71⤵PID:1512
-
\??\c:\hbxvv.exec:\hbxvv.exe72⤵PID:1988
-
\??\c:\fjrnj.exec:\fjrnj.exe73⤵PID:980
-
\??\c:\tpjxv.exec:\tpjxv.exe74⤵PID:328
-
\??\c:\thntvxx.exec:\thntvxx.exe75⤵PID:840
-
\??\c:\ffvvht.exec:\ffvvht.exe76⤵PID:1676
-
\??\c:\vrtfrfh.exec:\vrtfrfh.exe77⤵PID:1752
-
\??\c:\hppvbxl.exec:\hppvbxl.exe78⤵PID:2072
-
\??\c:\hdxtnh.exec:\hdxtnh.exe79⤵PID:2212
-
\??\c:\fjtplh.exec:\fjtplh.exe80⤵PID:1536
-
\??\c:\lbhvxtd.exec:\lbhvxtd.exe81⤵PID:2892
-
\??\c:\tfprvpb.exec:\tfprvpb.exe82⤵PID:2820
-
\??\c:\hxjll.exec:\hxjll.exe83⤵PID:2220
-
\??\c:\vpjrlnf.exec:\vpjrlnf.exe84⤵PID:1612
-
\??\c:\rvnfnj.exec:\rvnfnj.exe85⤵PID:2148
-
\??\c:\rbfttxj.exec:\rbfttxj.exe86⤵PID:2076
-
\??\c:\fjvlxf.exec:\fjvlxf.exe87⤵PID:3056
-
\??\c:\xnbnrnb.exec:\xnbnrnb.exe88⤵PID:2476
-
\??\c:\pvfvrpl.exec:\pvfvrpl.exe89⤵PID:2868
-
\??\c:\fnpjvrx.exec:\fnpjvrx.exe90⤵PID:2528
-
\??\c:\bnljthd.exec:\bnljthd.exe91⤵PID:2368
-
\??\c:\hprlnlr.exec:\hprlnlr.exe92⤵PID:2492
-
\??\c:\lhtnb.exec:\lhtnb.exe93⤵PID:2744
-
\??\c:\pjntxb.exec:\pjntxb.exe94⤵PID:2392
-
\??\c:\bvljxld.exec:\bvljxld.exe95⤵PID:2764
-
\??\c:\tvnfhb.exec:\tvnfhb.exe96⤵PID:2784
-
\??\c:\rnjrrr.exec:\rnjrrr.exe97⤵PID:2188
-
\??\c:\nfhffvj.exec:\nfhffvj.exe98⤵PID:760
-
\??\c:\fxrxjp.exec:\fxrxjp.exe99⤵PID:1052
-
\??\c:\xhdtt.exec:\xhdtt.exe100⤵PID:964
-
\??\c:\ftvbplr.exec:\ftvbplr.exe101⤵PID:1488
-
\??\c:\nltrpn.exec:\nltrpn.exe102⤵PID:2172
-
\??\c:\jdlptpp.exec:\jdlptpp.exe103⤵PID:1932
-
\??\c:\rvfbn.exec:\rvfbn.exe104⤵PID:1936
-
\??\c:\fflnnxp.exec:\fflnnxp.exe105⤵PID:2176
-
\??\c:\pjhrtn.exec:\pjhrtn.exe106⤵PID:1632
-
\??\c:\vrvfxdp.exec:\vrvfxdp.exe107⤵PID:1656
-
\??\c:\rnpbhhj.exec:\rnpbhhj.exe108⤵PID:2140
-
\??\c:\lxjdfj.exec:\lxjdfj.exe109⤵PID:1112
-
\??\c:\pvrjp.exec:\pvrjp.exe110⤵PID:1688
-
\??\c:\tljltdh.exec:\tljltdh.exe111⤵PID:2320
-
\??\c:\fhdxnf.exec:\fhdxnf.exe112⤵PID:800
-
\??\c:\lpxbrj.exec:\lpxbrj.exe113⤵PID:2712
-
\??\c:\dbdpbpt.exec:\dbdpbpt.exe114⤵PID:3012
-
\??\c:\pbrdrx.exec:\pbrdrx.exe115⤵PID:2244
-
\??\c:\ldthp.exec:\ldthp.exe116⤵PID:2120
-
\??\c:\rfntjt.exec:\rfntjt.exe117⤵PID:2848
-
\??\c:\bpjflxt.exec:\bpjflxt.exe118⤵PID:1292
-
\??\c:\bfxbb.exec:\bfxbb.exe119⤵PID:1844
-
\??\c:\rnprtrt.exec:\rnprtrt.exe120⤵PID:720
-
\??\c:\hbfvfjt.exec:\hbfvfjt.exe121⤵PID:1988
-
\??\c:\fpvpfv.exec:\fpvpfv.exe122⤵PID:368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-