Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 02:51
Behavioral task
behavioral1
Sample
d55270cafea1ea02b34e18f382a5c240_NEIKI.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target d55270cafea1ea02b34e18f382a5c240_NEIKI.exe
- Size 452KB
- Sample240509-db9cjshc95
- SHA256 7b2593b932c6984d56dcde774eace65b65ca8ca37dae91355629c17ee04d1a3c
- MD5 d55270cafea1ea02b34e18f382a5c240
- SHA1 f2d71c609d8822af604e708e40a365cc699f4018
- SHA512 51823c9315cf28251733cfbd3fbf61a5f56b06eb8cb875407adbd42ba1ed948451fdeaecd5d1ee75faf395d0a30eff93f43d18b999d887474bf78262a9b1c306
- SSDEEP 12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzploW:rd0gFp3lz1/uzploW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3428-7-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4588-5-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/452-17-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4792-23-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3220-26-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1948-34-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1552-48-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2980-58-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1612-64-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3216-71-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4260-77-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3828-84-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4592-90-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/464-103-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1664-114-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2868-122-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1176-127-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1420-146-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4868-153-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4016-161-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1688-170-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1608-184-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4588-197-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4068-201-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/452-205-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/452-209-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3860-213-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/424-220-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3236-224-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3612-237-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3328-238-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4228-245-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2976-252-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2440-257-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1832-274-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3660-281-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2288-298-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1856-303-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4156-336-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/220-361-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2316-377-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3192-399-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2440-403-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3116-410-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/884-435-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4828-439-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3928-443-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3848-447-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1704-477-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2348-463-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4960-489-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3428-348-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1584-502-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3432-518-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3112-553-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/464-560-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3424-612-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2240-616-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1172-625-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1076-631-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2884-636-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4712-727-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2576-731-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2576-735-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0006000000023298-3.dat family_berbew behavioral2/memory/3428-7-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4588-5-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0009000000023400-10.dat family_berbew behavioral2/files/0x0007000000023419-13.dat family_berbew behavioral2/memory/452-17-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341a-21.dat family_berbew behavioral2/memory/4792-23-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3220-26-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341b-30.dat family_berbew behavioral2/memory/1948-34-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341c-35.dat family_berbew behavioral2/files/0x000700000002341d-39.dat family_berbew behavioral2/files/0x000700000002341e-44.dat family_berbew behavioral2/memory/1552-48-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341f-50.dat family_berbew behavioral2/files/0x0007000000023420-56.dat family_berbew behavioral2/memory/2980-58-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/1612-59-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023421-65.dat family_berbew behavioral2/memory/1612-64-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023422-68.dat family_berbew behavioral2/memory/3216-71-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4260-70-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023423-74.dat family_berbew behavioral2/memory/4260-77-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023424-80.dat family_berbew behavioral2/memory/3828-84-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023425-86.dat family_berbew behavioral2/files/0x0007000000023426-94.dat family_berbew behavioral2/memory/4592-90-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000900000002340c-97.dat family_berbew behavioral2/files/0x0007000000023427-104.dat family_berbew behavioral2/memory/464-103-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023429-107.dat family_berbew behavioral2/files/0x000700000002342a-112.dat family_berbew behavioral2/files/0x000700000002342b-119.dat family_berbew behavioral2/memory/1664-114-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2868-122-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/1176-127-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002342c-125.dat family_berbew behavioral2/files/0x000700000002342d-132.dat family_berbew behavioral2/files/0x000700000002342e-136.dat family_berbew behavioral2/files/0x000700000002342f-140.dat family_berbew behavioral2/files/0x0007000000023430-148.dat family_berbew behavioral2/memory/1420-146-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023431-151.dat family_berbew behavioral2/memory/4868-153-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023432-158.dat family_berbew behavioral2/memory/4016-161-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023433-165.dat family_berbew behavioral2/files/0x0007000000023434-168.dat family_berbew behavioral2/memory/1688-170-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023435-175.dat family_berbew behavioral2/files/0x0007000000023436-180.dat family_berbew behavioral2/memory/1608-184-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4588-197-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4068-201-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/452-205-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/452-209-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3860-213-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/424-220-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3236-224-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 3428 tnnhbt.exe 452 jpvdj.exe 4792 5tnntt.exe 3220 5rxlfff.exe 1948 nhhnnt.exe 4344 xrxlxrl.exe 4940 nnhhbt.exe 1552 bnnttb.exe 2980 pdpjd.exe 1612 7fxlflf.exe 3216 pddvp.exe 4260 lffrrlf.exe 3784 hnnhbb.exe 3828 9fxrfxr.exe 4592 hhbntn.exe 2220 dddvv.exe 464 3tntht.exe 1588 xfffrff.exe 1664 jvvdp.exe 2152 xflrllf.exe 2868 nbtnhh.exe 1176 hnhbbb.exe 4440 lxrrlxr.exe 2424 bnttnb.exe 1420 lfxrlfx.exe 4868 tnbhhb.exe 1088 xxxffrx.exe 4016 7nbtnh.exe 3624 dpdpj.exe 1688 fffxrlf.exe 4156 9vjpp.exe 1608 xllxrlf.exe 1328 tntnhb.exe 3500 thhbnn.exe 4472 dpjpd.exe 4376 rlxrffx.exe 4588 7nhtbh.exe 4068 tbthbt.exe 452 dppjv.exe 1172 lllxlfr.exe 3860 3htnbb.exe 424 vjpjd.exe 3236 5rllxfr.exe 3056 tbbnhb.exe 3592 1hbthb.exe 4660 ppjdj.exe 3612 rxxrfxr.exe 3328 hhnhbn.exe 4228 1nhbnh.exe 5056 jvvjd.exe 2976 fxrlxrf.exe 2440 ffrxlfx.exe 4148 5ppjj.exe 3908 flrlxxr.exe 4532 rxrfrrf.exe 4964 thhbtt.exe 1832 nnnbtn.exe 1876 9ppjj.exe 3660 xrrfrrf.exe 4900 xlxlfrl.exe 2504 nbnhbt.exe 4580 jjdpj.exe 2868 pvpjv.exe 1176 rflxlfl.exe -
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/3428-7-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4588-5-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0009000000023400-10.dat upx behavioral2/files/0x0007000000023419-13.dat upx behavioral2/memory/452-17-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341a-21.dat upx behavioral2/memory/4792-23-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3220-26-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341b-30.dat upx behavioral2/memory/1948-34-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341c-35.dat upx behavioral2/files/0x000700000002341d-39.dat upx behavioral2/files/0x000700000002341e-44.dat upx behavioral2/memory/1552-48-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341f-50.dat upx behavioral2/files/0x0007000000023420-56.dat upx behavioral2/memory/2980-58-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1612-59-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023421-65.dat upx behavioral2/memory/1612-64-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023422-68.dat upx behavioral2/memory/3216-71-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4260-70-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023423-74.dat upx behavioral2/memory/4260-77-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023424-80.dat upx behavioral2/memory/3828-84-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023425-86.dat upx behavioral2/files/0x0007000000023426-94.dat upx behavioral2/memory/4592-90-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000900000002340c-97.dat upx behavioral2/files/0x0007000000023427-104.dat upx behavioral2/memory/464-103-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023429-107.dat upx behavioral2/files/0x000700000002342a-112.dat upx behavioral2/files/0x000700000002342b-119.dat upx behavioral2/memory/1664-114-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2868-122-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/1176-127-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002342c-125.dat upx behavioral2/files/0x000700000002342d-132.dat upx behavioral2/files/0x000700000002342e-136.dat upx behavioral2/files/0x000700000002342f-140.dat upx behavioral2/files/0x0007000000023430-148.dat upx behavioral2/memory/1420-146-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023431-151.dat upx behavioral2/memory/4868-153-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023432-158.dat upx behavioral2/memory/4016-161-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023433-165.dat upx behavioral2/files/0x0007000000023434-168.dat upx behavioral2/memory/1688-170-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023435-175.dat upx behavioral2/files/0x0007000000023436-180.dat upx behavioral2/memory/1608-184-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4588-197-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4068-201-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/452-205-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/452-209-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3860-213-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/424-220-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3236-224-0x0000000000400000-0x0000000000438000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 3428 4588 d55270cafea1ea02b34e18f382a5c240_NEIKI.exe 82 PID 4588 wrote to memory of 3428 4588 d55270cafea1ea02b34e18f382a5c240_NEIKI.exe 82 PID 4588 wrote to memory of 3428 4588 d55270cafea1ea02b34e18f382a5c240_NEIKI.exe 82 PID 3428 wrote to memory of 452 3428 tnnhbt.exe 83 PID 3428 wrote to memory of 452 3428 tnnhbt.exe 83 PID 3428 wrote to memory of 452 3428 tnnhbt.exe 83 PID 452 wrote to memory of 4792 452 jpvdj.exe 84 PID 452 wrote to memory of 4792 452 jpvdj.exe 84 PID 452 wrote to memory of 4792 452 jpvdj.exe 84 PID 4792 wrote to memory of 3220 4792 5tnntt.exe 85 PID 4792 wrote to memory of 3220 4792 5tnntt.exe 85 PID 4792 wrote to memory of 3220 4792 5tnntt.exe 85 PID 3220 wrote to memory of 1948 3220 5rxlfff.exe 86 PID 3220 wrote to memory of 1948 3220 5rxlfff.exe 86 PID 3220 wrote to memory of 1948 3220 5rxlfff.exe 86 PID 1948 wrote to memory of 4344 1948 nhhnnt.exe 87 PID 1948 wrote to memory of 4344 1948 nhhnnt.exe 87 PID 1948 wrote to memory of 4344 1948 nhhnnt.exe 87 PID 4344 wrote to memory of 4940 4344 xrxlxrl.exe 88 PID 4344 wrote to memory of 4940 4344 xrxlxrl.exe 88 PID 4344 wrote to memory of 4940 4344 xrxlxrl.exe 88 PID 4940 wrote to memory of 1552 4940 nnhhbt.exe 90 PID 4940 wrote to memory of 1552 4940 nnhhbt.exe 90 PID 4940 wrote to memory of 1552 4940 nnhhbt.exe 90 PID 1552 wrote to memory of 2980 1552 bnnttb.exe 91 PID 1552 wrote to memory of 2980 1552 bnnttb.exe 91 PID 1552 wrote to memory of 2980 1552 bnnttb.exe 91 PID 2980 wrote to memory of 1612 2980 pdpjd.exe 92 PID 2980 wrote to memory of 1612 2980 pdpjd.exe 92 PID 2980 wrote to memory of 1612 2980 pdpjd.exe 92 PID 1612 wrote to memory of 3216 1612 7fxlflf.exe 94 PID 1612 wrote to memory of 3216 1612 7fxlflf.exe 94 PID 1612 wrote to memory of 3216 1612 7fxlflf.exe 94 PID 3216 wrote to memory of 4260 3216 pddvp.exe 95 PID 3216 wrote to memory of 4260 3216 pddvp.exe 95 PID 3216 wrote to memory of 4260 3216 pddvp.exe 95 PID 4260 wrote to memory of 3784 4260 lffrrlf.exe 96 PID 4260 wrote to memory of 3784 4260 lffrrlf.exe 96 PID 4260 wrote to memory of 3784 4260 lffrrlf.exe 96 PID 3784 wrote to memory of 3828 3784 hnnhbb.exe 97 PID 3784 wrote to memory of 3828 3784 hnnhbb.exe 97 PID 3784 wrote to memory of 3828 3784 hnnhbb.exe 97 PID 3828 wrote to memory of 4592 3828 9fxrfxr.exe 98 PID 3828 wrote to memory of 4592 3828 9fxrfxr.exe 98 PID 3828 wrote to memory of 4592 3828 9fxrfxr.exe 98 PID 4592 wrote to memory of 2220 4592 hhbntn.exe 100 PID 4592 wrote to memory of 2220 4592 hhbntn.exe 100 PID 4592 wrote to memory of 2220 4592 hhbntn.exe 100 PID 2220 wrote to memory of 464 2220 dddvv.exe 101 PID 2220 wrote to memory of 464 2220 dddvv.exe 101 PID 2220 wrote to memory of 464 2220 dddvv.exe 101 PID 464 wrote to memory of 1588 464 3tntht.exe 102 PID 464 wrote to memory of 1588 464 3tntht.exe 102 PID 464 wrote to memory of 1588 464 3tntht.exe 102 PID 1588 wrote to memory of 1664 1588 xfffrff.exe 103 PID 1588 wrote to memory of 1664 1588 xfffrff.exe 103 PID 1588 wrote to memory of 1664 1588 xfffrff.exe 103 PID 1664 wrote to memory of 2152 1664 jvvdp.exe 104 PID 1664 wrote to memory of 2152 1664 jvvdp.exe 104 PID 1664 wrote to memory of 2152 1664 jvvdp.exe 104 PID 2152 wrote to memory of 2868 2152 xflrllf.exe 105 PID 2152 wrote to memory of 2868 2152 xflrllf.exe 105 PID 2152 wrote to memory of 2868 2152 xflrllf.exe 105 PID 2868 wrote to memory of 1176 2868 nbtnhh.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d55270cafea1ea02b34e18f382a5c240_NEIKI.exe"C:\Users\Admin\AppData\Local\Temp\d55270cafea1ea02b34e18f382a5c240_NEIKI.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\tnnhbt.exec:\tnnhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\jpvdj.exec:\jpvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\5tnntt.exec:\5tnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\5rxlfff.exec:\5rxlfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nhhnnt.exec:\nhhnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xrxlxrl.exec:\xrxlxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\nnhhbt.exec:\nnhhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\bnnttb.exec:\bnnttb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pdpjd.exec:\pdpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7fxlflf.exec:\7fxlflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pddvp.exec:\pddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\lffrrlf.exec:\lffrrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\hnnhbb.exec:\hnnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\9fxrfxr.exec:\9fxrfxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\hhbntn.exec:\hhbntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\dddvv.exec:\dddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\3tntht.exec:\3tntht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\xfffrff.exec:\xfffrff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\jvvdp.exec:\jvvdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\xflrllf.exec:\xflrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\nbtnhh.exec:\nbtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\hnhbbb.exec:\hnhbbb.exe23⤵
- Executes dropped EXE
PID:1176 -
\??\c:\lxrrlxr.exec:\lxrrlxr.exe24⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bnttnb.exec:\bnttnb.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe26⤵
- Executes dropped EXE
PID:1420 -
\??\c:\tnbhhb.exec:\tnbhhb.exe27⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xxxffrx.exec:\xxxffrx.exe28⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7nbtnh.exec:\7nbtnh.exe29⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dpdpj.exec:\dpdpj.exe30⤵
- Executes dropped EXE
PID:3624 -
\??\c:\fffxrlf.exec:\fffxrlf.exe31⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9vjpp.exec:\9vjpp.exe32⤵
- Executes dropped EXE
PID:4156 -
\??\c:\xllxrlf.exec:\xllxrlf.exe33⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tntnhb.exec:\tntnhb.exe34⤵
- Executes dropped EXE
PID:1328 -
\??\c:\thhbnn.exec:\thhbnn.exe35⤵
- Executes dropped EXE
PID:3500 -
\??\c:\dpjpd.exec:\dpjpd.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\rlxrffx.exec:\rlxrffx.exe37⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7nhtbh.exec:\7nhtbh.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\tbthbt.exec:\tbthbt.exe39⤵
- Executes dropped EXE
PID:4068 -
\??\c:\dppjv.exec:\dppjv.exe40⤵
- Executes dropped EXE
PID:452 -
\??\c:\lllxlfr.exec:\lllxlfr.exe41⤵
- Executes dropped EXE
PID:1172 -
\??\c:\3htnbb.exec:\3htnbb.exe42⤵
- Executes dropped EXE
PID:3860 -
\??\c:\vjpjd.exec:\vjpjd.exe43⤵
- Executes dropped EXE
PID:424 -
\??\c:\5rllxfr.exec:\5rllxfr.exe44⤵
- Executes dropped EXE
PID:3236 -
\??\c:\tbbnhb.exec:\tbbnhb.exe45⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1hbthb.exec:\1hbthb.exe46⤵
- Executes dropped EXE
PID:3592 -
\??\c:\ppjdj.exec:\ppjdj.exe47⤵
- Executes dropped EXE
PID:4660 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe48⤵
- Executes dropped EXE
PID:3612 -
\??\c:\hhnhbn.exec:\hhnhbn.exe49⤵
- Executes dropped EXE
PID:3328 -
\??\c:\1nhbnh.exec:\1nhbnh.exe50⤵
- Executes dropped EXE
PID:4228 -
\??\c:\jvvjd.exec:\jvvjd.exe51⤵
- Executes dropped EXE
PID:5056 -
\??\c:\fxrlxrf.exec:\fxrlxrf.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ffrxlfx.exec:\ffrxlfx.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\5ppjj.exec:\5ppjj.exe54⤵
- Executes dropped EXE
PID:4148 -
\??\c:\flrlxxr.exec:\flrlxxr.exe55⤵
- Executes dropped EXE
PID:3908 -
\??\c:\rxrfrrf.exec:\rxrfrrf.exe56⤵
- Executes dropped EXE
PID:4532 -
\??\c:\thhbtt.exec:\thhbtt.exe57⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nnnbtn.exec:\nnnbtn.exe58⤵
- Executes dropped EXE
PID:1832 -
\??\c:\9ppjj.exec:\9ppjj.exe59⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xrrfrrf.exec:\xrrfrrf.exe60⤵
- Executes dropped EXE
PID:3660 -
\??\c:\xlxlfrl.exec:\xlxlfrl.exe61⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nbnhbt.exec:\nbnhbt.exe62⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjdpj.exec:\jjdpj.exe63⤵
- Executes dropped EXE
PID:4580 -
\??\c:\pvpjv.exec:\pvpjv.exe64⤵
- Executes dropped EXE
PID:2868 -
\??\c:\rflxlfl.exec:\rflxlfl.exe65⤵
- Executes dropped EXE
PID:1176 -
\??\c:\thhthb.exec:\thhthb.exe66⤵PID:2288
-
\??\c:\thhthb.exec:\thhthb.exe67⤵PID:1856
-
\??\c:\pjvpd.exec:\pjvpd.exe68⤵PID:3304
-
\??\c:\3xlxlfx.exec:\3xlxlfx.exe69⤵PID:4252
-
\??\c:\1xxlxrf.exec:\1xxlxrf.exe70⤵PID:4132
-
\??\c:\5tnhtt.exec:\5tnhtt.exe71⤵PID:4868
-
\??\c:\vpdpp.exec:\vpdpp.exe72⤵PID:116
-
\??\c:\lfrflff.exec:\lfrflff.exe73⤵PID:1972
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe74⤵PID:3476
-
\??\c:\5bbthh.exec:\5bbthh.exe75⤵PID:2744
-
\??\c:\5ddpj.exec:\5ddpj.exe76⤵PID:2212
-
\??\c:\lxxrfrf.exec:\lxxrfrf.exe77⤵PID:2696
-
\??\c:\lxxlxfr.exec:\lxxlxfr.exe78⤵PID:4156
-
\??\c:\1bbttn.exec:\1bbttn.exe79⤵PID:1608
-
\??\c:\bhhthh.exec:\bhhthh.exe80⤵PID:2240
-
\??\c:\vjvpd.exec:\vjvpd.exe81⤵PID:3500
-
\??\c:\fffrlfx.exec:\fffrlfx.exe82⤵PID:3428
-
\??\c:\lrxlxlx.exec:\lrxlxlx.exe83⤵PID:4348
-
\??\c:\1bnhtn.exec:\1bnhtn.exe84⤵PID:2884
-
\??\c:\pvvjv.exec:\pvvjv.exe85⤵PID:3340
-
\??\c:\jvdpp.exec:\jvdpp.exe86⤵PID:220
-
\??\c:\ffllxxr.exec:\ffllxxr.exe87⤵PID:1132
-
\??\c:\flxrlff.exec:\flxrlff.exe88⤵PID:3684
-
\??\c:\thhthb.exec:\thhthb.exe89⤵PID:3184
-
\??\c:\btnbbt.exec:\btnbbt.exe90⤵PID:2316
-
\??\c:\9jdvj.exec:\9jdvj.exe91⤵PID:3344
-
\??\c:\3dvdj.exec:\3dvdj.exe92⤵PID:1464
-
\??\c:\5xrlxrf.exec:\5xrlxrf.exe93⤵PID:1996
-
\??\c:\nttnhh.exec:\nttnhh.exe94⤵PID:2392
-
\??\c:\btnhnn.exec:\btnhnn.exe95⤵PID:3080
-
\??\c:\vvdvj.exec:\vvdvj.exe96⤵PID:4220
-
\??\c:\lfxrrxr.exec:\lfxrrxr.exe97⤵PID:4260
-
\??\c:\rlflrfl.exec:\rlflrfl.exe98⤵PID:3192
-
\??\c:\bhbbnn.exec:\bhbbnn.exe99⤵PID:2440
-
\??\c:\bthbtn.exec:\bthbtn.exe100⤵PID:3116
-
\??\c:\dvpjj.exec:\dvpjj.exe101⤵PID:2188
-
\??\c:\7vpjv.exec:\7vpjv.exe102⤵PID:4480
-
\??\c:\lfffrxr.exec:\lfffrxr.exe103⤵PID:4964
-
\??\c:\hnhbnn.exec:\hnhbnn.exe104⤵PID:1832
-
\??\c:\ttnbnh.exec:\ttnbnh.exe105⤵PID:2428
-
\??\c:\vddpp.exec:\vddpp.exe106⤵PID:5072
-
\??\c:\frrlfxr.exec:\frrlfxr.exe107⤵PID:884
-
\??\c:\fflxlfr.exec:\fflxlfr.exe108⤵PID:4828
-
\??\c:\nnbnth.exec:\nnbnth.exe109⤵PID:4780
-
\??\c:\bthbtn.exec:\bthbtn.exe110⤵PID:3928
-
\??\c:\vvvpd.exec:\vvvpd.exe111⤵PID:3848
-
\??\c:\xrllffx.exec:\xrllffx.exe112⤵PID:2088
-
\??\c:\fxrlxrf.exec:\fxrlxrf.exe113⤵PID:1856
-
\??\c:\hbbbhh.exec:\hbbbhh.exe114⤵PID:1420
-
\??\c:\vddvp.exec:\vddvp.exe115⤵PID:4248
-
\??\c:\vvdpj.exec:\vvdpj.exe116⤵PID:2348
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe117⤵PID:4844
-
\??\c:\htthbt.exec:\htthbt.exe118⤵PID:3332
-
\??\c:\ntnhbt.exec:\ntnhbt.exe119⤵PID:1704
-
\??\c:\vpvpp.exec:\vpvpp.exe120⤵PID:3424
-
\??\c:\dvdpj.exec:\dvdpj.exe121⤵PID:4736
-
\??\c:\fxrfxfx.exec:\fxrfxfx.exe122⤵PID:3844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-