Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/05/2024, 15:00
Behavioral task
behavioral1
Sample
69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe
- Size 211KB
- Sample240509-sdmc5afg3w
- SHA256 da8e28b57626c2527da39e7a8be27251a7125ebf187c96ad52be6efe0617df18
- MD5 69a3b9a1985d6e2a6a010334415fa1e0
- SHA1 991dc42559906353b764d027ee6616c67db99e63
- SHA512 c1d2243ff02a1cfa46d2a7e02052d675171e2c0e4a0ba966e6e9a7582e6482f3d9fb67e38793213b3e57d3fc0aa9ac60ea4ba9e6b3bc31eb611e95124cdccc7a
- SSDEEP 6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+l5:V4wFHoSBK/ubLcfj
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1048-1-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3632-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3684-11-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-20-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2912-28-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4876-43-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4452-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1668-45-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4320-51-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2684-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4744-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3456-77-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3428-80-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1460-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1688-97-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/548-98-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/944-110-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3860-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2352-124-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/780-126-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5036-137-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4852-144-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1768-154-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1892-165-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3696-186-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4028-191-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1824-204-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/8-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3636-215-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3684-228-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2792-230-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4320-261-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1904-265-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2032-272-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3596-282-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/744-289-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-293-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2592-315-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2824-329-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3288-333-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2944-337-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3852-347-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4592-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4988-371-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3212-379-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2404-385-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3632-401-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1120-423-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3912-430-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4684-438-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4848-460-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3712-468-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2352-473-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4860-486-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3576-528-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3220-570-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3652-586-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4724-593-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1964-616-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1624-656-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4756-666-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3708-706-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1540-924-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2012-1295-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/1048-1-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/memory/3684-5-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0008000000023409-9.dat family_berbew behavioral2/memory/3632-13-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3684-11-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000800000002340c-14.dat family_berbew behavioral2/memory/2488-20-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002340d-22.dat family_berbew behavioral2/memory/2912-24-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002340e-29.dat family_berbew behavioral2/memory/2912-28-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002340f-33.dat family_berbew behavioral2/memory/4876-39-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023410-40.dat family_berbew behavioral2/memory/4876-43-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4452-37-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1668-45-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023411-48.dat family_berbew behavioral2/memory/4320-51-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023412-54.dat family_berbew behavioral2/files/0x0007000000023413-58.dat family_berbew behavioral2/memory/4744-62-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2684-61-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023414-66.dat family_berbew behavioral2/memory/4744-68-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023415-71.dat family_berbew behavioral2/files/0x0007000000023416-76.dat family_berbew behavioral2/memory/3456-77-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3428-80-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023417-83.dat family_berbew behavioral2/files/0x0007000000023418-87.dat family_berbew behavioral2/memory/1460-89-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023419-93.dat family_berbew behavioral2/memory/1688-97-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/548-98-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341d-106.dat family_berbew behavioral2/memory/944-110-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000800000002341a-113.dat family_berbew behavioral2/memory/3860-104-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341c-101.dat family_berbew behavioral2/files/0x000800000002340a-117.dat family_berbew behavioral2/files/0x0004000000022ac4-122.dat family_berbew behavioral2/memory/2352-124-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/780-126-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000800000002341e-129.dat family_berbew behavioral2/files/0x000700000002341f-134.dat family_berbew behavioral2/memory/5036-137-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023420-140.dat family_berbew behavioral2/memory/4852-144-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023421-146.dat family_berbew behavioral2/files/0x0007000000023422-151.dat family_berbew behavioral2/memory/1768-154-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023423-157.dat family_berbew behavioral2/files/0x0007000000023424-164.dat family_berbew behavioral2/memory/1892-165-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023425-168.dat family_berbew behavioral2/files/0x0007000000023426-173.dat family_berbew behavioral2/files/0x0007000000023427-178.dat family_berbew behavioral2/files/0x0007000000023428-184.dat family_berbew behavioral2/memory/3696-186-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4028-191-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1824-204-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/8-207-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 3684 thnhht.exe 3632 pjppp.exe 2488 9nhbbb.exe 2912 vdjdd.exe 4452 hnnhhh.exe 4876 vvjjd.exe 1668 pjvvj.exe 4320 1pvpv.exe 2684 jpvvv.exe 4744 7rrlfff.exe 3512 thhbnh.exe 3456 xffrllx.exe 3428 hbhbhh.exe 1460 vdjvj.exe 1688 lrllxlx.exe 548 3bthtt.exe 3860 7pjvp.exe 944 1rfxllx.exe 1636 xlfrllf.exe 2352 rxfxrfx.exe 780 nnhhhb.exe 5036 ppjpv.exe 4852 rxrrxlx.exe 1164 bththb.exe 4392 tnbnhh.exe 1768 rrxrlxl.exe 1624 3hnhnn.exe 1892 9djdv.exe 4756 rfxlxrl.exe 1828 htbnhb.exe 3696 bhhtnb.exe 1276 dvjvp.exe 4028 xrfrfxr.exe 2220 tbthtb.exe 2176 1ppdd.exe 2288 vpvvp.exe 1824 9lfxlfx.exe 8 5xlxlrf.exe 3636 thhhhh.exe 4508 ppvpd.exe 3084 pdjdp.exe 4888 xrrfrlf.exe 3684 hbbthb.exe 2792 tnhbnn.exe 2312 pjjvj.exe 2300 vvpjd.exe 2668 ddvjv.exe 3220 9bbbtt.exe 636 jpvpp.exe 5016 7vpdv.exe 3040 lffrrlf.exe 1668 rxffflr.exe 4320 bnbnht.exe 1904 vjdvj.exe 2152 frxrlfr.exe 2032 nhbtnh.exe 4180 jvvpv.exe 2780 7vvjv.exe 3596 rllxlfx.exe 2888 nbhbtn.exe 744 3nbnhb.exe 3468 7dvvj.exe 548 dpdvv.exe 532 nhnhbt.exe -
resource yara_rule behavioral2/memory/1048-1-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3684-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000023409-9.dat upx behavioral2/memory/3632-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3684-11-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002340c-14.dat upx behavioral2/memory/2488-20-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340d-22.dat upx behavioral2/memory/2912-24-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340e-29.dat upx behavioral2/memory/2912-28-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002340f-33.dat upx behavioral2/memory/4876-39-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023410-40.dat upx behavioral2/memory/4876-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4452-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1668-45-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023411-48.dat upx behavioral2/memory/4320-51-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023412-54.dat upx behavioral2/files/0x0007000000023413-58.dat upx behavioral2/memory/4744-62-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2684-61-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-66.dat upx behavioral2/memory/4744-68-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023415-71.dat upx behavioral2/files/0x0007000000023416-76.dat upx behavioral2/memory/3456-77-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3428-80-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023417-83.dat upx behavioral2/files/0x0007000000023418-87.dat upx behavioral2/memory/1460-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023419-93.dat upx behavioral2/memory/1688-97-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/548-98-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341d-106.dat upx behavioral2/memory/944-110-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002341a-113.dat upx behavioral2/memory/3860-104-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341c-101.dat upx behavioral2/files/0x000800000002340a-117.dat upx behavioral2/files/0x0004000000022ac4-122.dat upx behavioral2/memory/2352-124-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/780-126-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002341e-129.dat upx behavioral2/files/0x000700000002341f-134.dat upx behavioral2/memory/5036-137-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023420-140.dat upx behavioral2/memory/4852-144-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023421-146.dat upx behavioral2/files/0x0007000000023422-151.dat upx behavioral2/memory/1768-154-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023423-157.dat upx behavioral2/files/0x0007000000023424-164.dat upx behavioral2/memory/1892-165-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023425-168.dat upx behavioral2/files/0x0007000000023426-173.dat upx behavioral2/files/0x0007000000023427-178.dat upx behavioral2/files/0x0007000000023428-184.dat upx behavioral2/memory/3696-186-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4028-191-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1824-204-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/8-207-0x0000000000400000-0x0000000000434000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 3684 1048 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 80 PID 1048 wrote to memory of 3684 1048 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 80 PID 1048 wrote to memory of 3684 1048 69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe 80 PID 3684 wrote to memory of 3632 3684 thnhht.exe 81 PID 3684 wrote to memory of 3632 3684 thnhht.exe 81 PID 3684 wrote to memory of 3632 3684 thnhht.exe 81 PID 3632 wrote to memory of 2488 3632 pjppp.exe 82 PID 3632 wrote to memory of 2488 3632 pjppp.exe 82 PID 3632 wrote to memory of 2488 3632 pjppp.exe 82 PID 2488 wrote to memory of 2912 2488 9nhbbb.exe 83 PID 2488 wrote to memory of 2912 2488 9nhbbb.exe 83 PID 2488 wrote to memory of 2912 2488 9nhbbb.exe 83 PID 2912 wrote to memory of 4452 2912 vdjdd.exe 84 PID 2912 wrote to memory of 4452 2912 vdjdd.exe 84 PID 2912 wrote to memory of 4452 2912 vdjdd.exe 84 PID 4452 wrote to memory of 4876 4452 hnnhhh.exe 86 PID 4452 wrote to memory of 4876 4452 hnnhhh.exe 86 PID 4452 wrote to memory of 4876 4452 hnnhhh.exe 86 PID 4876 wrote to memory of 1668 4876 vvjjd.exe 87 PID 4876 wrote to memory of 1668 4876 vvjjd.exe 87 PID 4876 wrote to memory of 1668 4876 vvjjd.exe 87 PID 1668 wrote to memory of 4320 1668 pjvvj.exe 89 PID 1668 wrote to memory of 4320 1668 pjvvj.exe 89 PID 1668 wrote to memory of 4320 1668 pjvvj.exe 89 PID 4320 wrote to memory of 2684 4320 1pvpv.exe 90 PID 4320 wrote to memory of 2684 4320 1pvpv.exe 90 PID 4320 wrote to memory of 2684 4320 1pvpv.exe 90 PID 2684 wrote to memory of 4744 2684 jpvvv.exe 92 PID 2684 wrote to memory of 4744 2684 jpvvv.exe 92 PID 2684 wrote to memory of 4744 2684 jpvvv.exe 92 PID 4744 wrote to memory of 3512 4744 7rrlfff.exe 93 PID 4744 wrote to memory of 3512 4744 7rrlfff.exe 93 PID 4744 wrote to memory of 3512 4744 7rrlfff.exe 93 PID 3512 wrote to memory of 3456 3512 thhbnh.exe 94 PID 3512 wrote to memory of 3456 3512 thhbnh.exe 94 PID 3512 wrote to memory of 3456 3512 thhbnh.exe 94 PID 3456 wrote to memory of 3428 3456 xffrllx.exe 95 PID 3456 wrote to memory of 3428 3456 xffrllx.exe 95 PID 3456 wrote to memory of 3428 3456 xffrllx.exe 95 PID 3428 wrote to memory of 1460 3428 hbhbhh.exe 96 PID 3428 wrote to memory of 1460 3428 hbhbhh.exe 96 PID 3428 wrote to memory of 1460 3428 hbhbhh.exe 96 PID 1460 wrote to memory of 1688 1460 vdjvj.exe 97 PID 1460 wrote to memory of 1688 1460 vdjvj.exe 97 PID 1460 wrote to memory of 1688 1460 vdjvj.exe 97 PID 1688 wrote to memory of 548 1688 lrllxlx.exe 98 PID 1688 wrote to memory of 548 1688 lrllxlx.exe 98 PID 1688 wrote to memory of 548 1688 lrllxlx.exe 98 PID 548 wrote to memory of 3860 548 3bthtt.exe 99 PID 548 wrote to memory of 3860 548 3bthtt.exe 99 PID 548 wrote to memory of 3860 548 3bthtt.exe 99 PID 3860 wrote to memory of 944 3860 7pjvp.exe 100 PID 3860 wrote to memory of 944 3860 7pjvp.exe 100 PID 3860 wrote to memory of 944 3860 7pjvp.exe 100 PID 944 wrote to memory of 1636 944 1rfxllx.exe 101 PID 944 wrote to memory of 1636 944 1rfxllx.exe 101 PID 944 wrote to memory of 1636 944 1rfxllx.exe 101 PID 1636 wrote to memory of 2352 1636 xlfrllf.exe 102 PID 1636 wrote to memory of 2352 1636 xlfrllf.exe 102 PID 1636 wrote to memory of 2352 1636 xlfrllf.exe 102 PID 2352 wrote to memory of 780 2352 rxfxrfx.exe 103 PID 2352 wrote to memory of 780 2352 rxfxrfx.exe 103 PID 2352 wrote to memory of 780 2352 rxfxrfx.exe 103 PID 780 wrote to memory of 5036 780 nnhhhb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\69a3b9a1985d6e2a6a010334415fa1e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\thnhht.exec:\thnhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\pjppp.exec:\pjppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\9nhbbb.exec:\9nhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vdjdd.exec:\vdjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\hnnhhh.exec:\hnnhhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\vvjjd.exec:\vvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\pjvvj.exec:\pjvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\1pvpv.exec:\1pvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\jpvvv.exec:\jpvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\7rrlfff.exec:\7rrlfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\thhbnh.exec:\thhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\xffrllx.exec:\xffrllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\hbhbhh.exec:\hbhbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\vdjvj.exec:\vdjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\lrllxlx.exec:\lrllxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\3bthtt.exec:\3bthtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\7pjvp.exec:\7pjvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\1rfxllx.exec:\1rfxllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\xlfrllf.exec:\xlfrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\rxfxrfx.exec:\rxfxrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nnhhhb.exec:\nnhhhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\ppjpv.exec:\ppjpv.exe23⤵
- Executes dropped EXE
PID:5036 -
\??\c:\rxrrxlx.exec:\rxrrxlx.exe24⤵
- Executes dropped EXE
PID:4852 -
\??\c:\bththb.exec:\bththb.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\tnbnhh.exec:\tnbnhh.exe26⤵
- Executes dropped EXE
PID:4392 -
\??\c:\rrxrlxl.exec:\rrxrlxl.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3hnhnn.exec:\3hnhnn.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9djdv.exec:\9djdv.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe30⤵
- Executes dropped EXE
PID:4756 -
\??\c:\htbnhb.exec:\htbnhb.exe31⤵
- Executes dropped EXE
PID:1828 -
\??\c:\bhhtnb.exec:\bhhtnb.exe32⤵
- Executes dropped EXE
PID:3696 -
\??\c:\dvjvp.exec:\dvjvp.exe33⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xrfrfxr.exec:\xrfrfxr.exe34⤵
- Executes dropped EXE
PID:4028 -
\??\c:\tbthtb.exec:\tbthtb.exe35⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1ppdd.exec:\1ppdd.exe36⤵
- Executes dropped EXE
PID:2176 -
\??\c:\vpvvp.exec:\vpvvp.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9lfxlfx.exec:\9lfxlfx.exe38⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5xlxlrf.exec:\5xlxlrf.exe39⤵
- Executes dropped EXE
PID:8 -
\??\c:\thhhhh.exec:\thhhhh.exe40⤵
- Executes dropped EXE
PID:3636 -
\??\c:\ppvpd.exec:\ppvpd.exe41⤵
- Executes dropped EXE
PID:4508 -
\??\c:\pdjdp.exec:\pdjdp.exe42⤵
- Executes dropped EXE
PID:3084 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe43⤵
- Executes dropped EXE
PID:4888 -
\??\c:\hbbthb.exec:\hbbthb.exe44⤵
- Executes dropped EXE
PID:3684 -
\??\c:\tnhbnn.exec:\tnhbnn.exe45⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pjjvj.exec:\pjjvj.exe46⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vvpjd.exec:\vvpjd.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\ddvjv.exec:\ddvjv.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\9bbbtt.exec:\9bbbtt.exe49⤵
- Executes dropped EXE
PID:3220 -
\??\c:\jpvpp.exec:\jpvpp.exe50⤵
- Executes dropped EXE
PID:636 -
\??\c:\7vpdv.exec:\7vpdv.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\lffrrlf.exec:\lffrrlf.exe52⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rxffflr.exec:\rxffflr.exe53⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bnbnht.exec:\bnbnht.exe54⤵
- Executes dropped EXE
PID:4320 -
\??\c:\vjdvj.exec:\vjdvj.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\frxrlfr.exec:\frxrlfr.exe56⤵
- Executes dropped EXE
PID:2152 -
\??\c:\nhbtnh.exec:\nhbtnh.exe57⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvvpv.exec:\jvvpv.exe58⤵
- Executes dropped EXE
PID:4180 -
\??\c:\7vvjv.exec:\7vvjv.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rllxlfx.exec:\rllxlfx.exe60⤵
- Executes dropped EXE
PID:3596 -
\??\c:\nbhbtn.exec:\nbhbtn.exe61⤵
- Executes dropped EXE
PID:2888 -
\??\c:\3nbnhb.exec:\3nbnhb.exe62⤵
- Executes dropped EXE
PID:744 -
\??\c:\7dvvj.exec:\7dvvj.exe63⤵
- Executes dropped EXE
PID:3468 -
\??\c:\dpdvv.exec:\dpdvv.exe64⤵
- Executes dropped EXE
PID:548 -
\??\c:\nhnhbt.exec:\nhnhbt.exe65⤵
- Executes dropped EXE
PID:532 -
\??\c:\1vjdp.exec:\1vjdp.exe66⤵PID:3860
-
\??\c:\ddppd.exec:\ddppd.exe67⤵PID:1192
-
\??\c:\1rrlllf.exec:\1rrlllf.exe68⤵PID:4672
-
\??\c:\7nnthh.exec:\7nnthh.exe69⤵PID:4152
-
\??\c:\thbtnh.exec:\thbtnh.exe70⤵PID:2592
-
\??\c:\jvdvd.exec:\jvdvd.exe71⤵PID:780
-
\??\c:\pjvjv.exec:\pjvjv.exe72⤵PID:4952
-
\??\c:\xffxrlf.exec:\xffxrlf.exe73⤵PID:3752
-
\??\c:\httnhn.exec:\httnhn.exe74⤵PID:2824
-
\??\c:\dvvjv.exec:\dvvjv.exe75⤵PID:3288
-
\??\c:\djdpj.exec:\djdpj.exe76⤵PID:2944
-
\??\c:\frfxfxf.exec:\frfxfxf.exe77⤵PID:1700
-
\??\c:\tttnhh.exec:\tttnhh.exe78⤵PID:4128
-
\??\c:\nhhtbh.exec:\nhhtbh.exe79⤵PID:3852
-
\??\c:\9djpj.exec:\9djpj.exe80⤵PID:4200
-
\??\c:\xxxrffx.exec:\xxxrffx.exe81⤵PID:4032
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe82⤵PID:1280
-
\??\c:\9nthtn.exec:\9nthtn.exe83⤵PID:3168
-
\??\c:\thbnbn.exec:\thbnbn.exe84⤵PID:3660
-
\??\c:\vdpjv.exec:\vdpjv.exe85⤵PID:4592
-
\??\c:\vjvpd.exec:\vjvpd.exe86⤵PID:4700
-
\??\c:\9xxrllf.exec:\9xxrllf.exe87⤵PID:4988
-
\??\c:\xffxrrl.exec:\xffxrrl.exe88⤵PID:3144
-
\??\c:\ttnhtn.exec:\ttnhtn.exe89⤵PID:3212
-
\??\c:\hhtnnn.exec:\hhtnnn.exe90⤵PID:2404
-
\??\c:\9ppjd.exec:\9ppjd.exe91⤵PID:4524
-
\??\c:\jvvjv.exec:\jvvjv.exe92⤵PID:3708
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe93⤵PID:4060
-
\??\c:\hthtnh.exec:\hthtnh.exe94⤵PID:4012
-
\??\c:\tbtnhb.exec:\tbtnhb.exe95⤵PID:3632
-
\??\c:\jdvpd.exec:\jdvpd.exe96⤵PID:2436
-
\??\c:\1vvpj.exec:\1vvpj.exe97⤵PID:4576
-
\??\c:\xlxrxrf.exec:\xlxrxrf.exe98⤵PID:820
-
\??\c:\xrrfllx.exec:\xrrfllx.exe99⤵PID:4876
-
\??\c:\hhbthb.exec:\hhbthb.exe100⤵PID:1036
-
\??\c:\nnnhbt.exec:\nnnhbt.exe101⤵PID:4880
-
\??\c:\pjpjv.exec:\pjpjv.exe102⤵PID:1120
-
\??\c:\pvvjd.exec:\pvvjd.exe103⤵PID:2096
-
\??\c:\ffrlxfr.exec:\ffrlxfr.exe104⤵PID:3912
-
\??\c:\rfrlffr.exec:\rfrlffr.exe105⤵PID:3404
-
\??\c:\ntthbt.exec:\ntthbt.exe106⤵PID:4684
-
\??\c:\thhbtt.exec:\thhbtt.exe107⤵PID:4744
-
\??\c:\jddvj.exec:\jddvj.exe108⤵PID:748
-
\??\c:\vpdpd.exec:\vpdpd.exe109⤵PID:2780
-
\??\c:\xffrlfr.exec:\xffrlfr.exe110⤵PID:4100
-
\??\c:\hnthbt.exec:\hnthbt.exe111⤵PID:1560
-
\??\c:\1jvjd.exec:\1jvjd.exe112⤵PID:744
-
\??\c:\dpppd.exec:\dpppd.exe113⤵PID:4848
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe114⤵PID:728
-
\??\c:\1hbnhh.exec:\1hbnhh.exe115⤵PID:3712
-
\??\c:\nbnhhh.exec:\nbnhhh.exe116⤵PID:1636
-
\??\c:\3vvpj.exec:\3vvpj.exe117⤵PID:2352
-
\??\c:\3vddp.exec:\3vddp.exe118⤵PID:5100
-
\??\c:\fxxffxr.exec:\fxxffxr.exe119⤵PID:5036
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe120⤵PID:4860
-
\??\c:\nhtnbn.exec:\nhtnbn.exe121⤵PID:1524
-
\??\c:\nbtnhb.exec:\nbtnhb.exe122⤵PID:1600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-