Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 23:11
Behavioral task
behavioral1
Sample
4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe
- Size 211KB
- Sample240517-26jmdagb68
- SHA256 97fb1a865d9fa4128a29b8127018e94d58e3c562ee6d67758ea247f1e8eb01ec
- MD5 4ee25c03b9245adcae1df6e53c3012d0
- SHA1 d8b7d62afd3cf5b23ae30e88e6625c45bf3ad4b1
- SHA512 0e472857dee473e31078d8652909f89f3816b17ff1e41ab13e71c19ce6d4679e6b8e06e524a1e8307f0add0c00450dbb2b9732d71dc063fb549957afc36fce3c
- SSDEEP 6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+li:V4wFHoSBK/ubLcfU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2336-5-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4848-12-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1428-17-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/224-22-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2496-27-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4508-33-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3832-39-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5056-42-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3392-52-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2424-59-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1304-60-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1304-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5012-68-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2956-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2456-78-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4396-89-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4172-94-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5040-112-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/464-116-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3604-130-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4192-128-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1048-144-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3056-156-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3528-164-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3996-172-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2080-193-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5116-200-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1312-219-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3764-223-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4820-227-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3244-240-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1392-245-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/116-249-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/396-253-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/436-264-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/884-271-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1952-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4008-288-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1476-294-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1728-301-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2160-306-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3376-312-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1616-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2408-354-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2328-366-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/404-370-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2732-380-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2104-387-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3136-388-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/552-396-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4508-408-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3516-412-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1304-429-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1164-435-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4396-445-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-449-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2488-454-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4276-484-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2168-512-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1620-541-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2956-575-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2976-615-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4668-703-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/2336-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0008000000022f51-3.dat family_berbew behavioral2/memory/2336-5-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000900000002340c-9.dat family_berbew behavioral2/memory/4848-12-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023414-13.dat family_berbew behavioral2/memory/1428-17-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/224-22-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023415-20.dat family_berbew behavioral2/memory/2496-27-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023416-26.dat family_berbew behavioral2/files/0x0007000000023417-31.dat family_berbew behavioral2/memory/4508-33-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3832-39-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023418-37.dat family_berbew behavioral2/memory/5056-42-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023419-44.dat family_berbew behavioral2/memory/3392-47-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341a-50.dat family_berbew behavioral2/memory/3392-52-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341b-56.dat family_berbew behavioral2/memory/2424-59-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1304-60-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1304-67-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341c-64.dat family_berbew behavioral2/memory/5012-68-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341d-70.dat family_berbew behavioral2/memory/2956-76-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341e-75.dat family_berbew behavioral2/files/0x000700000002341f-81.dat family_berbew behavioral2/memory/2456-78-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4396-89-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023420-87.dat family_berbew behavioral2/files/0x0007000000023422-92.dat family_berbew behavioral2/memory/4172-94-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0008000000023410-99.dat family_berbew behavioral2/memory/2488-105-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023423-106.dat family_berbew behavioral2/files/0x0007000000023424-110.dat family_berbew behavioral2/memory/5040-112-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/464-116-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023425-117.dat family_berbew behavioral2/files/0x0007000000023426-122.dat family_berbew behavioral2/files/0x0007000000023427-126.dat family_berbew behavioral2/memory/3604-130-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023428-133.dat family_berbew behavioral2/memory/4192-128-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023429-139.dat family_berbew behavioral2/memory/1048-144-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002342a-145.dat family_berbew behavioral2/files/0x000700000002342b-149.dat family_berbew behavioral2/memory/3056-156-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002342c-155.dat family_berbew behavioral2/files/0x000700000002342d-161.dat family_berbew behavioral2/memory/3528-164-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002342e-168.dat family_berbew behavioral2/memory/3996-172-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002342f-173.dat family_berbew behavioral2/files/0x0007000000023430-178.dat family_berbew behavioral2/files/0x0007000000023431-183.dat family_berbew behavioral2/memory/2080-193-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/5116-200-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1312-219-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3764-223-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 4848 hbbhbn.exe 1428 7rrfrrf.exe 224 9pdvp.exe 2496 bhbnhn.exe 4508 vdpjj.exe 3832 lrrfxrl.exe 5056 3tthhn.exe 3392 jdpvv.exe 2424 hnnnbh.exe 1304 lllfxrx.exe 5012 bbthbt.exe 2956 vvvpj.exe 2456 hthtnh.exe 4396 jpvvd.exe 4172 7ttnhb.exe 3928 jpvvp.exe 2488 fflxrrl.exe 5040 htbtnn.exe 464 ppvjd.exe 2924 3xxxrff.exe 4192 dpjjd.exe 3604 hntbbn.exe 3012 pdppv.exe 1048 xfffxxf.exe 3464 pdpvj.exe 3056 7rrrrxx.exe 4084 hhhbbb.exe 3528 lrllxrf.exe 3996 1tntbh.exe 2056 dvpjd.exe 2168 3xxfxfl.exe 4600 hbthhh.exe 4692 jjvvd.exe 2080 lflffrr.exe 2560 hthbbb.exe 5116 dvvjj.exe 4064 jvvpj.exe 756 rllllrr.exe 4712 thhhbh.exe 4412 jjpjv.exe 4860 9fxrrxf.exe 1312 thnnhn.exe 3764 1bnnnt.exe 4820 9pppp.exe 3776 xfrlflf.exe 4852 bbbhhh.exe 2860 vdppj.exe 3244 ffffrxr.exe 4484 lrlfrxf.exe 1392 tnnnhn.exe 116 9nttnt.exe 396 3pppj.exe 1920 xlrrlxx.exe 1360 3rrllll.exe 436 ttbbtt.exe 4428 ddvpp.exe 884 jpjjj.exe 1952 5lrrrrl.exe 2340 bbbbbh.exe 3184 jjjjd.exe 4740 vdppj.exe 4008 rxxffff.exe 1476 nthbtt.exe 4716 pvvdd.exe -
resource yara_rule behavioral2/memory/2336-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/2336-5-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000900000002340c-9.dat upx behavioral2/memory/4848-12-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-13.dat upx behavioral2/memory/1428-17-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/224-22-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023415-20.dat upx behavioral2/memory/2496-27-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023416-26.dat upx behavioral2/files/0x0007000000023417-31.dat upx behavioral2/memory/4508-33-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3832-39-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023418-37.dat upx behavioral2/memory/5056-42-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023419-44.dat upx behavioral2/memory/3392-47-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341a-50.dat upx behavioral2/memory/3392-52-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341b-56.dat upx behavioral2/memory/2424-59-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1304-60-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1304-67-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341c-64.dat upx behavioral2/memory/5012-68-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341d-70.dat upx behavioral2/memory/2956-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341e-75.dat upx behavioral2/files/0x000700000002341f-81.dat upx behavioral2/memory/2456-78-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4396-89-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023420-87.dat upx behavioral2/files/0x0007000000023422-92.dat upx behavioral2/memory/4172-94-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000023410-99.dat upx behavioral2/memory/2488-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023423-106.dat upx behavioral2/files/0x0007000000023424-110.dat upx behavioral2/memory/5040-112-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/464-116-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023425-117.dat upx behavioral2/files/0x0007000000023426-122.dat upx behavioral2/files/0x0007000000023427-126.dat upx behavioral2/memory/3604-130-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023428-133.dat upx behavioral2/memory/4192-128-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023429-139.dat upx behavioral2/memory/1048-144-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342a-145.dat upx behavioral2/files/0x000700000002342b-149.dat upx behavioral2/memory/3056-156-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342c-155.dat upx behavioral2/files/0x000700000002342d-161.dat upx behavioral2/memory/3528-164-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342e-168.dat upx behavioral2/memory/3996-172-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342f-173.dat upx behavioral2/files/0x0007000000023430-178.dat upx behavioral2/files/0x0007000000023431-183.dat upx behavioral2/memory/2080-193-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5116-200-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1312-219-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3764-223-0x0000000000400000-0x0000000000434000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 4848 2336 4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe 83 PID 2336 wrote to memory of 4848 2336 4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe 83 PID 2336 wrote to memory of 4848 2336 4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe 83 PID 4848 wrote to memory of 1428 4848 hbbhbn.exe 84 PID 4848 wrote to memory of 1428 4848 hbbhbn.exe 84 PID 4848 wrote to memory of 1428 4848 hbbhbn.exe 84 PID 1428 wrote to memory of 224 1428 7rrfrrf.exe 85 PID 1428 wrote to memory of 224 1428 7rrfrrf.exe 85 PID 1428 wrote to memory of 224 1428 7rrfrrf.exe 85 PID 224 wrote to memory of 2496 224 9pdvp.exe 86 PID 224 wrote to memory of 2496 224 9pdvp.exe 86 PID 224 wrote to memory of 2496 224 9pdvp.exe 86 PID 2496 wrote to memory of 4508 2496 bhbnhn.exe 87 PID 2496 wrote to memory of 4508 2496 bhbnhn.exe 87 PID 2496 wrote to memory of 4508 2496 bhbnhn.exe 87 PID 4508 wrote to memory of 3832 4508 vdpjj.exe 88 PID 4508 wrote to memory of 3832 4508 vdpjj.exe 88 PID 4508 wrote to memory of 3832 4508 vdpjj.exe 88 PID 3832 wrote to memory of 5056 3832 lrrfxrl.exe 89 PID 3832 wrote to memory of 5056 3832 lrrfxrl.exe 89 PID 3832 wrote to memory of 5056 3832 lrrfxrl.exe 89 PID 5056 wrote to memory of 3392 5056 3tthhn.exe 90 PID 5056 wrote to memory of 3392 5056 3tthhn.exe 90 PID 5056 wrote to memory of 3392 5056 3tthhn.exe 90 PID 3392 wrote to memory of 2424 3392 jdpvv.exe 91 PID 3392 wrote to memory of 2424 3392 jdpvv.exe 91 PID 3392 wrote to memory of 2424 3392 jdpvv.exe 91 PID 2424 wrote to memory of 1304 2424 hnnnbh.exe 92 PID 2424 wrote to memory of 1304 2424 hnnnbh.exe 92 PID 2424 wrote to memory of 1304 2424 hnnnbh.exe 92 PID 1304 wrote to memory of 5012 1304 lllfxrx.exe 93 PID 1304 wrote to memory of 5012 1304 lllfxrx.exe 93 PID 1304 wrote to memory of 5012 1304 lllfxrx.exe 93 PID 5012 wrote to memory of 2956 5012 bbthbt.exe 94 PID 5012 wrote to memory of 2956 5012 bbthbt.exe 94 PID 5012 wrote to memory of 2956 5012 bbthbt.exe 94 PID 2956 wrote to memory of 2456 2956 vvvpj.exe 95 PID 2956 wrote to memory of 2456 2956 vvvpj.exe 95 PID 2956 wrote to memory of 2456 2956 vvvpj.exe 95 PID 2456 wrote to memory of 4396 2456 hthtnh.exe 96 PID 2456 wrote to memory of 4396 2456 hthtnh.exe 96 PID 2456 wrote to memory of 4396 2456 hthtnh.exe 96 PID 4396 wrote to memory of 4172 4396 jpvvd.exe 97 PID 4396 wrote to memory of 4172 4396 jpvvd.exe 97 PID 4396 wrote to memory of 4172 4396 jpvvd.exe 97 PID 4172 wrote to memory of 3928 4172 7ttnhb.exe 98 PID 4172 wrote to memory of 3928 4172 7ttnhb.exe 98 PID 4172 wrote to memory of 3928 4172 7ttnhb.exe 98 PID 3928 wrote to memory of 2488 3928 jpvvp.exe 100 PID 3928 wrote to memory of 2488 3928 jpvvp.exe 100 PID 3928 wrote to memory of 2488 3928 jpvvp.exe 100 PID 2488 wrote to memory of 5040 2488 fflxrrl.exe 101 PID 2488 wrote to memory of 5040 2488 fflxrrl.exe 101 PID 2488 wrote to memory of 5040 2488 fflxrrl.exe 101 PID 5040 wrote to memory of 464 5040 htbtnn.exe 102 PID 5040 wrote to memory of 464 5040 htbtnn.exe 102 PID 5040 wrote to memory of 464 5040 htbtnn.exe 102 PID 464 wrote to memory of 2924 464 ppvjd.exe 103 PID 464 wrote to memory of 2924 464 ppvjd.exe 103 PID 464 wrote to memory of 2924 464 ppvjd.exe 103 PID 2924 wrote to memory of 4192 2924 3xxxrff.exe 104 PID 2924 wrote to memory of 4192 2924 3xxxrff.exe 104 PID 2924 wrote to memory of 4192 2924 3xxxrff.exe 104 PID 4192 wrote to memory of 3604 4192 dpjjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4ee25c03b9245adcae1df6e53c3012d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\hbbhbn.exec:\hbbhbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\7rrfrrf.exec:\7rrfrrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\9pdvp.exec:\9pdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\bhbnhn.exec:\bhbnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vdpjj.exec:\vdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\3tthhn.exec:\3tthhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\jdpvv.exec:\jdpvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\hnnnbh.exec:\hnnnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\lllfxrx.exec:\lllfxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\bbthbt.exec:\bbthbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\vvvpj.exec:\vvvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hthtnh.exec:\hthtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jpvvd.exec:\jpvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\7ttnhb.exec:\7ttnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\jpvvp.exec:\jpvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\fflxrrl.exec:\fflxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\htbtnn.exec:\htbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\ppvjd.exec:\ppvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\3xxxrff.exec:\3xxxrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\dpjjd.exec:\dpjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\hntbbn.exec:\hntbbn.exe23⤵
- Executes dropped EXE
PID:3604 -
\??\c:\pdppv.exec:\pdppv.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xfffxxf.exec:\xfffxxf.exe25⤵
- Executes dropped EXE
PID:1048 -
\??\c:\pdpvj.exec:\pdpvj.exe26⤵
- Executes dropped EXE
PID:3464 -
\??\c:\7rrrrxx.exec:\7rrrrxx.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hhhbbb.exec:\hhhbbb.exe28⤵
- Executes dropped EXE
PID:4084 -
\??\c:\lrllxrf.exec:\lrllxrf.exe29⤵
- Executes dropped EXE
PID:3528 -
\??\c:\1tntbh.exec:\1tntbh.exe30⤵
- Executes dropped EXE
PID:3996 -
\??\c:\dvpjd.exec:\dvpjd.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\3xxfxfl.exec:\3xxfxfl.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hbthhh.exec:\hbthhh.exe33⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jjvvd.exec:\jjvvd.exe34⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lflffrr.exec:\lflffrr.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\hthbbb.exec:\hthbbb.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dvvjj.exec:\dvvjj.exe37⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jvvpj.exec:\jvvpj.exe38⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rllllrr.exec:\rllllrr.exe39⤵
- Executes dropped EXE
PID:756 -
\??\c:\thhhbh.exec:\thhhbh.exe40⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jjpjv.exec:\jjpjv.exe41⤵
- Executes dropped EXE
PID:4412 -
\??\c:\9fxrrxf.exec:\9fxrrxf.exe42⤵
- Executes dropped EXE
PID:4860 -
\??\c:\thnnhn.exec:\thnnhn.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\1bnnnt.exec:\1bnnnt.exe44⤵
- Executes dropped EXE
PID:3764 -
\??\c:\9pppp.exec:\9pppp.exe45⤵
- Executes dropped EXE
PID:4820 -
\??\c:\xfrlflf.exec:\xfrlflf.exe46⤵
- Executes dropped EXE
PID:3776 -
\??\c:\bbbhhh.exec:\bbbhhh.exe47⤵
- Executes dropped EXE
PID:4852 -
\??\c:\vdppj.exec:\vdppj.exe48⤵
- Executes dropped EXE
PID:2860 -
\??\c:\ffffrxr.exec:\ffffrxr.exe49⤵
- Executes dropped EXE
PID:3244 -
\??\c:\lrlfrxf.exec:\lrlfrxf.exe50⤵
- Executes dropped EXE
PID:4484 -
\??\c:\tnnnhn.exec:\tnnnhn.exe51⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9nttnt.exec:\9nttnt.exe52⤵
- Executes dropped EXE
PID:116 -
\??\c:\3pppj.exec:\3pppj.exe53⤵
- Executes dropped EXE
PID:396 -
\??\c:\xlrrlxx.exec:\xlrrlxx.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3rrllll.exec:\3rrllll.exe55⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ttbbtt.exec:\ttbbtt.exe56⤵
- Executes dropped EXE
PID:436 -
\??\c:\ddvpp.exec:\ddvpp.exe57⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jpjjj.exec:\jpjjj.exe58⤵
- Executes dropped EXE
PID:884 -
\??\c:\5lrrrrl.exec:\5lrrrrl.exe59⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bbbbbh.exec:\bbbbbh.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jjjjd.exec:\jjjjd.exe61⤵
- Executes dropped EXE
PID:3184 -
\??\c:\vdppj.exec:\vdppj.exe62⤵
- Executes dropped EXE
PID:4740 -
\??\c:\rxxffff.exec:\rxxffff.exe63⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nthbtt.exec:\nthbtt.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\pvvdd.exec:\pvvdd.exe65⤵
- Executes dropped EXE
PID:4716 -
\??\c:\9flfflx.exec:\9flfflx.exe66⤵PID:1728
-
\??\c:\lffffll.exec:\lffffll.exe67⤵PID:2164
-
\??\c:\nbhhbb.exec:\nbhhbb.exe68⤵PID:2160
-
\??\c:\3djpp.exec:\3djpp.exe69⤵PID:3376
-
\??\c:\jjvvj.exec:\jjvvj.exe70⤵PID:4568
-
\??\c:\3rfflll.exec:\3rfflll.exe71⤵PID:4112
-
\??\c:\tbbttt.exec:\tbbttt.exe72⤵PID:524
-
\??\c:\jjjdd.exec:\jjjdd.exe73⤵PID:2004
-
\??\c:\fffllxx.exec:\fffllxx.exe74⤵PID:1616
-
\??\c:\ttnnhh.exec:\ttnnhh.exe75⤵PID:4836
-
\??\c:\jvdjj.exec:\jvdjj.exe76⤵PID:844
-
\??\c:\pddvv.exec:\pddvv.exe77⤵PID:2824
-
\??\c:\ffffxff.exec:\ffffxff.exe78⤵PID:3232
-
\??\c:\htbbbb.exec:\htbbbb.exe79⤵PID:1452
-
\??\c:\ttnnht.exec:\ttnnht.exe80⤵PID:3520
-
\??\c:\3ddvp.exec:\3ddvp.exe81⤵PID:3808
-
\??\c:\pvjpd.exec:\pvjpd.exe82⤵PID:2056
-
\??\c:\lfrrxfl.exec:\lfrrxfl.exe83⤵PID:2408
-
\??\c:\flrxffl.exec:\flrxffl.exe84⤵PID:2156
-
\??\c:\bbbbtb.exec:\bbbbtb.exe85⤵PID:2096
-
\??\c:\vjdjd.exec:\vjdjd.exe86⤵PID:2328
-
\??\c:\frfxxxx.exec:\frfxxxx.exe87⤵PID:404
-
\??\c:\hbhbbn.exec:\hbhbbn.exe88⤵PID:4208
-
\??\c:\ffrlxxf.exec:\ffrlxxf.exe89⤵PID:1520
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe90⤵PID:2732
-
\??\c:\ntthtn.exec:\ntthtn.exe91⤵PID:4884
-
\??\c:\bhhhbh.exec:\bhhhbh.exe92⤵PID:2104
-
\??\c:\djddd.exec:\djddd.exe93⤵PID:3136
-
\??\c:\xlffffl.exec:\xlffffl.exe94⤵PID:232
-
\??\c:\hthbbb.exec:\hthbbb.exe95⤵PID:552
-
\??\c:\vjjpd.exec:\vjjpd.exe96⤵PID:4820
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe97⤵PID:1524
-
\??\c:\1llllxx.exec:\1llllxx.exe98⤵PID:4508
-
\??\c:\nbnnnn.exec:\nbnnnn.exe99⤵PID:3516
-
\??\c:\pjpjp.exec:\pjpjp.exe100⤵PID:5056
-
\??\c:\dpvdv.exec:\dpvdv.exe101⤵PID:1780
-
\??\c:\9xxrlrr.exec:\9xxrlrr.exe102⤵PID:4480
-
\??\c:\hbbbnt.exec:\hbbbnt.exe103⤵PID:5032
-
\??\c:\btnhbb.exec:\btnhbb.exe104⤵PID:4676
-
\??\c:\pjjpp.exec:\pjjpp.exe105⤵PID:1304
-
\??\c:\dpvpp.exec:\dpvpp.exe106⤵PID:1624
-
\??\c:\lrxxxll.exec:\lrxxxll.exe107⤵PID:1164
-
\??\c:\bbnntb.exec:\bbnntb.exe108⤵PID:3640
-
\??\c:\3ntbtb.exec:\3ntbtb.exe109⤵PID:4396
-
\??\c:\5ddvp.exec:\5ddvp.exe110⤵PID:3768
-
\??\c:\lffllrr.exec:\lffllrr.exe111⤵PID:560
-
\??\c:\hbthhb.exec:\hbthhb.exe112⤵PID:2488
-
\??\c:\hbhttn.exec:\hbhttn.exe113⤵PID:4716
-
\??\c:\djppj.exec:\djppj.exe114⤵PID:3360
-
\??\c:\dvpvd.exec:\dvpvd.exe115⤵PID:3288
-
\??\c:\rlrlfll.exec:\rlrlfll.exe116⤵PID:4728
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe117⤵PID:4652
-
\??\c:\nhnnhh.exec:\nhnnhh.exe118⤵PID:2124
-
\??\c:\httttb.exec:\httttb.exe119⤵PID:4112
-
\??\c:\jjpvv.exec:\jjpvv.exe120⤵PID:2880
-
\??\c:\ppdpv.exec:\ppdpv.exe121⤵PID:4276
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe122⤵PID:4460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-