Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
17/05/2024, 23:31
Behavioral task
behavioral1
Sample
522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target 522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe
- Size 463KB
- Sample240517-3ht9msgh83
- SHA256 cbbcac301f0dfeb2b0e0af550c9b1d936a5d55a95268929f1a1d821e095cd612
- MD5 522099cc933b0f90eba082b4df8322c0
- SHA1 5015298319d53bbd96e6b939b03c9f886404eaf7
- SHA512 42589a1946579b711812120b922ce4a025d4b7f33dcfa82466967d02af12987c5f7cb68d83b429117cfa2184cd0233affc798084a659a8dbf3cf78c1b15016f6
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V1:VeR0oykayRFp3lztP+OKaf1V1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2568-0-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/412-12-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2920-17-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3452-23-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3480-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5060-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2308-41-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4824-50-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1220-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2368-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2708-80-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2652-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1332-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4092-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3560-199-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4028-224-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2344-263-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4484-283-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4556-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3708-293-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4352-279-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1364-276-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3748-258-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3396-251-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4968-248-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1748-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1088-239-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4548-219-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3796-209-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2588-195-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4468-188-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3852-182-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4396-176-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4544-170-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4484-160-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4292-148-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1648-136-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3620-130-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1832-119-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1300-97-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3728-73-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4672-69-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4548-68-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1836-327-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2060-335-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4616-336-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5064-352-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/224-370-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4292-377-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/748-397-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/916-407-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4832-417-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4572-425-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/532-456-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4828-461-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/548-473-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4292-491-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3988-564-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3720-565-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4380-570-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/532-634-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4092-801-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1548-920-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1964-1019-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/2568-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0005000000022975-3.dat family_berbew behavioral2/files/0x000a0000000232f5-9.dat family_berbew behavioral2/files/0x00080000000232fb-11.dat family_berbew behavioral2/memory/412-12-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2920-17-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00080000000232fc-22.dat family_berbew behavioral2/memory/3452-23-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3480-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00080000000232ff-27.dat family_berbew behavioral2/memory/5060-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000d0000000233b3-33.dat family_berbew behavioral2/memory/2308-35-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235d7-39.dat family_berbew behavioral2/memory/2308-41-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235d8-45.dat family_berbew behavioral2/memory/4824-50-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1220-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235d9-52.dat family_berbew behavioral2/files/0x00070000000235da-60.dat family_berbew behavioral2/memory/2368-59-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235db-64.dat family_berbew behavioral2/files/0x00070000000235dc-78.dat family_berbew behavioral2/memory/2708-80-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2652-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235df-94.dat family_berbew behavioral2/files/0x00070000000235e0-100.dat family_berbew behavioral2/memory/1332-102-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235e1-106.dat family_berbew behavioral2/files/0x00070000000235e2-111.dat family_berbew behavioral2/files/0x00070000000235e3-116.dat family_berbew behavioral2/files/0x00070000000235e6-133.dat family_berbew behavioral2/memory/4092-142-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235e9-150.dat family_berbew behavioral2/files/0x00070000000235ea-156.dat family_berbew behavioral2/files/0x00070000000235ec-167.dat family_berbew behavioral2/files/0x00070000000235ee-179.dat family_berbew behavioral2/memory/3560-199-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4028-224-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2344-263-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4484-283-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4556-292-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3708-293-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4352-279-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1364-276-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3748-258-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3396-251-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4968-248-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1748-243-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1088-239-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4548-219-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3796-209-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2588-195-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4468-188-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235ef-185.dat family_berbew behavioral2/memory/3852-182-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4396-176-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235ed-173.dat family_berbew behavioral2/memory/4544-170-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235eb-162.dat family_berbew behavioral2/memory/4484-160-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4292-148-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000235e8-145.dat family_berbew behavioral2/files/0x00070000000235e7-139.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 3480 1vdvp.exe 412 rxrfxxl.exe 2920 fflllfl.exe 3452 nntnnn.exe 5060 tttnnh.exe 2308 xxrllll.exe 1220 fxfllff.exe 4824 1vjjp.exe 2368 bthbtt.exe 4548 1vvvd.exe 4672 9rlxxfr.exe 3728 frrrrxx.exe 2708 tnhbbt.exe 2652 vdjdv.exe 1300 vpjjd.exe 4932 vjppp.exe 1332 9lrrrrr.exe 1776 hhhbbb.exe 1832 pjdvv.exe 3964 fffxxxr.exe 3620 lfflrrr.exe 1648 nbbttn.exe 4092 9pjjd.exe 4292 5dvvp.exe 4908 xrxxxxf.exe 4484 btbtbb.exe 1212 vdpvj.exe 4544 xfllflx.exe 4396 1frxlfx.exe 3852 bnhbtt.exe 4468 3pdvv.exe 2996 rlrlffx.exe 2588 3xrxrxr.exe 3560 nntnnt.exe 704 vvddd.exe 4588 9jvpj.exe 3796 rlllrrl.exe 4980 tnbbtt.exe 1304 5nbbbh.exe 4548 dvpvp.exe 4028 7lxxxxx.exe 1588 bbnhht.exe 3696 tbbbnn.exe 4840 vddpp.exe 872 frffrrl.exe 1088 xxxxrxr.exe 1748 7hbbbh.exe 4968 9pjjd.exe 3396 fxrrlxf.exe 4288 xfffflf.exe 3748 9btnnn.exe 2344 jdjjj.exe 1540 lxlrlfl.exe 2936 xlfxffr.exe 328 hhtttt.exe 1364 5vvvv.exe 4352 xlrlllf.exe 4484 lxxrllf.exe 4400 nbhbtn.exe 4396 vvjdj.exe 4556 lflfffx.exe 3708 lflfrrf.exe 2996 bnbhbt.exe 4748 tbhntt.exe -
resource yara_rule behavioral2/memory/2568-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0005000000022975-3.dat upx behavioral2/files/0x000a0000000232f5-9.dat upx behavioral2/files/0x00080000000232fb-11.dat upx behavioral2/memory/412-12-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2920-17-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00080000000232fc-22.dat upx behavioral2/memory/3452-23-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3480-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00080000000232ff-27.dat upx behavioral2/memory/5060-30-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000d0000000233b3-33.dat upx behavioral2/memory/2308-35-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235d7-39.dat upx behavioral2/memory/2308-41-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235d8-45.dat upx behavioral2/memory/4824-50-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1220-47-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235d9-52.dat upx behavioral2/files/0x00070000000235da-60.dat upx behavioral2/memory/2368-59-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235db-64.dat upx behavioral2/files/0x00070000000235dc-78.dat upx behavioral2/memory/2708-80-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2652-91-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235df-94.dat upx behavioral2/files/0x00070000000235e0-100.dat upx behavioral2/memory/1332-102-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235e1-106.dat upx behavioral2/files/0x00070000000235e2-111.dat upx behavioral2/files/0x00070000000235e3-116.dat upx behavioral2/files/0x00070000000235e6-133.dat upx behavioral2/memory/4092-142-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235e9-150.dat upx behavioral2/files/0x00070000000235ea-156.dat upx behavioral2/files/0x00070000000235ec-167.dat upx behavioral2/files/0x00070000000235ee-179.dat upx behavioral2/memory/3560-199-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4028-224-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2344-263-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4484-283-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4556-292-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3708-293-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4352-279-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1364-276-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3748-258-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3396-251-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4968-248-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1748-243-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1088-239-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4548-219-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3796-209-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2588-195-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4468-188-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235ef-185.dat upx behavioral2/memory/3852-182-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4396-176-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235ed-173.dat upx behavioral2/memory/4544-170-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235eb-162.dat upx behavioral2/memory/4484-160-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4292-148-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000235e8-145.dat upx behavioral2/files/0x00070000000235e7-139.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 3480 2568 522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe 92 PID 2568 wrote to memory of 3480 2568 522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe 92 PID 2568 wrote to memory of 3480 2568 522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe 92 PID 3480 wrote to memory of 412 3480 1vdvp.exe 93 PID 3480 wrote to memory of 412 3480 1vdvp.exe 93 PID 3480 wrote to memory of 412 3480 1vdvp.exe 93 PID 412 wrote to memory of 2920 412 rxrfxxl.exe 94 PID 412 wrote to memory of 2920 412 rxrfxxl.exe 94 PID 412 wrote to memory of 2920 412 rxrfxxl.exe 94 PID 2920 wrote to memory of 3452 2920 fflllfl.exe 95 PID 2920 wrote to memory of 3452 2920 fflllfl.exe 95 PID 2920 wrote to memory of 3452 2920 fflllfl.exe 95 PID 3452 wrote to memory of 5060 3452 nntnnn.exe 96 PID 3452 wrote to memory of 5060 3452 nntnnn.exe 96 PID 3452 wrote to memory of 5060 3452 nntnnn.exe 96 PID 5060 wrote to memory of 2308 5060 tttnnh.exe 97 PID 5060 wrote to memory of 2308 5060 tttnnh.exe 97 PID 5060 wrote to memory of 2308 5060 tttnnh.exe 97 PID 2308 wrote to memory of 1220 2308 xxrllll.exe 98 PID 2308 wrote to memory of 1220 2308 xxrllll.exe 98 PID 2308 wrote to memory of 1220 2308 xxrllll.exe 98 PID 1220 wrote to memory of 4824 1220 fxfllff.exe 162 PID 1220 wrote to memory of 4824 1220 fxfllff.exe 162 PID 1220 wrote to memory of 4824 1220 fxfllff.exe 162 PID 4824 wrote to memory of 2368 4824 1vjjp.exe 100 PID 4824 wrote to memory of 2368 4824 1vjjp.exe 100 PID 4824 wrote to memory of 2368 4824 1vjjp.exe 100 PID 2368 wrote to memory of 4548 2368 bthbtt.exe 132 PID 2368 wrote to memory of 4548 2368 bthbtt.exe 132 PID 2368 wrote to memory of 4548 2368 bthbtt.exe 132 PID 4548 wrote to memory of 4672 4548 1vvvd.exe 102 PID 4548 wrote to memory of 4672 4548 1vvvd.exe 102 PID 4548 wrote to memory of 4672 4548 1vvvd.exe 102 PID 4672 wrote to memory of 3728 4672 9rlxxfr.exe 103 PID 4672 wrote to memory of 3728 4672 9rlxxfr.exe 103 PID 4672 wrote to memory of 3728 4672 9rlxxfr.exe 103 PID 3728 wrote to memory of 2708 3728 frrrrxx.exe 104 PID 3728 wrote to memory of 2708 3728 frrrrxx.exe 104 PID 3728 wrote to memory of 2708 3728 frrrrxx.exe 104 PID 2708 wrote to memory of 2652 2708 tnhbbt.exe 105 PID 2708 wrote to memory of 2652 2708 tnhbbt.exe 105 PID 2708 wrote to memory of 2652 2708 tnhbbt.exe 105 PID 2652 wrote to memory of 1300 2652 vdjdv.exe 106 PID 2652 wrote to memory of 1300 2652 vdjdv.exe 106 PID 2652 wrote to memory of 1300 2652 vdjdv.exe 106 PID 1300 wrote to memory of 4932 1300 vpjjd.exe 107 PID 1300 wrote to memory of 4932 1300 vpjjd.exe 107 PID 1300 wrote to memory of 4932 1300 vpjjd.exe 107 PID 4932 wrote to memory of 1332 4932 vjppp.exe 108 PID 4932 wrote to memory of 1332 4932 vjppp.exe 108 PID 4932 wrote to memory of 1332 4932 vjppp.exe 108 PID 1332 wrote to memory of 1776 1332 9lrrrrr.exe 109 PID 1332 wrote to memory of 1776 1332 9lrrrrr.exe 109 PID 1332 wrote to memory of 1776 1332 9lrrrrr.exe 109 PID 1776 wrote to memory of 1832 1776 hhhbbb.exe 110 PID 1776 wrote to memory of 1832 1776 hhhbbb.exe 110 PID 1776 wrote to memory of 1832 1776 hhhbbb.exe 110 PID 1832 wrote to memory of 3964 1832 pjdvv.exe 111 PID 1832 wrote to memory of 3964 1832 pjdvv.exe 111 PID 1832 wrote to memory of 3964 1832 pjdvv.exe 111 PID 3964 wrote to memory of 3620 3964 fffxxxr.exe 113 PID 3964 wrote to memory of 3620 3964 fffxxxr.exe 113 PID 3964 wrote to memory of 3620 3964 fffxxxr.exe 113 PID 3620 wrote to memory of 1648 3620 lfflrrr.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\522099cc933b0f90eba082b4df8322c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1vdvp.exec:\1vdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\rxrfxxl.exec:\rxrfxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\fflllfl.exec:\fflllfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\nntnnn.exec:\nntnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\tttnnh.exec:\tttnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\xxrllll.exec:\xxrllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\fxfllff.exec:\fxfllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\1vjjp.exec:\1vjjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\bthbtt.exec:\bthbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\1vvvd.exec:\1vvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\9rlxxfr.exec:\9rlxxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\frrrrxx.exec:\frrrrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\tnhbbt.exec:\tnhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vdjdv.exec:\vdjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpjjd.exec:\vpjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\vjppp.exec:\vjppp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\9lrrrrr.exec:\9lrrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\hhhbbb.exec:\hhhbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\pjdvv.exec:\pjdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\fffxxxr.exec:\fffxxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\lfflrrr.exec:\lfflrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\nbbttn.exec:\nbbttn.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9pjjd.exec:\9pjjd.exe24⤵
- Executes dropped EXE
PID:4092 -
\??\c:\5dvvp.exec:\5dvvp.exe25⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe26⤵
- Executes dropped EXE
PID:4908 -
\??\c:\btbtbb.exec:\btbtbb.exe27⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vdpvj.exec:\vdpvj.exe28⤵
- Executes dropped EXE
PID:1212 -
\??\c:\xfllflx.exec:\xfllflx.exe29⤵
- Executes dropped EXE
PID:4544 -
\??\c:\1frxlfx.exec:\1frxlfx.exe30⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bnhbtt.exec:\bnhbtt.exe31⤵
- Executes dropped EXE
PID:3852 -
\??\c:\3pdvv.exec:\3pdvv.exe32⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rlrlffx.exec:\rlrlffx.exe33⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3xrxrxr.exec:\3xrxrxr.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\nntnnt.exec:\nntnnt.exe35⤵
- Executes dropped EXE
PID:3560 -
\??\c:\vvddd.exec:\vvddd.exe36⤵
- Executes dropped EXE
PID:704 -
\??\c:\9jvpj.exec:\9jvpj.exe37⤵
- Executes dropped EXE
PID:4588 -
\??\c:\rlllrrl.exec:\rlllrrl.exe38⤵
- Executes dropped EXE
PID:3796 -
\??\c:\tnbbtt.exec:\tnbbtt.exe39⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5nbbbh.exec:\5nbbbh.exe40⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dvpvp.exec:\dvpvp.exe41⤵
- Executes dropped EXE
PID:4548 -
\??\c:\7lxxxxx.exec:\7lxxxxx.exe42⤵
- Executes dropped EXE
PID:4028 -
\??\c:\bbnhht.exec:\bbnhht.exe43⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tbbbnn.exec:\tbbbnn.exe44⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vddpp.exec:\vddpp.exe45⤵
- Executes dropped EXE
PID:4840 -
\??\c:\frffrrl.exec:\frffrrl.exe46⤵
- Executes dropped EXE
PID:872 -
\??\c:\xxxxrxr.exec:\xxxxrxr.exe47⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7hbbbh.exec:\7hbbbh.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\9pjjd.exec:\9pjjd.exe49⤵
- Executes dropped EXE
PID:4968 -
\??\c:\fxrrlxf.exec:\fxrrlxf.exe50⤵
- Executes dropped EXE
PID:3396 -
\??\c:\xfffflf.exec:\xfffflf.exe51⤵
- Executes dropped EXE
PID:4288 -
\??\c:\9btnnn.exec:\9btnnn.exe52⤵
- Executes dropped EXE
PID:3748 -
\??\c:\jdjjj.exec:\jdjjj.exe53⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxlrlfl.exec:\lxlrlfl.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xlfxffr.exec:\xlfxffr.exe55⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhtttt.exec:\hhtttt.exe56⤵
- Executes dropped EXE
PID:328 -
\??\c:\5vvvv.exec:\5vvvv.exe57⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xlrlllf.exec:\xlrlllf.exe58⤵
- Executes dropped EXE
PID:4352 -
\??\c:\lxxrllf.exec:\lxxrllf.exe59⤵
- Executes dropped EXE
PID:4484 -
\??\c:\nbhbtn.exec:\nbhbtn.exe60⤵
- Executes dropped EXE
PID:4400 -
\??\c:\vvjdj.exec:\vvjdj.exe61⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lflfffx.exec:\lflfffx.exe62⤵
- Executes dropped EXE
PID:4556 -
\??\c:\lflfrrf.exec:\lflfrrf.exe63⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bnbhbt.exec:\bnbhbt.exe64⤵
- Executes dropped EXE
PID:2996 -
\??\c:\tbhntt.exec:\tbhntt.exe65⤵
- Executes dropped EXE
PID:4748 -
\??\c:\ddpjj.exec:\ddpjj.exe66⤵PID:4888
-
\??\c:\lfllffx.exec:\lfllffx.exe67⤵PID:1120
-
\??\c:\9rrlflf.exec:\9rrlflf.exe68⤵PID:3292
-
\??\c:\tbtttb.exec:\tbtttb.exe69⤵PID:2540
-
\??\c:\pjdjj.exec:\pjdjj.exe70⤵PID:4676
-
\??\c:\3fllrrr.exec:\3fllrrr.exe71⤵PID:4824
-
\??\c:\5ntnnt.exec:\5ntnnt.exe72⤵PID:2204
-
\??\c:\ppvdp.exec:\ppvdp.exe73⤵PID:1836
-
\??\c:\djppp.exec:\djppp.exe74⤵PID:4840
-
\??\c:\xrxxrrx.exec:\xrxxrrx.exe75⤵PID:2060
-
\??\c:\dpppj.exec:\dpppj.exe76⤵PID:4616
-
\??\c:\7bnthb.exec:\7bnthb.exe77⤵PID:732
-
\??\c:\dvppd.exec:\dvppd.exe78⤵PID:4912
-
\??\c:\xrrrlfr.exec:\xrrrlfr.exe79⤵PID:4968
-
\??\c:\tnbttt.exec:\tnbttt.exe80⤵PID:5064
-
\??\c:\ppjjv.exec:\ppjjv.exe81⤵PID:4288
-
\??\c:\hbbnnt.exec:\hbbnnt.exe82⤵PID:3748
-
\??\c:\bnttnn.exec:\bnttnn.exe83⤵PID:2344
-
\??\c:\1jvvv.exec:\1jvvv.exe84⤵PID:1576
-
\??\c:\1rffxfx.exec:\1rffxfx.exe85⤵PID:224
-
\??\c:\nbhbtb.exec:\nbhbtb.exe86⤵PID:4908
-
\??\c:\dvvpj.exec:\dvvpj.exe87⤵PID:4292
-
\??\c:\fflrlll.exec:\fflrlll.exe88⤵PID:4388
-
\??\c:\tbnthn.exec:\tbnthn.exe89⤵PID:2676
-
\??\c:\dvddd.exec:\dvddd.exe90⤵PID:4000
-
\??\c:\1lllfff.exec:\1lllfff.exe91⤵PID:2568
-
\??\c:\7nnnnt.exec:\7nnnnt.exe92⤵PID:3580
-
\??\c:\jdvvv.exec:\jdvvv.exe93⤵PID:748
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe94⤵PID:1384
-
\??\c:\tnbtbb.exec:\tnbtbb.exe95⤵PID:3952
-
\??\c:\vvvdd.exec:\vvvdd.exe96⤵PID:916
-
\??\c:\rxfflrr.exec:\rxfflrr.exe97⤵PID:2784
-
\??\c:\3tbttb.exec:\3tbttb.exe98⤵PID:1444
-
\??\c:\dvddp.exec:\dvddp.exe99⤵PID:4832
-
\??\c:\7lrllll.exec:\7lrllll.exe100⤵PID:4588
-
\??\c:\tthbnb.exec:\tthbnb.exe101⤵PID:3704
-
\??\c:\hthbtt.exec:\hthbtt.exe102⤵PID:4572
-
\??\c:\dvppp.exec:\dvppp.exe103⤵PID:4612
-
\??\c:\fxlrllf.exec:\fxlrllf.exe104⤵PID:3164
-
\??\c:\btntnh.exec:\btntnh.exe105⤵PID:4824
-
\??\c:\jdjdj.exec:\jdjdj.exe106⤵PID:1000
-
\??\c:\frfrxlf.exec:\frfrxlf.exe107⤵PID:1272
-
\??\c:\5hnhbh.exec:\5hnhbh.exe108⤵PID:1956
-
\??\c:\jppvp.exec:\jppvp.exe109⤵PID:872
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe110⤵PID:1776
-
\??\c:\3bttbh.exec:\3bttbh.exe111⤵PID:532
-
\??\c:\vvvpj.exec:\vvvpj.exe112⤵PID:4828
-
\??\c:\lfffrrr.exec:\lfffrrr.exe113⤵PID:4412
-
\??\c:\bbbbtt.exec:\bbbbtt.exe114⤵PID:4540
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:1596
-
\??\c:\flffxlf.exec:\flffxlf.exe116⤵PID:548
-
\??\c:\hnnhbb.exec:\hnnhbb.exe117⤵PID:3596
-
\??\c:\vjdjd.exec:\vjdjd.exe118⤵PID:3916
-
\??\c:\rxrlfrr.exec:\rxrlfrr.exe119⤵PID:2312
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe120⤵PID:2696
-
\??\c:\nnnnnt.exec:\nnnnnt.exe121⤵PID:4292
-
\??\c:\ppddd.exec:\ppddd.exe122⤵PID:2676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-