Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 12:40
Behavioral task
behavioral1
Sample
ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe
-
Size
447KB
-
MD5
ecb9b33a23f053225b6447f148d44870
-
SHA1
c52164612b896fe8906d6224833574b77328fc2e
-
SHA256
615336c214d0a92d455d9aeb62f813cbc036e8a9771c43c141dccbc7830729e2
-
SHA512
64bf569fe20376ae83e36c2a58b75010c6eded79a2b5e8a2d367b8a8b175e6a0e1013a30bec2760bc7af25ea5ff65f3948f41af4eea4500f373ee62d4672cdf7
-
SSDEEP
12288:QT6SZhP46SCTbSwgS1IaPRJbDh4i0vm4OsKN5sTuGZb:QThhP46SCTbSwgS1IaPRJbDh4i0vm4Om
Malware Config
Signatures
-
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x00090000000235f1-5.dat family_berbew behavioral2/files/0x00080000000235f5-19.dat family_berbew behavioral2/files/0x00080000000235f8-29.dat family_berbew behavioral2/files/0x0009000000023607-41.dat family_berbew behavioral2/files/0x000f0000000235fb-51.dat family_berbew behavioral2/files/0x0008000000023313-61.dat family_berbew behavioral2/files/0x000800000002296f-72.dat family_berbew behavioral2/files/0x0005000000022975-82.dat family_berbew behavioral2/files/0x000a0000000232fe-92.dat family_berbew behavioral2/files/0x000c000000023313-103.dat family_berbew behavioral2/files/0x0006000000022975-113.dat family_berbew behavioral2/files/0x000b0000000232fe-123.dat family_berbew behavioral2/files/0x000e000000023317-134.dat family_berbew behavioral2/files/0x0009000000022975-144.dat family_berbew behavioral2/files/0x000e000000023319-155.dat family_berbew behavioral2/files/0x000c000000023320-166.dat family_berbew behavioral2/files/0x000b0000000235f8-177.dat family_berbew behavioral2/files/0x000f000000023319-187.dat family_berbew behavioral2/files/0x0017000000023320-197.dat family_berbew behavioral2/files/0x000c0000000235f8-207.dat family_berbew behavioral2/files/0x0010000000023319-218.dat family_berbew behavioral2/files/0x0018000000023320-229.dat family_berbew behavioral2/files/0x000d0000000235f8-240.dat family_berbew behavioral2/files/0x0011000000023319-251.dat family_berbew behavioral2/files/0x0019000000023320-261.dat family_berbew behavioral2/files/0x000e0000000235f8-271.dat family_berbew behavioral2/files/0x0012000000023319-281.dat family_berbew behavioral2/files/0x001a000000023320-291.dat family_berbew behavioral2/files/0x000f0000000235f8-301.dat family_berbew behavioral2/files/0x0013000000023319-311.dat family_berbew behavioral2/files/0x000d000000023601-321.dat family_berbew behavioral2/files/0x000c000000023603-331.dat family_berbew -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wbwqi.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wpq.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wxfsb.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation whitq.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation waxrynfp.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wppii.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wymyogcr.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wlikctkh.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wbmpti.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wiidtka.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wpnfflpt.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wylmj.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation weirkxl.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation whc.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wclplj.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wmbw.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation waipifoy.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvo.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvkirk.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wdooa.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wheldcxv.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wpbsdneuw.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wjafirm.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wdljf.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wruwmxe.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvtywlmjg.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wxpojxc.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation woiko.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wajnri.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wgrjpyp.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wqclda.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvhnj.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wnsun.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wybiij.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation weqs.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvrhgd.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wtcxjki.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wmbkcxdi.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wrpxwn.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wwsoogh.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wwquef.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wovdpl.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wfuu.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wcco.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wgprjyqb.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wvlhhy.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation woivjngj.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wmg.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wuim.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wcf.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wfmdjmv.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wjl.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wwld.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wwj.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wasttk.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wdrcueyp.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wiusij.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation woas.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wwb.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wfern.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wgxof.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wlft.exe Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation wxvakmo.exe -
Executes dropped EXE 64 IoCs
pid Process 4856 wpbsdneuw.exe 3144 wbmpti.exe 4992 wmbw.exe 1264 wyf.exe 5112 wbdr.exe 1248 wbslr.exe 4472 wasttk.exe 2340 wrxkn.exe 5068 wpiym.exe 4352 wpctj.exe 1780 wykw.exe 1140 wieklxov.exe 3792 wjafirm.exe 2092 woiko.exe 3628 whhsp.exe 1796 wmbkcxdi.exe 4216 wbwqi.exe 2764 wlft.exe 3096 wdonnuwn.exe 2224 wrpxwn.exe 3628 wcjlcq.exe 3744 wpnfflpt.exe 4556 whc.exe 2580 wthwc.exe 964 wgdeam.exe 4876 wmg.exe 624 wrbwrd.exe 3760 wvuofo.exe 1860 wwsoogh.exe 3608 wtpnsjbc.exe 4608 wiwmicbul.exe 228 wylmj.exe 2464 wajnri.exe 1200 waipifoy.exe 3684 wwld.exe 3924 wnejgt.exe 1124 wbhdjpxs.exe 436 wgrjpyp.exe 4780 wxvakmo.exe 2096 whhlcrmdu.exe 1112 wkglj.exe 4004 wgwnn.exe 4776 wdljf.exe 5008 wpq.exe 3376 wexd.exe 3928 wymyogcr.exe 2964 wiku.exe 4848 wwquef.exe 2608 waqul.exe 2068 wjcg.exe 3272 wdrcueyp.exe 2380 wqclda.exe 1244 wqqenw.exe 1420 wiusij.exe 4252 wjxcjeu.exe 4848 wfy.exe 4884 wvhnj.exe 516 wrkytb.exe 1220 weirkxl.exe 4856 wvaxw.exe 3480 wvo.exe 3760 wemmfmyv.exe 5060 wwdqr.exe 2276 wvgbtt.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wpbsdneuw.exe ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe File opened for modification C:\Windows\SysWOW64\wbdr.exe wyf.exe File created C:\Windows\SysWOW64\whhlcrmdu.exe wxvakmo.exe File opened for modification C:\Windows\SysWOW64\waqul.exe wwquef.exe File created C:\Windows\SysWOW64\wrkytb.exe wvhnj.exe File created C:\Windows\SysWOW64\wbgal.exe wriel.exe File created C:\Windows\SysWOW64\wuim.exe wbgal.exe File opened for modification C:\Windows\SysWOW64\wsef.exe wipwwdtat.exe File opened for modification C:\Windows\SysWOW64\wrpxwn.exe wdonnuwn.exe File opened for modification C:\Windows\SysWOW64\wjxcjeu.exe wiusij.exe File created C:\Windows\SysWOW64\wvaxw.exe weirkxl.exe File created C:\Windows\SysWOW64\wwyss.exe wwwkpesr.exe File opened for modification C:\Windows\SysWOW64\wnftpakd.exe wryy.exe File created C:\Windows\SysWOW64\wlikcpvh.exe wyoahuk.exe File created C:\Windows\SysWOW64\wjl.exe wrhfx.exe File created C:\Windows\SysWOW64\wdcgucun.exe wijyh.exe File created C:\Windows\SysWOW64\wyxdds.exe whc.exe File created C:\Windows\SysWOW64\waxrynfp.exe wwyss.exe File created C:\Windows\SysWOW64\wbppury.exe wfmdjmv.exe File created C:\Windows\SysWOW64\wjri.exe wfesxjjfu.exe File created C:\Windows\SysWOW64\wvves.exe wtiyiuv.exe File opened for modification C:\Windows\SysWOW64\wuim.exe wbgal.exe File opened for modification C:\Windows\SysWOW64\wwwkpesr.exe wjasahh.exe File created C:\Windows\SysWOW64\woeuoy.exe wfhaptgpk.exe File created C:\Windows\SysWOW64\womlolw.exe woxsg.exe File opened for modification C:\Windows\SysWOW64\wmbkcxdi.exe whhsp.exe File opened for modification C:\Windows\SysWOW64\wiwmicbul.exe wtpnsjbc.exe File opened for modification C:\Windows\SysWOW64\wqfvfmqg.exe wnhv.exe File opened for modification C:\Windows\SysWOW64\wxfsb.exe wlikctkh.exe File created C:\Windows\SysWOW64\wybiij.exe wlikcpvh.exe File opened for modification C:\Windows\SysWOW64\wclplj.exe woivjngj.exe File created C:\Windows\SysWOW64\wmdgpa.exe wdjtk.exe File created C:\Windows\SysWOW64\wcjlcq.exe wrpxwn.exe File opened for modification C:\Windows\SysWOW64\wajnri.exe wylmj.exe File created C:\Windows\SysWOW64\wjxcjeu.exe wiusij.exe File created C:\Windows\SysWOW64\wvgbtt.exe wwdqr.exe File created C:\Windows\SysWOW64\wjgmakbm.exe wftwav.exe File opened for modification C:\Windows\SysWOW64\wkglj.exe whhlcrmdu.exe File created C:\Windows\SysWOW64\wvlhhy.exe wryrhmr.exe File opened for modification C:\Windows\SysWOW64\wvkirk.exe wvhbpoqhn.exe File opened for modification C:\Windows\SysWOW64\wlkksja.exe wtft.exe File created C:\Windows\SysWOW64\wbwwo.exe wwj.exe File created C:\Windows\SysWOW64\wgjndqfpe.exe wiqpov.exe File opened for modification C:\Windows\SysWOW64\wwdqr.exe wemmfmyv.exe File created C:\Windows\SysWOW64\woacyoe.exe wsv.exe File created C:\Windows\SysWOW64\wfuu.exe wjri.exe File created C:\Windows\SysWOW64\wgxof.exe wjgmakbm.exe File created C:\Windows\SysWOW64\wdjtk.exe wlgdokg.exe File created C:\Windows\SysWOW64\wymyogcr.exe wexd.exe File opened for modification C:\Windows\SysWOW64\wadkef.exe waaccikfv.exe File created C:\Windows\SysWOW64\wdrcueyp.exe wjcg.exe File opened for modification C:\Windows\SysWOW64\wnwjxcg.exe wruwmxe.exe File created C:\Windows\SysWOW64\woas.exe wnwjxcg.exe File created C:\Windows\SysWOW64\wvnokt.exe wvlhhy.exe File created C:\Windows\SysWOW64\wqfvfmqg.exe wnhv.exe File created C:\Windows\SysWOW64\wdbtqxi.exe wueyrra.exe File opened for modification C:\Windows\SysWOW64\wgprjyqb.exe weqs.exe File created C:\Windows\SysWOW64\wlurtx.exe wiidtka.exe File opened for modification C:\Windows\SysWOW64\wrkytb.exe wvhnj.exe File created C:\Windows\SysWOW64\wjgfld.exe wuim.exe File opened for modification C:\Windows\SysWOW64\wdcgucun.exe wijyh.exe File created C:\Windows\SysWOW64\wmnsfyo.exe wpl.exe File created C:\Windows\SysWOW64\wejl.exe wbwwo.exe File opened for modification C:\Windows\SysWOW64\wjafirm.exe wieklxov.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 16 IoCs
pid pid_target Process procid_target 2464 4856 WerFault.exe 95 3492 4856 WerFault.exe 95 4648 4472 WerFault.exe 127 4216 1140 WerFault.exe 146 4968 4608 WerFault.exe 207 212 1112 WerFault.exe 240 4092 4848 WerFault.exe 263 1188 4252 WerFault.exe 286 224 4396 WerFault.exe 349 632 1188 WerFault.exe 375 3480 4648 WerFault.exe 404 1988 4356 WerFault.exe 418 3816 2524 WerFault.exe 489 4776 3056 WerFault.exe 493 1952 2300 WerFault.exe 601 3288 4428 WerFault.exe 656 -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 4856 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 95 PID 2416 wrote to memory of 4856 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 95 PID 2416 wrote to memory of 4856 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 95 PID 2416 wrote to memory of 376 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 97 PID 2416 wrote to memory of 376 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 97 PID 2416 wrote to memory of 376 2416 ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe 97 PID 4856 wrote to memory of 3144 4856 wpbsdneuw.exe 99 PID 4856 wrote to memory of 3144 4856 wpbsdneuw.exe 99 PID 4856 wrote to memory of 3144 4856 wpbsdneuw.exe 99 PID 4856 wrote to memory of 2000 4856 wpbsdneuw.exe 100 PID 4856 wrote to memory of 2000 4856 wpbsdneuw.exe 100 PID 4856 wrote to memory of 2000 4856 wpbsdneuw.exe 100 PID 3144 wrote to memory of 4992 3144 wbmpti.exe 107 PID 3144 wrote to memory of 4992 3144 wbmpti.exe 107 PID 3144 wrote to memory of 4992 3144 wbmpti.exe 107 PID 3144 wrote to memory of 1220 3144 wbmpti.exe 108 PID 3144 wrote to memory of 1220 3144 wbmpti.exe 108 PID 3144 wrote to memory of 1220 3144 wbmpti.exe 108 PID 4992 wrote to memory of 1264 4992 wmbw.exe 112 PID 4992 wrote to memory of 1264 4992 wmbw.exe 112 PID 4992 wrote to memory of 1264 4992 wmbw.exe 112 PID 4992 wrote to memory of 2868 4992 wmbw.exe 113 PID 4992 wrote to memory of 2868 4992 wmbw.exe 113 PID 4992 wrote to memory of 2868 4992 wmbw.exe 113 PID 1264 wrote to memory of 5112 1264 wyf.exe 120 PID 1264 wrote to memory of 5112 1264 wyf.exe 120 PID 1264 wrote to memory of 5112 1264 wyf.exe 120 PID 1264 wrote to memory of 1692 1264 wyf.exe 121 PID 1264 wrote to memory of 1692 1264 wyf.exe 121 PID 1264 wrote to memory of 1692 1264 wyf.exe 121 PID 5112 wrote to memory of 1248 5112 wbdr.exe 124 PID 5112 wrote to memory of 1248 5112 wbdr.exe 124 PID 5112 wrote to memory of 1248 5112 wbdr.exe 124 PID 5112 wrote to memory of 5000 5112 wbdr.exe 125 PID 5112 wrote to memory of 5000 5112 wbdr.exe 125 PID 5112 wrote to memory of 5000 5112 wbdr.exe 125 PID 1248 wrote to memory of 4472 1248 wbslr.exe 127 PID 1248 wrote to memory of 4472 1248 wbslr.exe 127 PID 1248 wrote to memory of 4472 1248 wbslr.exe 127 PID 1248 wrote to memory of 5004 1248 wbslr.exe 128 PID 1248 wrote to memory of 5004 1248 wbslr.exe 128 PID 1248 wrote to memory of 5004 1248 wbslr.exe 128 PID 4472 wrote to memory of 2340 4472 wasttk.exe 130 PID 4472 wrote to memory of 2340 4472 wasttk.exe 130 PID 4472 wrote to memory of 2340 4472 wasttk.exe 130 PID 4472 wrote to memory of 1884 4472 wasttk.exe 131 PID 4472 wrote to memory of 1884 4472 wasttk.exe 131 PID 4472 wrote to memory of 1884 4472 wasttk.exe 131 PID 2340 wrote to memory of 5068 2340 wrxkn.exe 136 PID 2340 wrote to memory of 5068 2340 wrxkn.exe 136 PID 2340 wrote to memory of 5068 2340 wrxkn.exe 136 PID 2340 wrote to memory of 1676 2340 wrxkn.exe 137 PID 2340 wrote to memory of 1676 2340 wrxkn.exe 137 PID 2340 wrote to memory of 1676 2340 wrxkn.exe 137 PID 5068 wrote to memory of 4352 5068 wpiym.exe 139 PID 5068 wrote to memory of 4352 5068 wpiym.exe 139 PID 5068 wrote to memory of 4352 5068 wpiym.exe 139 PID 5068 wrote to memory of 3044 5068 wpiym.exe 140 PID 5068 wrote to memory of 3044 5068 wpiym.exe 140 PID 5068 wrote to memory of 3044 5068 wpiym.exe 140 PID 4352 wrote to memory of 1780 4352 wpctj.exe 142 PID 4352 wrote to memory of 1780 4352 wpctj.exe 142 PID 4352 wrote to memory of 1780 4352 wpctj.exe 142 PID 4352 wrote to memory of 1424 4352 wpctj.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ecb9b33a23f053225b6447f148d44870_NeikiAnalytics.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\wpbsdneuw.exe"C:\Windows\system32\wpbsdneuw.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\wbmpti.exe"C:\Windows\system32\wbmpti.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\wmbw.exe"C:\Windows\system32\wmbw.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\wyf.exe"C:\Windows\system32\wyf.exe"5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\wbdr.exe"C:\Windows\system32\wbdr.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\wbslr.exe"C:\Windows\system32\wbslr.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\SysWOW64\wasttk.exe"C:\Windows\system32\wasttk.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\wrxkn.exe"C:\Windows\system32\wrxkn.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\wpiym.exe"C:\Windows\system32\wpiym.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\wpctj.exe"C:\Windows\system32\wpctj.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\wykw.exe"C:\Windows\system32\wykw.exe"12⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\SysWOW64\wieklxov.exe"C:\Windows\system32\wieklxov.exe"13⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1140 -
C:\Windows\SysWOW64\wjafirm.exe"C:\Windows\system32\wjafirm.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
PID:3792 -
C:\Windows\SysWOW64\woiko.exe"C:\Windows\system32\woiko.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
PID:2092 -
C:\Windows\SysWOW64\whhsp.exe"C:\Windows\system32\whhsp.exe"16⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3628 -
C:\Windows\SysWOW64\wmbkcxdi.exe"C:\Windows\system32\wmbkcxdi.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
PID:1796 -
C:\Windows\SysWOW64\wbwqi.exe"C:\Windows\system32\wbwqi.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
PID:4216 -
C:\Windows\SysWOW64\wlft.exe"C:\Windows\system32\wlft.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
PID:2764 -
C:\Windows\SysWOW64\wdonnuwn.exe"C:\Windows\system32\wdonnuwn.exe"20⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3096 -
C:\Windows\SysWOW64\wrpxwn.exe"C:\Windows\system32\wrpxwn.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:2224 -
C:\Windows\SysWOW64\wcjlcq.exe"C:\Windows\system32\wcjlcq.exe"22⤵
- Executes dropped EXE
PID:3628 -
C:\Windows\SysWOW64\wpnfflpt.exe"C:\Windows\system32\wpnfflpt.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
PID:3744 -
C:\Windows\SysWOW64\whc.exe"C:\Windows\system32\whc.exe"24⤵
- Executes dropped EXE
PID:4556 -
C:\Windows\SysWOW64\wthwc.exe"C:\Windows\system32\wthwc.exe"25⤵
- Executes dropped EXE
PID:2580 -
C:\Windows\SysWOW64\wgdeam.exe"C:\Windows\system32\wgdeam.exe"26⤵
- Executes dropped EXE
PID:964 -
C:\Windows\SysWOW64\wmg.exe"C:\Windows\system32\wmg.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
PID:4876 -
C:\Windows\SysWOW64\wrbwrd.exe"C:\Windows\system32\wrbwrd.exe"28⤵
- Executes dropped EXE
PID:624 -
C:\Windows\SysWOW64\wvuofo.exe"C:\Windows\system32\wvuofo.exe"29⤵
- Executes dropped EXE
PID:3760 -
C:\Windows\SysWOW64\wwsoogh.exe"C:\Windows\system32\wwsoogh.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
PID:1860 -
C:\Windows\SysWOW64\wtpnsjbc.exe"C:\Windows\system32\wtpnsjbc.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3608 -
C:\Windows\SysWOW64\wiwmicbul.exe"C:\Windows\system32\wiwmicbul.exe"32⤵
- Executes dropped EXE
PID:4608 -
C:\Windows\SysWOW64\wylmj.exe"C:\Windows\system32\wylmj.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:228 -
C:\Windows\SysWOW64\wajnri.exe"C:\Windows\system32\wajnri.exe"34⤵
- Checks computer location settings
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\waipifoy.exe"C:\Windows\system32\waipifoy.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
PID:1200 -
C:\Windows\SysWOW64\wwld.exe"C:\Windows\system32\wwld.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\wnejgt.exe"C:\Windows\system32\wnejgt.exe"37⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\wbhdjpxs.exe"C:\Windows\system32\wbhdjpxs.exe"38⤵
- Executes dropped EXE
PID:1124 -
C:\Windows\SysWOW64\wgrjpyp.exe"C:\Windows\system32\wgrjpyp.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
PID:436 -
C:\Windows\SysWOW64\wxvakmo.exe"C:\Windows\system32\wxvakmo.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4780 -
C:\Windows\SysWOW64\whhlcrmdu.exe"C:\Windows\system32\whhlcrmdu.exe"41⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2096 -
C:\Windows\SysWOW64\wkglj.exe"C:\Windows\system32\wkglj.exe"42⤵
- Executes dropped EXE
PID:1112 -
C:\Windows\SysWOW64\wgwnn.exe"C:\Windows\system32\wgwnn.exe"43⤵
- Executes dropped EXE
PID:4004 -
C:\Windows\SysWOW64\wdljf.exe"C:\Windows\system32\wdljf.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
PID:4776 -
C:\Windows\SysWOW64\wpq.exe"C:\Windows\system32\wpq.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
PID:5008 -
C:\Windows\SysWOW64\wexd.exe"C:\Windows\system32\wexd.exe"46⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3376 -
C:\Windows\SysWOW64\wymyogcr.exe"C:\Windows\system32\wymyogcr.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
PID:3928 -
C:\Windows\SysWOW64\wiku.exe"C:\Windows\system32\wiku.exe"48⤵
- Executes dropped EXE
PID:2964 -
C:\Windows\SysWOW64\wwquef.exe"C:\Windows\system32\wwquef.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4848 -
C:\Windows\SysWOW64\waqul.exe"C:\Windows\system32\waqul.exe"50⤵
- Executes dropped EXE
PID:2608 -
C:\Windows\SysWOW64\wjcg.exe"C:\Windows\system32\wjcg.exe"51⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2068 -
C:\Windows\SysWOW64\wdrcueyp.exe"C:\Windows\system32\wdrcueyp.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
PID:3272 -
C:\Windows\SysWOW64\wqclda.exe"C:\Windows\system32\wqclda.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\wqqenw.exe"C:\Windows\system32\wqqenw.exe"54⤵
- Executes dropped EXE
PID:1244 -
C:\Windows\SysWOW64\wiusij.exe"C:\Windows\system32\wiusij.exe"55⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:1420 -
C:\Windows\SysWOW64\wjxcjeu.exe"C:\Windows\system32\wjxcjeu.exe"56⤵
- Executes dropped EXE
PID:4252 -
C:\Windows\SysWOW64\wfy.exe"C:\Windows\system32\wfy.exe"57⤵
- Executes dropped EXE
PID:4848 -
C:\Windows\SysWOW64\wvhnj.exe"C:\Windows\system32\wvhnj.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:4884 -
C:\Windows\SysWOW64\wrkytb.exe"C:\Windows\system32\wrkytb.exe"59⤵
- Executes dropped EXE
PID:516 -
C:\Windows\SysWOW64\weirkxl.exe"C:\Windows\system32\weirkxl.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
PID:1220 -
C:\Windows\SysWOW64\wvaxw.exe"C:\Windows\system32\wvaxw.exe"61⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\wvo.exe"C:\Windows\system32\wvo.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
PID:3480 -
C:\Windows\SysWOW64\wemmfmyv.exe"C:\Windows\system32\wemmfmyv.exe"63⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3760 -
C:\Windows\SysWOW64\wwdqr.exe"C:\Windows\system32\wwdqr.exe"64⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5060 -
C:\Windows\SysWOW64\wvgbtt.exe"C:\Windows\system32\wvgbtt.exe"65⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\SysWOW64\wruwmxe.exe"C:\Windows\system32\wruwmxe.exe"66⤵
- Checks computer location settings
- Drops file in System32 directory
PID:5000 -
C:\Windows\SysWOW64\wnwjxcg.exe"C:\Windows\system32\wnwjxcg.exe"67⤵
- Drops file in System32 directory
PID:2524 -
C:\Windows\SysWOW64\woas.exe"C:\Windows\system32\woas.exe"68⤵
- Checks computer location settings
PID:116 -
C:\Windows\SysWOW64\wryrhmr.exe"C:\Windows\system32\wryrhmr.exe"69⤵
- Drops file in System32 directory
PID:3692 -
C:\Windows\SysWOW64\wvlhhy.exe"C:\Windows\system32\wvlhhy.exe"70⤵
- Checks computer location settings
- Drops file in System32 directory
PID:4180 -
C:\Windows\SysWOW64\wvnokt.exe"C:\Windows\system32\wvnokt.exe"71⤵PID:3760
-
C:\Windows\SysWOW64\wnje.exe"C:\Windows\system32\wnje.exe"72⤵PID:624
-
C:\Windows\SysWOW64\wvhbpoqhn.exe"C:\Windows\system32\wvhbpoqhn.exe"73⤵
- Drops file in System32 directory
PID:5068 -
C:\Windows\SysWOW64\wvkirk.exe"C:\Windows\system32\wvkirk.exe"74⤵
- Checks computer location settings
PID:672 -
C:\Windows\SysWOW64\wnhv.exe"C:\Windows\system32\wnhv.exe"75⤵
- Drops file in System32 directory
PID:1016 -
C:\Windows\SysWOW64\wqfvfmqg.exe"C:\Windows\system32\wqfvfmqg.exe"76⤵PID:4396
-
C:\Windows\SysWOW64\whckm.exe"C:\Windows\system32\whckm.exe"77⤵PID:4248
-
C:\Windows\SysWOW64\wdxvlhaal.exe"C:\Windows\system32\wdxvlhaal.exe"78⤵PID:3632
-
C:\Windows\SysWOW64\wtft.exe"C:\Windows\system32\wtft.exe"79⤵
- Drops file in System32 directory
PID:3324 -
C:\Windows\SysWOW64\wlkksja.exe"C:\Windows\system32\wlkksja.exe"80⤵PID:4352
-
C:\Windows\SysWOW64\wtvuko.exe"C:\Windows\system32\wtvuko.exe"81⤵PID:4812
-
C:\Windows\SysWOW64\wiidtka.exe"C:\Windows\system32\wiidtka.exe"82⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1700 -
C:\Windows\SysWOW64\wlurtx.exe"C:\Windows\system32\wlurtx.exe"83⤵PID:2464
-
C:\Windows\SysWOW64\wlikctkh.exe"C:\Windows\system32\wlikctkh.exe"84⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1188 -
C:\Windows\SysWOW64\wxfsb.exe"C:\Windows\system32\wxfsb.exe"85⤵
- Checks computer location settings
PID:4248 -
C:\Windows\SysWOW64\wriel.exe"C:\Windows\system32\wriel.exe"86⤵
- Drops file in System32 directory
PID:4044 -
C:\Windows\SysWOW64\wbgal.exe"C:\Windows\system32\wbgal.exe"87⤵
- Drops file in System32 directory
PID:1884 -
C:\Windows\SysWOW64\wuim.exe"C:\Windows\system32\wuim.exe"88⤵
- Checks computer location settings
- Drops file in System32 directory
PID:3372 -
C:\Windows\SysWOW64\wjgfld.exe"C:\Windows\system32\wjgfld.exe"89⤵PID:3044
-
C:\Windows\SysWOW64\wnsun.exe"C:\Windows\system32\wnsun.exe"90⤵
- Checks computer location settings
PID:4320 -
C:\Windows\SysWOW64\wovdpl.exe"C:\Windows\system32\wovdpl.exe"91⤵
- Checks computer location settings
PID:2352 -
C:\Windows\SysWOW64\wijyh.exe"C:\Windows\system32\wijyh.exe"92⤵
- Drops file in System32 directory
PID:4228 -
C:\Windows\SysWOW64\wdcgucun.exe"C:\Windows\system32\wdcgucun.exe"93⤵PID:4648
-
C:\Windows\SysWOW64\wcf.exe"C:\Windows\system32\wcf.exe"94⤵
- Checks computer location settings
PID:3012 -
C:\Windows\SysWOW64\wxiopxel.exe"C:\Windows\system32\wxiopxel.exe"95⤵PID:4696
-
C:\Windows\SysWOW64\wxthy.exe"C:\Windows\system32\wxthy.exe"96⤵PID:1828
-
C:\Windows\SysWOW64\whitq.exe"C:\Windows\system32\whitq.exe"97⤵
- Checks computer location settings
PID:4356 -
C:\Windows\SysWOW64\wmthqlm.exe"C:\Windows\system32\wmthqlm.exe"98⤵PID:1424
-
C:\Windows\SysWOW64\wxgqyjoq.exe"C:\Windows\system32\wxgqyjoq.exe"99⤵PID:2304
-
C:\Windows\SysWOW64\wpl.exe"C:\Windows\system32\wpl.exe"100⤵
- Drops file in System32 directory
PID:2580 -
C:\Windows\SysWOW64\wmnsfyo.exe"C:\Windows\system32\wmnsfyo.exe"101⤵PID:3068
-
C:\Windows\SysWOW64\whc.exe"C:\Windows\system32\whc.exe"102⤵
- Checks computer location settings
- Drops file in System32 directory
PID:1428 -
C:\Windows\SysWOW64\wyxdds.exe"C:\Windows\system32\wyxdds.exe"103⤵PID:4588
-
C:\Windows\SysWOW64\wtbqov.exe"C:\Windows\system32\wtbqov.exe"104⤵PID:4396
-
C:\Windows\SysWOW64\wueyrra.exe"C:\Windows\system32\wueyrra.exe"105⤵
- Drops file in System32 directory
PID:2236 -
C:\Windows\SysWOW64\wdbtqxi.exe"C:\Windows\system32\wdbtqxi.exe"106⤵PID:4516
-
C:\Windows\SysWOW64\wdooa.exe"C:\Windows\system32\wdooa.exe"107⤵
- Checks computer location settings
PID:2092 -
C:\Windows\SysWOW64\wpmfop.exe"C:\Windows\system32\wpmfop.exe"108⤵PID:4192
-
C:\Windows\SysWOW64\wheldcxv.exe"C:\Windows\system32\wheldcxv.exe"109⤵
- Checks computer location settings
PID:1408 -
C:\Windows\SysWOW64\wpch.exe"C:\Windows\system32\wpch.exe"110⤵PID:4968
-
C:\Windows\SysWOW64\wvtywlmjg.exe"C:\Windows\system32\wvtywlmjg.exe"111⤵
- Checks computer location settings
PID:4264 -
C:\Windows\SysWOW64\wjasahh.exe"C:\Windows\system32\wjasahh.exe"112⤵
- Drops file in System32 directory
PID:2380 -
C:\Windows\SysWOW64\wwwkpesr.exe"C:\Windows\system32\wwwkpesr.exe"113⤵
- Drops file in System32 directory
PID:5112 -
C:\Windows\SysWOW64\wwyss.exe"C:\Windows\system32\wwyss.exe"114⤵
- Drops file in System32 directory
PID:1452 -
C:\Windows\SysWOW64\waxrynfp.exe"C:\Windows\system32\waxrynfp.exe"115⤵
- Checks computer location settings
PID:1096 -
C:\Windows\SysWOW64\waaccikfv.exe"C:\Windows\system32\waaccikfv.exe"116⤵
- Drops file in System32 directory
PID:3236 -
C:\Windows\SysWOW64\wadkef.exe"C:\Windows\system32\wadkef.exe"117⤵PID:3076
-
C:\Windows\SysWOW64\wryy.exe"C:\Windows\system32\wryy.exe"118⤵
- Drops file in System32 directory
PID:4356 -
C:\Windows\SysWOW64\wnftpakd.exe"C:\Windows\system32\wnftpakd.exe"119⤵PID:2524
-
C:\Windows\SysWOW64\wyckf.exe"C:\Windows\system32\wyckf.exe"120⤵PID:3056
-
C:\Windows\SysWOW64\wipwwdtat.exe"C:\Windows\system32\wipwwdtat.exe"121⤵
- Drops file in System32 directory
PID:4948 -
C:\Windows\SysWOW64\wsef.exe"C:\Windows\system32\wsef.exe"122⤵PID:2292
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-