Analysis
- max time kernel
152s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 00:58
Behavioral task
behavioral1
Sample
652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe
Resource
win7-20240221-en
6 signatures
150 seconds
General
- Target 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe
- Size 464KB
- Sample240518-bbg7yscc4x
- SHA256 7ba6e366baa2b94fa08942d82f75ab900964be3a90b5ab82726245da1e190b87
- MD5 652a714169341d3ca92b741068ae73b0
- SHA1 18668e9b9bf28586ac96e0b71927033879529f10
- SHA512 2a0bdc5e58c3022911a964719d01275247190222505edd0572971b41d9867b50ebfcfd4dd9e7cab631f13ab107de061a949af3e5a3751ce5751e828c77292ac1
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VB:VeR0oykayRFp3lztP+OKaf1VB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral2/memory/2696-6-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3408-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/448-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3132-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2228-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4544-35-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2636-51-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3836-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1612-64-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2076-75-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4904-81-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5040-87-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2040-93-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2924-99-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3152-105-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4632-111-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3956-120-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5060-117-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1980-135-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3412-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1860-152-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/940-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2236-181-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2432-190-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2112-202-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3788-205-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2228-215-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4944-223-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2928-234-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/892-243-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4876-256-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3008-263-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4652-276-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3416-289-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/928-293-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2092-297-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3012-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1104-311-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4936-334-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5024-356-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2036-372-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2656-379-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1364-417-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/400-427-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3444-438-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3688-442-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3296-449-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1732-459-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1228-469-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3084-476-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4716-492-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1768-497-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3120-516-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/208-529-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4596-545-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1256-552-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3860-568-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1460-668-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4104-687-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4548-712-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2268-859-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/2696-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000f000000023253-3.dat family_berbew behavioral2/memory/2696-6-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0008000000023261-9.dat family_berbew behavioral2/memory/3408-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/448-14-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0008000000023263-11.dat family_berbew behavioral2/memory/3132-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023264-22.dat family_berbew behavioral2/files/0x0007000000023265-26.dat family_berbew behavioral2/memory/2228-29-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4544-35-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023266-33.dat family_berbew behavioral2/files/0x0007000000023267-39.dat family_berbew behavioral2/files/0x0007000000023268-44.dat family_berbew behavioral2/files/0x0007000000023269-49.dat family_berbew behavioral2/memory/2636-51-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002326a-55.dat family_berbew behavioral2/memory/3836-59-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002326b-61.dat family_berbew behavioral2/memory/1612-64-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002326c-67.dat family_berbew behavioral2/files/0x000700000002326d-72.dat family_berbew behavioral2/memory/2076-75-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002326e-80.dat family_berbew behavioral2/memory/4904-81-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/5040-82-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002326f-85.dat family_berbew behavioral2/memory/5040-87-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023270-91.dat family_berbew behavioral2/memory/2040-93-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023271-97.dat family_berbew behavioral2/memory/2924-99-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3152-105-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023272-103.dat family_berbew behavioral2/files/0x0007000000023273-110.dat family_berbew behavioral2/memory/4632-111-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023274-115.dat family_berbew behavioral2/memory/3956-120-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/5060-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023275-122.dat family_berbew behavioral2/files/0x0007000000023276-128.dat family_berbew behavioral2/memory/1980-130-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023277-134.dat family_berbew behavioral2/memory/1980-135-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023278-139.dat family_berbew behavioral2/memory/3412-142-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023279-145.dat family_berbew behavioral2/memory/1860-152-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002327a-150.dat family_berbew behavioral2/files/0x000700000002327b-156.dat family_berbew behavioral2/memory/940-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002327d-162.dat family_berbew behavioral2/files/0x000700000002327e-167.dat family_berbew behavioral2/files/0x000700000002327f-172.dat family_berbew behavioral2/files/0x0007000000023280-177.dat family_berbew behavioral2/memory/2236-181-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023281-182.dat family_berbew behavioral2/memory/2432-190-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2112-202-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3788-205-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2228-215-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4944-219-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4944-223-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 3408 l0atp.exe 448 5b80x4.exe 3132 u217s41.exe 2228 52h2x5n.exe 4544 7h235m.exe 4224 w8hu3.exe 4272 d9dp43.exe 2636 6v9bbi.exe 3820 tr3ge.exe 3836 87ui3i.exe 1612 6217a.exe 2076 dqtua.exe 4904 8fo97a.exe 5040 h416t.exe 2040 ms83p.exe 2924 a389b.exe 3152 d077ix.exe 4632 v9s4837.exe 5060 h4a8r4.exe 3956 qk3393.exe 3572 21j291.exe 1980 hx3qc.exe 3412 53g8n9.exe 2948 1j2398e.exe 1860 mafmh.exe 940 bo7v365.exe 4928 v4dh8.exe 4380 7a1qm.exe 5032 oif30.exe 2364 35sv1i.exe 2236 v38h1.exe 4992 qug50k.exe 2432 049bhf.exe 3028 m62ls.exe 2696 r2q84d2.exe 2112 fnolm9.exe 3788 pvgk7i3.exe 448 76dpv.exe 4868 t9hu1i.exe 2228 c5sv4.exe 3336 37hb31.exe 4944 0wgj0g.exe 224 fmec7.exe 1416 15140.exe 2636 hr9nv.exe 2928 pm0u3p.exe 3756 9gc8i7.exe 3836 rf110n.exe 892 dx765.exe 4320 p0ua1.exe 4332 47te3.exe 4876 181q5m9.exe 4136 9i26lo9.exe 3860 1453p.exe 3008 l67whqc.exe 3404 735e18.exe 1392 451w0.exe 4652 7931kt.exe 3800 q4dg0w.exe 5060 3gm2767.exe 3188 8vdho2.exe 3416 342xrm3.exe 928 48lo28.exe 2092 k1kwi61.exe -
resource yara_rule behavioral2/memory/2696-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000f000000023253-3.dat upx behavioral2/memory/2696-6-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0008000000023261-9.dat upx behavioral2/memory/3408-13-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/448-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0008000000023263-11.dat upx behavioral2/memory/3132-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023264-22.dat upx behavioral2/files/0x0007000000023265-26.dat upx behavioral2/memory/2228-29-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4544-35-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023266-33.dat upx behavioral2/files/0x0007000000023267-39.dat upx behavioral2/files/0x0007000000023268-44.dat upx behavioral2/files/0x0007000000023269-49.dat upx behavioral2/memory/2636-51-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002326a-55.dat upx behavioral2/memory/3836-59-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002326b-61.dat upx behavioral2/memory/1612-64-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002326c-67.dat upx behavioral2/files/0x000700000002326d-72.dat upx behavioral2/memory/2076-75-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002326e-80.dat upx behavioral2/memory/4904-81-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/5040-82-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002326f-85.dat upx behavioral2/memory/5040-87-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023270-91.dat upx behavioral2/memory/2040-93-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023271-97.dat upx behavioral2/memory/2924-99-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3152-105-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023272-103.dat upx behavioral2/files/0x0007000000023273-110.dat upx behavioral2/memory/4632-111-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023274-115.dat upx behavioral2/memory/3956-120-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/5060-117-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023275-122.dat upx behavioral2/files/0x0007000000023276-128.dat upx behavioral2/memory/1980-130-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023277-134.dat upx behavioral2/memory/1980-135-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023278-139.dat upx behavioral2/memory/3412-142-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023279-145.dat upx behavioral2/memory/1860-152-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002327a-150.dat upx behavioral2/files/0x000700000002327b-156.dat upx behavioral2/memory/940-158-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002327d-162.dat upx behavioral2/files/0x000700000002327e-167.dat upx behavioral2/files/0x000700000002327f-172.dat upx behavioral2/files/0x0007000000023280-177.dat upx behavioral2/memory/2236-181-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023281-182.dat upx behavioral2/memory/2432-190-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2112-202-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3788-205-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2228-215-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4944-219-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4944-223-0x0000000000400000-0x000000000043A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3408 2696 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 90 PID 2696 wrote to memory of 3408 2696 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 90 PID 2696 wrote to memory of 3408 2696 652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe 90 PID 3408 wrote to memory of 448 3408 l0atp.exe 91 PID 3408 wrote to memory of 448 3408 l0atp.exe 91 PID 3408 wrote to memory of 448 3408 l0atp.exe 91 PID 448 wrote to memory of 3132 448 5b80x4.exe 92 PID 448 wrote to memory of 3132 448 5b80x4.exe 92 PID 448 wrote to memory of 3132 448 5b80x4.exe 92 PID 3132 wrote to memory of 2228 3132 u217s41.exe 93 PID 3132 wrote to memory of 2228 3132 u217s41.exe 93 PID 3132 wrote to memory of 2228 3132 u217s41.exe 93 PID 2228 wrote to memory of 4544 2228 52h2x5n.exe 94 PID 2228 wrote to memory of 4544 2228 52h2x5n.exe 94 PID 2228 wrote to memory of 4544 2228 52h2x5n.exe 94 PID 4544 wrote to memory of 4224 4544 7h235m.exe 95 PID 4544 wrote to memory of 4224 4544 7h235m.exe 95 PID 4544 wrote to memory of 4224 4544 7h235m.exe 95 PID 4224 wrote to memory of 4272 4224 w8hu3.exe 96 PID 4224 wrote to memory of 4272 4224 w8hu3.exe 96 PID 4224 wrote to memory of 4272 4224 w8hu3.exe 96 PID 4272 wrote to memory of 2636 4272 d9dp43.exe 97 PID 4272 wrote to memory of 2636 4272 d9dp43.exe 97 PID 4272 wrote to memory of 2636 4272 d9dp43.exe 97 PID 2636 wrote to memory of 3820 2636 6v9bbi.exe 98 PID 2636 wrote to memory of 3820 2636 6v9bbi.exe 98 PID 2636 wrote to memory of 3820 2636 6v9bbi.exe 98 PID 3820 wrote to memory of 3836 3820 tr3ge.exe 99 PID 3820 wrote to memory of 3836 3820 tr3ge.exe 99 PID 3820 wrote to memory of 3836 3820 tr3ge.exe 99 PID 3836 wrote to memory of 1612 3836 87ui3i.exe 100 PID 3836 wrote to memory of 1612 3836 87ui3i.exe 100 PID 3836 wrote to memory of 1612 3836 87ui3i.exe 100 PID 1612 wrote to memory of 2076 1612 6217a.exe 101 PID 1612 wrote to memory of 2076 1612 6217a.exe 101 PID 1612 wrote to memory of 2076 1612 6217a.exe 101 PID 2076 wrote to memory of 4904 2076 dqtua.exe 102 PID 2076 wrote to memory of 4904 2076 dqtua.exe 102 PID 2076 wrote to memory of 4904 2076 dqtua.exe 102 PID 4904 wrote to memory of 5040 4904 8fo97a.exe 103 PID 4904 wrote to memory of 5040 4904 8fo97a.exe 103 PID 4904 wrote to memory of 5040 4904 8fo97a.exe 103 PID 5040 wrote to memory of 2040 5040 h416t.exe 104 PID 5040 wrote to memory of 2040 5040 h416t.exe 104 PID 5040 wrote to memory of 2040 5040 h416t.exe 104 PID 2040 wrote to memory of 2924 2040 ms83p.exe 105 PID 2040 wrote to memory of 2924 2040 ms83p.exe 105 PID 2040 wrote to memory of 2924 2040 ms83p.exe 105 PID 2924 wrote to memory of 3152 2924 a389b.exe 106 PID 2924 wrote to memory of 3152 2924 a389b.exe 106 PID 2924 wrote to memory of 3152 2924 a389b.exe 106 PID 3152 wrote to memory of 4632 3152 d077ix.exe 107 PID 3152 wrote to memory of 4632 3152 d077ix.exe 107 PID 3152 wrote to memory of 4632 3152 d077ix.exe 107 PID 4632 wrote to memory of 5060 4632 v9s4837.exe 108 PID 4632 wrote to memory of 5060 4632 v9s4837.exe 108 PID 4632 wrote to memory of 5060 4632 v9s4837.exe 108 PID 5060 wrote to memory of 3956 5060 h4a8r4.exe 109 PID 5060 wrote to memory of 3956 5060 h4a8r4.exe 109 PID 5060 wrote to memory of 3956 5060 h4a8r4.exe 109 PID 3956 wrote to memory of 3572 3956 qk3393.exe 110 PID 3956 wrote to memory of 3572 3956 qk3393.exe 110 PID 3956 wrote to memory of 3572 3956 qk3393.exe 110 PID 3572 wrote to memory of 1980 3572 21j291.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\652a714169341d3ca92b741068ae73b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\l0atp.exec:\l0atp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\5b80x4.exec:\5b80x4.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\u217s41.exec:\u217s41.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\52h2x5n.exec:\52h2x5n.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\7h235m.exec:\7h235m.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\w8hu3.exec:\w8hu3.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\d9dp43.exec:\d9dp43.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\6v9bbi.exec:\6v9bbi.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\tr3ge.exec:\tr3ge.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\87ui3i.exec:\87ui3i.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\6217a.exec:\6217a.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\dqtua.exec:\dqtua.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\8fo97a.exec:\8fo97a.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\h416t.exec:\h416t.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\ms83p.exec:\ms83p.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\a389b.exec:\a389b.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\d077ix.exec:\d077ix.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\v9s4837.exec:\v9s4837.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\h4a8r4.exec:\h4a8r4.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\qk3393.exec:\qk3393.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\21j291.exec:\21j291.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hx3qc.exec:\hx3qc.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\53g8n9.exec:\53g8n9.exe24⤵
- Executes dropped EXE
PID:3412 -
\??\c:\1j2398e.exec:\1j2398e.exe25⤵
- Executes dropped EXE
PID:2948 -
\??\c:\mafmh.exec:\mafmh.exe26⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bo7v365.exec:\bo7v365.exe27⤵
- Executes dropped EXE
PID:940 -
\??\c:\v4dh8.exec:\v4dh8.exe28⤵
- Executes dropped EXE
PID:4928 -
\??\c:\7a1qm.exec:\7a1qm.exe29⤵
- Executes dropped EXE
PID:4380 -
\??\c:\oif30.exec:\oif30.exe30⤵
- Executes dropped EXE
PID:5032 -
\??\c:\35sv1i.exec:\35sv1i.exe31⤵
- Executes dropped EXE
PID:2364 -
\??\c:\v38h1.exec:\v38h1.exe32⤵
- Executes dropped EXE
PID:2236 -
\??\c:\qug50k.exec:\qug50k.exe33⤵
- Executes dropped EXE
PID:4992 -
\??\c:\049bhf.exec:\049bhf.exe34⤵
- Executes dropped EXE
PID:2432 -
\??\c:\m62ls.exec:\m62ls.exe35⤵
- Executes dropped EXE
PID:3028 -
\??\c:\r2q84d2.exec:\r2q84d2.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\fnolm9.exec:\fnolm9.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\pvgk7i3.exec:\pvgk7i3.exe38⤵
- Executes dropped EXE
PID:3788 -
\??\c:\76dpv.exec:\76dpv.exe39⤵
- Executes dropped EXE
PID:448 -
\??\c:\t9hu1i.exec:\t9hu1i.exe40⤵
- Executes dropped EXE
PID:4868 -
\??\c:\c5sv4.exec:\c5sv4.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\37hb31.exec:\37hb31.exe42⤵
- Executes dropped EXE
PID:3336 -
\??\c:\0wgj0g.exec:\0wgj0g.exe43⤵
- Executes dropped EXE
PID:4944 -
\??\c:\fmec7.exec:\fmec7.exe44⤵
- Executes dropped EXE
PID:224 -
\??\c:\15140.exec:\15140.exe45⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hr9nv.exec:\hr9nv.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pm0u3p.exec:\pm0u3p.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9gc8i7.exec:\9gc8i7.exe48⤵
- Executes dropped EXE
PID:3756 -
\??\c:\rf110n.exec:\rf110n.exe49⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dx765.exec:\dx765.exe50⤵
- Executes dropped EXE
PID:892 -
\??\c:\p0ua1.exec:\p0ua1.exe51⤵
- Executes dropped EXE
PID:4320 -
\??\c:\47te3.exec:\47te3.exe52⤵
- Executes dropped EXE
PID:4332 -
\??\c:\181q5m9.exec:\181q5m9.exe53⤵
- Executes dropped EXE
PID:4876 -
\??\c:\9i26lo9.exec:\9i26lo9.exe54⤵
- Executes dropped EXE
PID:4136 -
\??\c:\1453p.exec:\1453p.exe55⤵
- Executes dropped EXE
PID:3860 -
\??\c:\l67whqc.exec:\l67whqc.exe56⤵
- Executes dropped EXE
PID:3008 -
\??\c:\735e18.exec:\735e18.exe57⤵
- Executes dropped EXE
PID:3404 -
\??\c:\451w0.exec:\451w0.exe58⤵
- Executes dropped EXE
PID:1392 -
\??\c:\7931kt.exec:\7931kt.exe59⤵
- Executes dropped EXE
PID:4652 -
\??\c:\q4dg0w.exec:\q4dg0w.exe60⤵
- Executes dropped EXE
PID:3800 -
\??\c:\3gm2767.exec:\3gm2767.exe61⤵
- Executes dropped EXE
PID:5060 -
\??\c:\8vdho2.exec:\8vdho2.exe62⤵
- Executes dropped EXE
PID:3188 -
\??\c:\342xrm3.exec:\342xrm3.exe63⤵
- Executes dropped EXE
PID:3416 -
\??\c:\48lo28.exec:\48lo28.exe64⤵
- Executes dropped EXE
PID:928 -
\??\c:\k1kwi61.exec:\k1kwi61.exe65⤵
- Executes dropped EXE
PID:2092 -
\??\c:\qsg3h5.exec:\qsg3h5.exe66⤵PID:1508
-
\??\c:\blexj0.exec:\blexj0.exe67⤵PID:3012
-
\??\c:\2he344.exec:\2he344.exe68⤵PID:4120
-
\??\c:\09jo8p.exec:\09jo8p.exe69⤵PID:1104
-
\??\c:\5a67uuu.exec:\5a67uuu.exe70⤵PID:1092
-
\??\c:\0p89bh.exec:\0p89bh.exe71⤵PID:3856
-
\??\c:\8nqxmk5.exec:\8nqxmk5.exe72⤵PID:3104
-
\??\c:\e3578.exec:\e3578.exe73⤵PID:556
-
\??\c:\0u92735.exec:\0u92735.exe74⤵PID:2268
-
\??\c:\ko701h.exec:\ko701h.exe75⤵PID:2712
-
\??\c:\4i02ui.exec:\4i02ui.exe76⤵PID:4936
-
\??\c:\19bem9h.exec:\19bem9h.exe77⤵PID:1540
-
\??\c:\1817d.exec:\1817d.exe78⤵PID:1156
-
\??\c:\k0okwt6.exec:\k0okwt6.exe79⤵PID:4992
-
\??\c:\5s33707.exec:\5s33707.exe80⤵PID:2432
-
\??\c:\m0utn49.exec:\m0utn49.exe81⤵PID:2260
-
\??\c:\rglx758.exec:\rglx758.exe82⤵PID:2696
-
\??\c:\t5vcg.exec:\t5vcg.exe83⤵PID:5024
-
\??\c:\0k25g8.exec:\0k25g8.exe84⤵PID:4308
-
\??\c:\4u7ico.exec:\4u7ico.exe85⤵PID:3132
-
\??\c:\6639cn.exec:\6639cn.exe86⤵PID:3704
-
\??\c:\07l7t.exec:\07l7t.exe87⤵PID:4544
-
\??\c:\dpnll1.exec:\dpnll1.exe88⤵PID:2036
-
\??\c:\63x72o.exec:\63x72o.exe89⤵PID:4944
-
\??\c:\eqkbn.exec:\eqkbn.exe90⤵PID:2656
-
\??\c:\tpto7o.exec:\tpto7o.exe91⤵PID:1416
-
\??\c:\nqw3i3g.exec:\nqw3i3g.exe92⤵PID:4620
-
\??\c:\9ills9.exec:\9ills9.exe93⤵PID:964
-
\??\c:\w72579.exec:\w72579.exe94⤵PID:3756
-
\??\c:\3cc3s93.exec:\3cc3s93.exe95⤵PID:1524
-
\??\c:\rr719.exec:\rr719.exe96⤵PID:1676
-
\??\c:\pvsg549.exec:\pvsg549.exe97⤵PID:4320
-
\??\c:\008254.exec:\008254.exe98⤵PID:2816
-
\??\c:\a5h501.exec:\a5h501.exe99⤵PID:2584
-
\??\c:\25hw0w9.exec:\25hw0w9.exe100⤵PID:4044
-
\??\c:\124shu.exec:\124shu.exe101⤵PID:2040
-
\??\c:\4tm4l7a.exec:\4tm4l7a.exe102⤵PID:1364
-
\??\c:\6crg438.exec:\6crg438.exe103⤵PID:3008
-
\??\c:\001p8.exec:\001p8.exe104⤵PID:3152
-
\??\c:\833dk.exec:\833dk.exe105⤵PID:400
-
\??\c:\81e176.exec:\81e176.exe106⤵PID:4548
-
\??\c:\9398s.exec:\9398s.exe107⤵PID:3292
-
\??\c:\80220.exec:\80220.exe108⤵PID:3444
-
\??\c:\6h32c.exec:\6h32c.exe109⤵PID:3688
-
\??\c:\9csbn.exec:\9csbn.exe110⤵PID:4812
-
\??\c:\886uxpx.exec:\886uxpx.exe111⤵PID:3296
-
\??\c:\bnc86g.exec:\bnc86g.exe112⤵PID:4164
-
\??\c:\u9o68r7.exec:\u9o68r7.exe113⤵PID:824
-
\??\c:\ucjax.exec:\ucjax.exe114⤵PID:1732
-
\??\c:\5f7ulcs.exec:\5f7ulcs.exe115⤵PID:3156
-
\??\c:\dj04974.exec:\dj04974.exe116⤵PID:1036
-
\??\c:\b489i.exec:\b489i.exe117⤵PID:1228
-
\??\c:\2444ij6.exec:\2444ij6.exe118⤵PID:4404
-
\??\c:\lmi7s15.exec:\lmi7s15.exe119⤵PID:3084
-
\??\c:\h95l0.exec:\h95l0.exe120⤵PID:5088
-
\??\c:\762ul4.exec:\762ul4.exe121⤵PID:3392
-
\??\c:\tbebf.exec:\tbebf.exe122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-