Analysis
- max time kernel
150s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 04:49
Behavioral task
behavioral1
Sample
90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target 90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe
- Size 456KB
- Sample240518-ff72dsce6z
- SHA256 6e98902ac0c0ceedc7ad1d89965bd52be0dfdaa1edae360aea981e8cb2936a26
- MD5 90ada90505b4ad2e4dfaa185f56db110
- SHA1 c7cda6a842fc55ec1265e38b896e1bc72c9eb2d4
- SHA512 dd39c9b42ba1cd0927c308e27b0eaa80eb103d33f8032cc8e40d71a09917f00774d56546b40c7f71f081a6932f476a408d9a9667cb3c0d6b4472d43e97fd00c0
- SSDEEP 12288:04wFHoSyd0V3eFp3IDvSbh5nPYERM8mXzplo4MJ:rd0gFp3lz1/uzploB
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2216-6-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2168-8-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4672-25-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3232-19-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5064-14-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3136-32-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3104-43-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4416-52-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2100-59-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4004-61-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1536-71-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2528-73-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3348-85-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2716-104-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4880-78-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1856-115-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2052-117-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5096-124-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1088-130-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4736-139-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4116-142-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2256-152-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3252-162-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3740-185-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2164-184-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5016-188-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5080-195-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3576-199-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4588-210-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4780-218-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4052-224-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3268-243-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3104-250-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1168-257-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/456-263-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1220-267-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1220-271-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4404-281-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1416-286-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4648-298-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4824-330-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1720-345-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5052-352-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1496-398-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1536-409-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4664-422-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2284-450-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4860-469-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5080-489-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3100-497-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4416-529-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4004-538-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2032-543-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5012-549-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4560-559-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/3088-563-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4116-596-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/2100-676-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1376-749-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/884-786-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/5000-817-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4956-893-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/4452-927-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon behavioral2/memory/1496-967-0x0000000000400000-0x0000000000438000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/2216-0-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2216-6-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000900000002340c-4.dat family_berbew behavioral2/files/0x0007000000023413-11.dat family_berbew behavioral2/memory/2168-8-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023415-22.dat family_berbew behavioral2/memory/4672-25-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3232-19-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023414-13.dat family_berbew behavioral2/memory/5064-14-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023416-29.dat family_berbew behavioral2/memory/3136-32-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023417-35.dat family_berbew behavioral2/memory/3268-37-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023418-40.dat family_berbew behavioral2/memory/3104-43-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341a-46.dat family_berbew behavioral2/files/0x000700000002341b-51.dat family_berbew behavioral2/memory/4416-52-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341c-56.dat family_berbew behavioral2/files/0x000700000002341d-63.dat family_berbew behavioral2/memory/2100-59-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4004-61-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341e-69.dat family_berbew behavioral2/memory/1536-71-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2528-73-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002341f-76.dat family_berbew behavioral2/memory/3348-85-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023420-82.dat family_berbew behavioral2/files/0x0007000000023421-88.dat family_berbew behavioral2/files/0x0008000000023410-92.dat family_berbew behavioral2/files/0x0007000000023422-97.dat family_berbew behavioral2/memory/2716-104-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023424-109.dat family_berbew behavioral2/files/0x0007000000023423-103.dat family_berbew behavioral2/memory/4880-78-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023425-113.dat family_berbew behavioral2/memory/1856-115-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2052-117-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023426-120.dat family_berbew behavioral2/memory/5096-124-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023427-127.dat family_berbew behavioral2/memory/1088-130-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023428-133.dat family_berbew behavioral2/memory/4736-139-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x0007000000023429-137.dat family_berbew behavioral2/memory/4116-142-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002342a-145.dat family_berbew behavioral2/files/0x000700000002342b-150.dat family_berbew behavioral2/memory/2256-152-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002342c-154.dat family_berbew behavioral2/files/0x000700000002342d-160.dat family_berbew behavioral2/memory/3252-162-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/files/0x000700000002342e-166.dat family_berbew behavioral2/files/0x000700000002342f-171.dat family_berbew behavioral2/files/0x0007000000023430-176.dat family_berbew behavioral2/files/0x0007000000023431-181.dat family_berbew behavioral2/memory/3740-185-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/2164-184-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/5016-188-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/5080-195-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/3576-199-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4280-203-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew behavioral2/memory/4588-210-0x0000000000400000-0x0000000000438000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 2168 lllfrxr.exe 5064 rflfxxf.exe 3232 bhtttt.exe 4672 jvdvv.exe 3136 fflffxr.exe 3268 3vvjd.exe 3104 pjpvj.exe 4416 hhhbbt.exe 2100 ddvvp.exe 4004 frxxlxf.exe 1536 vdvjv.exe 2528 rxlfrrf.exe 4880 hnbbbb.exe 3348 htbtnn.exe 2860 bhnthn.exe 2632 xlxfffx.exe 1816 xlrlfxx.exe 2716 jppdv.exe 1856 rllffrr.exe 2052 3hntbb.exe 5096 fxrlffx.exe 1088 xlfxrrl.exe 4736 frrlxxl.exe 4116 nnnnhh.exe 4196 9dpvj.exe 2256 nhtttt.exe 3252 hbnhnn.exe 1880 pdjdv.exe 4164 lfflxrf.exe 2424 dvdvd.exe 2164 hbnhhh.exe 3740 9rfrfxr.exe 5016 htnhbt.exe 5080 7llfxrl.exe 924 tbthbh.exe 3576 vjdvv.exe 4280 lrllllr.exe 220 ttbtnn.exe 4588 tbhbhh.exe 4540 pvdjp.exe 4780 flfxxxf.exe 4068 nhhbtt.exe 4052 9pvpj.exe 656 xrlffff.exe 3968 tnbnhh.exe 3448 pvdvp.exe 3196 djpvp.exe 3268 lrxlfxr.exe 4124 7hnhbt.exe 3104 pdpjd.exe 1468 7dvpj.exe 1168 3rlfrrr.exe 3452 hnnhbb.exe 456 xlfxrfx.exe 1020 frfxxrx.exe 1220 nbbtnn.exe 4880 jpvvp.exe 3524 3lfxrrr.exe 4404 nttttb.exe 1592 vjjjj.exe 1416 llxfxxx.exe 5104 9ntnbb.exe 4640 htbnnb.exe 4648 vdjdv.exe -
resource yara_rule behavioral2/memory/2216-0-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2216-6-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000900000002340c-4.dat upx behavioral2/files/0x0007000000023413-11.dat upx behavioral2/memory/2168-8-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023415-22.dat upx behavioral2/memory/4672-25-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3232-19-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023414-13.dat upx behavioral2/memory/5064-14-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023416-29.dat upx behavioral2/memory/3136-32-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023417-35.dat upx behavioral2/memory/3268-37-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023418-40.dat upx behavioral2/memory/3104-43-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341a-46.dat upx behavioral2/files/0x000700000002341b-51.dat upx behavioral2/memory/4416-52-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341c-56.dat upx behavioral2/files/0x000700000002341d-63.dat upx behavioral2/memory/2100-59-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4004-61-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341e-69.dat upx behavioral2/memory/1536-71-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2528-73-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002341f-76.dat upx behavioral2/memory/3348-85-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023420-82.dat upx behavioral2/files/0x0007000000023421-88.dat upx behavioral2/files/0x0008000000023410-92.dat upx behavioral2/files/0x0007000000023422-97.dat upx behavioral2/memory/2716-104-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023424-109.dat upx behavioral2/files/0x0007000000023423-103.dat upx behavioral2/memory/4880-78-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023425-113.dat upx behavioral2/memory/1856-115-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2052-117-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023426-120.dat upx behavioral2/memory/5096-124-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023427-127.dat upx behavioral2/memory/1088-130-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023428-133.dat upx behavioral2/memory/4736-139-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x0007000000023429-137.dat upx behavioral2/memory/4116-142-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002342a-145.dat upx behavioral2/files/0x000700000002342b-150.dat upx behavioral2/memory/2256-152-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002342c-154.dat upx behavioral2/files/0x000700000002342d-160.dat upx behavioral2/memory/3252-162-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/files/0x000700000002342e-166.dat upx behavioral2/files/0x000700000002342f-171.dat upx behavioral2/files/0x0007000000023430-176.dat upx behavioral2/files/0x0007000000023431-181.dat upx behavioral2/memory/3740-185-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/2164-184-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/5016-188-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/5080-195-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/3576-199-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4280-203-0x0000000000400000-0x0000000000438000-memory.dmp upx behavioral2/memory/4588-210-0x0000000000400000-0x0000000000438000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2168 2216 90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe 82 PID 2216 wrote to memory of 2168 2216 90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe 82 PID 2216 wrote to memory of 2168 2216 90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe 82 PID 2168 wrote to memory of 5064 2168 lllfrxr.exe 83 PID 2168 wrote to memory of 5064 2168 lllfrxr.exe 83 PID 2168 wrote to memory of 5064 2168 lllfrxr.exe 83 PID 5064 wrote to memory of 3232 5064 rflfxxf.exe 84 PID 5064 wrote to memory of 3232 5064 rflfxxf.exe 84 PID 5064 wrote to memory of 3232 5064 rflfxxf.exe 84 PID 3232 wrote to memory of 4672 3232 bhtttt.exe 85 PID 3232 wrote to memory of 4672 3232 bhtttt.exe 85 PID 3232 wrote to memory of 4672 3232 bhtttt.exe 85 PID 4672 wrote to memory of 3136 4672 jvdvv.exe 86 PID 4672 wrote to memory of 3136 4672 jvdvv.exe 86 PID 4672 wrote to memory of 3136 4672 jvdvv.exe 86 PID 3136 wrote to memory of 3268 3136 fflffxr.exe 87 PID 3136 wrote to memory of 3268 3136 fflffxr.exe 87 PID 3136 wrote to memory of 3268 3136 fflffxr.exe 87 PID 3268 wrote to memory of 3104 3268 3vvjd.exe 88 PID 3268 wrote to memory of 3104 3268 3vvjd.exe 88 PID 3268 wrote to memory of 3104 3268 3vvjd.exe 88 PID 3104 wrote to memory of 4416 3104 pjpvj.exe 89 PID 3104 wrote to memory of 4416 3104 pjpvj.exe 89 PID 3104 wrote to memory of 4416 3104 pjpvj.exe 89 PID 4416 wrote to memory of 2100 4416 hhhbbt.exe 90 PID 4416 wrote to memory of 2100 4416 hhhbbt.exe 90 PID 4416 wrote to memory of 2100 4416 hhhbbt.exe 90 PID 2100 wrote to memory of 4004 2100 ddvvp.exe 91 PID 2100 wrote to memory of 4004 2100 ddvvp.exe 91 PID 2100 wrote to memory of 4004 2100 ddvvp.exe 91 PID 4004 wrote to memory of 1536 4004 frxxlxf.exe 92 PID 4004 wrote to memory of 1536 4004 frxxlxf.exe 92 PID 4004 wrote to memory of 1536 4004 frxxlxf.exe 92 PID 1536 wrote to memory of 2528 1536 vdvjv.exe 93 PID 1536 wrote to memory of 2528 1536 vdvjv.exe 93 PID 1536 wrote to memory of 2528 1536 vdvjv.exe 93 PID 2528 wrote to memory of 4880 2528 rxlfrrf.exe 94 PID 2528 wrote to memory of 4880 2528 rxlfrrf.exe 94 PID 2528 wrote to memory of 4880 2528 rxlfrrf.exe 94 PID 4880 wrote to memory of 3348 4880 hnbbbb.exe 96 PID 4880 wrote to memory of 3348 4880 hnbbbb.exe 96 PID 4880 wrote to memory of 3348 4880 hnbbbb.exe 96 PID 3348 wrote to memory of 2860 3348 htbtnn.exe 97 PID 3348 wrote to memory of 2860 3348 htbtnn.exe 97 PID 3348 wrote to memory of 2860 3348 htbtnn.exe 97 PID 2860 wrote to memory of 2632 2860 bhnthn.exe 98 PID 2860 wrote to memory of 2632 2860 bhnthn.exe 98 PID 2860 wrote to memory of 2632 2860 bhnthn.exe 98 PID 2632 wrote to memory of 1816 2632 xlxfffx.exe 99 PID 2632 wrote to memory of 1816 2632 xlxfffx.exe 99 PID 2632 wrote to memory of 1816 2632 xlxfffx.exe 99 PID 1816 wrote to memory of 2716 1816 xlrlfxx.exe 100 PID 1816 wrote to memory of 2716 1816 xlrlfxx.exe 100 PID 1816 wrote to memory of 2716 1816 xlrlfxx.exe 100 PID 2716 wrote to memory of 1856 2716 jppdv.exe 101 PID 2716 wrote to memory of 1856 2716 jppdv.exe 101 PID 2716 wrote to memory of 1856 2716 jppdv.exe 101 PID 1856 wrote to memory of 2052 1856 rllffrr.exe 102 PID 1856 wrote to memory of 2052 1856 rllffrr.exe 102 PID 1856 wrote to memory of 2052 1856 rllffrr.exe 102 PID 2052 wrote to memory of 5096 2052 3hntbb.exe 103 PID 2052 wrote to memory of 5096 2052 3hntbb.exe 103 PID 2052 wrote to memory of 5096 2052 3hntbb.exe 103 PID 5096 wrote to memory of 1088 5096 fxrlffx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\90ada90505b4ad2e4dfaa185f56db110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\lllfrxr.exec:\lllfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rflfxxf.exec:\rflfxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\bhtttt.exec:\bhtttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\jvdvv.exec:\jvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\fflffxr.exec:\fflffxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\3vvjd.exec:\3vvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\pjpvj.exec:\pjpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\hhhbbt.exec:\hhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ddvvp.exec:\ddvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\frxxlxf.exec:\frxxlxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\vdvjv.exec:\vdvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\hnbbbb.exec:\hnbbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\htbtnn.exec:\htbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\bhnthn.exec:\bhnthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xlxfffx.exec:\xlxfffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jppdv.exec:\jppdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rllffrr.exec:\rllffrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\3hntbb.exec:\3hntbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fxrlffx.exec:\fxrlffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\frrlxxl.exec:\frrlxxl.exe24⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nnnnhh.exec:\nnnnhh.exe25⤵
- Executes dropped EXE
PID:4116 -
\??\c:\9dpvj.exec:\9dpvj.exe26⤵
- Executes dropped EXE
PID:4196 -
\??\c:\nhtttt.exec:\nhtttt.exe27⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbnhnn.exec:\hbnhnn.exe28⤵
- Executes dropped EXE
PID:3252 -
\??\c:\pdjdv.exec:\pdjdv.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\lfflxrf.exec:\lfflxrf.exe30⤵
- Executes dropped EXE
PID:4164 -
\??\c:\dvdvd.exec:\dvdvd.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hbnhhh.exec:\hbnhhh.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9rfrfxr.exec:\9rfrfxr.exe33⤵
- Executes dropped EXE
PID:3740 -
\??\c:\htnhbt.exec:\htnhbt.exe34⤵
- Executes dropped EXE
PID:5016 -
\??\c:\7llfxrl.exec:\7llfxrl.exe35⤵
- Executes dropped EXE
PID:5080 -
\??\c:\tbthbh.exec:\tbthbh.exe36⤵
- Executes dropped EXE
PID:924 -
\??\c:\vjdvv.exec:\vjdvv.exe37⤵
- Executes dropped EXE
PID:3576 -
\??\c:\lrllllr.exec:\lrllllr.exe38⤵
- Executes dropped EXE
PID:4280 -
\??\c:\ttbtnn.exec:\ttbtnn.exe39⤵
- Executes dropped EXE
PID:220 -
\??\c:\tbhbhh.exec:\tbhbhh.exe40⤵
- Executes dropped EXE
PID:4588 -
\??\c:\pvdjp.exec:\pvdjp.exe41⤵
- Executes dropped EXE
PID:4540 -
\??\c:\flfxxxf.exec:\flfxxxf.exe42⤵
- Executes dropped EXE
PID:4780 -
\??\c:\nhhbtt.exec:\nhhbtt.exe43⤵
- Executes dropped EXE
PID:4068 -
\??\c:\9pvpj.exec:\9pvpj.exe44⤵
- Executes dropped EXE
PID:4052 -
\??\c:\xrlffff.exec:\xrlffff.exe45⤵
- Executes dropped EXE
PID:656 -
\??\c:\tnbnhh.exec:\tnbnhh.exe46⤵
- Executes dropped EXE
PID:3968 -
\??\c:\pvdvp.exec:\pvdvp.exe47⤵
- Executes dropped EXE
PID:3448 -
\??\c:\djpvp.exec:\djpvp.exe48⤵
- Executes dropped EXE
PID:3196 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe49⤵
- Executes dropped EXE
PID:3268 -
\??\c:\7hnhbt.exec:\7hnhbt.exe50⤵
- Executes dropped EXE
PID:4124 -
\??\c:\pdpjd.exec:\pdpjd.exe51⤵
- Executes dropped EXE
PID:3104 -
\??\c:\7dvpj.exec:\7dvpj.exe52⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3rlfrrr.exec:\3rlfrrr.exe53⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hnnhbb.exec:\hnnhbb.exe54⤵
- Executes dropped EXE
PID:3452 -
\??\c:\xlfxrfx.exec:\xlfxrfx.exe55⤵
- Executes dropped EXE
PID:456 -
\??\c:\frfxxrx.exec:\frfxxrx.exe56⤵
- Executes dropped EXE
PID:1020 -
\??\c:\nbbtnn.exec:\nbbtnn.exe57⤵
- Executes dropped EXE
PID:1220 -
\??\c:\jpvvp.exec:\jpvvp.exe58⤵
- Executes dropped EXE
PID:4880 -
\??\c:\3lfxrrr.exec:\3lfxrrr.exe59⤵
- Executes dropped EXE
PID:3524 -
\??\c:\nttttb.exec:\nttttb.exe60⤵
- Executes dropped EXE
PID:4404 -
\??\c:\vjjjj.exec:\vjjjj.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\llxfxxx.exec:\llxfxxx.exe62⤵
- Executes dropped EXE
PID:1416 -
\??\c:\9ntnbb.exec:\9ntnbb.exe63⤵
- Executes dropped EXE
PID:5104 -
\??\c:\htbnnb.exec:\htbnnb.exe64⤵
- Executes dropped EXE
PID:4640 -
\??\c:\vdjdv.exec:\vdjdv.exe65⤵
- Executes dropped EXE
PID:4648 -
\??\c:\rffxrrf.exec:\rffxrrf.exe66⤵PID:2052
-
\??\c:\nbbtnh.exec:\nbbtnh.exe67⤵PID:5096
-
\??\c:\hhnbnh.exec:\hhnbnh.exe68⤵PID:2896
-
\??\c:\3jddv.exec:\3jddv.exe69⤵PID:1724
-
\??\c:\fxlxrfx.exec:\fxlxrfx.exe70⤵PID:692
-
\??\c:\ffrfxxr.exec:\ffrfxxr.exe71⤵PID:4116
-
\??\c:\ntbnhb.exec:\ntbnhb.exe72⤵PID:3428
-
\??\c:\vddvp.exec:\vddvp.exe73⤵PID:4376
-
\??\c:\5fxrlll.exec:\5fxrlll.exe74⤵PID:2256
-
\??\c:\9xrfxxl.exec:\9xrfxxl.exe75⤵PID:2356
-
\??\c:\9bhhbb.exec:\9bhhbb.exe76⤵PID:4824
-
\??\c:\djjdp.exec:\djjdp.exe77⤵PID:2952
-
\??\c:\pvdvp.exec:\pvdvp.exe78⤵PID:436
-
\??\c:\llxxfxl.exec:\llxxfxl.exe79⤵PID:2148
-
\??\c:\nhnntt.exec:\nhnntt.exe80⤵PID:4600
-
\??\c:\1dvvp.exec:\1dvvp.exe81⤵PID:1720
-
\??\c:\jdvjd.exec:\jdvjd.exe82⤵PID:5052
-
\??\c:\xlffxxr.exec:\xlffxxr.exe83⤵PID:1576
-
\??\c:\1tbbtt.exec:\1tbbtt.exe84⤵PID:3148
-
\??\c:\lffxllf.exec:\lffxllf.exe85⤵PID:4588
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe86⤵PID:4444
-
\??\c:\thnbtn.exec:\thnbtn.exe87⤵PID:4780
-
\??\c:\vpjdv.exec:\vpjdv.exe88⤵PID:4068
-
\??\c:\rfxrllf.exec:\rfxrllf.exe89⤵PID:4424
-
\??\c:\bnnnnn.exec:\bnnnnn.exe90⤵PID:3328
-
\??\c:\nnnnhh.exec:\nnnnhh.exe91⤵PID:5044
-
\??\c:\jdvpj.exec:\jdvpj.exe92⤵PID:1824
-
\??\c:\xrffllx.exec:\xrffllx.exe93⤵PID:3336
-
\??\c:\tbnhtn.exec:\tbnhtn.exe94⤵PID:3268
-
\??\c:\vpjdp.exec:\vpjdp.exe95⤵PID:4124
-
\??\c:\rllfxxr.exec:\rllfxxr.exe96⤵PID:3104
-
\??\c:\xlrrlff.exec:\xlrrlff.exe97⤵PID:1496
-
\??\c:\9tttnn.exec:\9tttnn.exe98⤵PID:4724
-
\??\c:\1vdvp.exec:\1vdvp.exe99⤵PID:2516
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe100⤵PID:1536
-
\??\c:\nnnnhh.exec:\nnnnhh.exe101⤵PID:3836
-
\??\c:\5vdpj.exec:\5vdpj.exe102⤵PID:3932
-
\??\c:\vvjpj.exec:\vvjpj.exe103⤵PID:3348
-
\??\c:\3rrlllf.exec:\3rrlllf.exe104⤵PID:4664
-
\??\c:\thhtbh.exec:\thhtbh.exe105⤵PID:4812
-
\??\c:\9rrrlrl.exec:\9rrrlrl.exe106⤵PID:2764
-
\??\c:\tbnntt.exec:\tbnntt.exe107⤵PID:3712
-
\??\c:\jdjdv.exec:\jdjdv.exe108⤵PID:1788
-
\??\c:\xfxlfrx.exec:\xfxlfrx.exe109⤵PID:1828
-
\??\c:\vvvjp.exec:\vvvjp.exe110⤵PID:4328
-
\??\c:\hnttht.exec:\hnttht.exe111⤵PID:4648
-
\??\c:\7pvjd.exec:\7pvjd.exe112⤵PID:2052
-
\??\c:\rxlfrlr.exec:\rxlfrlr.exe113⤵PID:2284
-
\??\c:\hbbbtt.exec:\hbbbtt.exe114⤵PID:4736
-
\??\c:\3ddpj.exec:\3ddpj.exe115⤵PID:3984
-
\??\c:\1ffxllx.exec:\1ffxllx.exe116⤵PID:4484
-
\??\c:\llrlrlf.exec:\llrlrlf.exe117⤵PID:2868
-
\??\c:\tbhbnt.exec:\tbhbnt.exe118⤵PID:2116
-
\??\c:\dpjpd.exec:\dpjpd.exe119⤵PID:4860
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe120⤵PID:1880
-
\??\c:\xxrllff.exec:\xxrllff.exe121⤵PID:2432
-
\??\c:\tnhbbh.exec:\tnhbbh.exe122⤵PID:4388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-