Analysis
- max time kernel
150s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 08:08
Behavioral task
behavioral1
Sample
b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe
Resource
win7-20240419-en
6 signatures
150 seconds
General
- Target b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe
- Size 463KB
- Sample240518-j11dtsba49
- SHA256 f1e80c720eb0d4df1eccc752ce0f69d672453a2a73de9b5ca06e88e8b82d8d3f
- MD5 b29899458e09404ba9fe3e41e124e480
- SHA1 7daa3a81b34f25bee6082eed46c9bf2cb85d498a
- SHA512 0c3341437b0650b6d96821d5545cbff342d3d655ee2247220a0e2b3e287a8abde823077d02486319a82c9d955016716168ecdae18d6dd3f33d6132fd53b08c0e
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V1:VeR0oykayRFp3lztP+OKaf1V1
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3148-14-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1032-52-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4124-70-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/552-62-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3992-45-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2696-36-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1732-31-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1884-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/212-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4812-20-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3272-12-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3124-93-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2504-99-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1436-109-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/712-113-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/612-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2772-135-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4416-141-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/8-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2520-169-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/544-186-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1976-179-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1788-193-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/116-204-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2296-210-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2212-217-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3484-230-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1492-234-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1296-254-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1224-258-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3644-262-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4640-275-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2116-280-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3216-286-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2936-294-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4500-296-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2872-302-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/404-324-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/920-331-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1020-335-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3536-352-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4204-361-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5100-370-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2972-388-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/760-390-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1408-409-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2104-413-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/872-417-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3612-443-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2488-449-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4748-459-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1036-466-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4040-506-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1960-528-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1644-535-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/100-539-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4748-595-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-608-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2528-651-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1884-676-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4156-912-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/232-991-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4584-1148-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000c0000000233da-3.dat family_berbew behavioral2/memory/3272-5-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023428-13.dat family_berbew behavioral2/memory/3148-14-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023429-23.dat family_berbew behavioral2/files/0x000700000002342a-29.dat family_berbew behavioral2/files/0x000700000002342c-41.dat family_berbew behavioral2/files/0x000700000002342d-46.dat family_berbew behavioral2/memory/1032-52-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002342f-57.dat family_berbew behavioral2/files/0x0007000000023430-64.dat family_berbew behavioral2/memory/4124-70-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023431-68.dat family_berbew behavioral2/memory/552-62-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002342e-54.dat family_berbew behavioral2/memory/3992-45-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2696-36-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002342b-35.dat family_berbew behavioral2/files/0x0007000000023432-75.dat family_berbew behavioral2/memory/840-77-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1732-31-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023433-81.dat family_berbew behavioral2/files/0x0007000000023434-86.dat family_berbew behavioral2/memory/1884-84-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/212-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4812-20-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3272-12-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023427-10.dat family_berbew behavioral2/files/0x0008000000023424-91.dat family_berbew behavioral2/memory/3124-93-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023435-97.dat family_berbew behavioral2/memory/2504-99-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023436-104.dat family_berbew behavioral2/files/0x0007000000023437-110.dat family_berbew behavioral2/memory/1436-109-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/712-113-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023438-115.dat family_berbew behavioral2/files/0x0007000000023439-120.dat family_berbew behavioral2/memory/612-123-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002343a-127.dat family_berbew behavioral2/memory/612-129-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002343b-133.dat family_berbew behavioral2/memory/2772-135-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002343c-139.dat family_berbew behavioral2/memory/4416-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002343d-144.dat family_berbew behavioral2/files/0x000700000002343e-149.dat family_berbew behavioral2/files/0x0007000000023442-154.dat family_berbew behavioral2/memory/8-158-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023443-160.dat family_berbew behavioral2/memory/2520-169-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023446-172.dat family_berbew behavioral2/files/0x0007000000023445-166.dat family_berbew behavioral2/files/0x0007000000023447-177.dat family_berbew behavioral2/files/0x0007000000023448-184.dat family_berbew behavioral2/memory/544-186-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1976-179-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1788-193-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1476-199-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/116-204-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2296-210-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2212-217-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3484-230-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 3272 djjjv.exe 3148 xxfffff.exe 4812 hhnhhb.exe 212 pjjjd.exe 1732 ppjdd.exe 2696 nhnhnt.exe 3992 3jddv.exe 1032 frrlfrr.exe 552 ttbttn.exe 2928 dvdjj.exe 2100 lxrrlrr.exe 4124 htnhtn.exe 840 vvjjd.exe 1884 ffrrlll.exe 3124 bbnnhh.exe 2504 jdvdd.exe 1868 3tbbhh.exe 1436 ppdvv.exe 712 bhhthn.exe 3008 vvdjd.exe 612 hthbtn.exe 512 lrxrrrl.exe 2772 nbhtbb.exe 4416 xfffxrr.exe 1768 tthhhh.exe 5108 pppjd.exe 8 jdjdp.exe 532 lfxrffx.exe 2520 pvpjj.exe 2676 lffxxff.exe 1976 9hbbtn.exe 544 ddppj.exe 2264 5xflflf.exe 1788 pdppj.exe 1028 tbbttt.exe 1476 3djpj.exe 116 tntnhh.exe 2296 jdjdv.exe 3928 llffllf.exe 2212 rflffxr.exe 3160 nntnhb.exe 1960 5ffxrxr.exe 4580 xxlffxf.exe 3484 1ppjd.exe 1492 xlfxfrf.exe 2608 hnttbt.exe 1532 ddddv.exe 668 jpjdd.exe 3736 bnnnnb.exe 2416 dvppj.exe 1296 ffffrxl.exe 1224 3tnbtb.exe 3644 5jdvd.exe 3124 lxfxrlf.exe 4932 fflffff.exe 3236 tbhbtt.exe 4640 vvpjj.exe 1760 jdvpj.exe 2116 rflffxx.exe 3216 ntbthb.exe 4372 vvpjd.exe 2936 lrfrrxx.exe 4500 dvjjj.exe 2872 jjdvp.exe -
resource yara_rule behavioral2/memory/4568-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000c0000000233da-3.dat upx behavioral2/memory/3272-5-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023428-13.dat upx behavioral2/memory/3148-14-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023429-23.dat upx behavioral2/files/0x000700000002342a-29.dat upx behavioral2/files/0x000700000002342c-41.dat upx behavioral2/files/0x000700000002342d-46.dat upx behavioral2/memory/1032-52-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342f-57.dat upx behavioral2/files/0x0007000000023430-64.dat upx behavioral2/memory/4124-70-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023431-68.dat upx behavioral2/memory/552-62-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342e-54.dat upx behavioral2/memory/3992-45-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2696-36-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002342b-35.dat upx behavioral2/files/0x0007000000023432-75.dat upx behavioral2/memory/840-77-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1732-31-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023433-81.dat upx behavioral2/files/0x0007000000023434-86.dat upx behavioral2/memory/1884-84-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/212-27-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4812-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3272-12-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023427-10.dat upx behavioral2/files/0x0008000000023424-91.dat upx behavioral2/memory/3124-93-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023435-97.dat upx behavioral2/memory/2504-99-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023436-104.dat upx behavioral2/files/0x0007000000023437-110.dat upx behavioral2/memory/1436-109-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/712-113-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023438-115.dat upx behavioral2/files/0x0007000000023439-120.dat upx behavioral2/memory/612-123-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002343a-127.dat upx behavioral2/memory/612-129-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002343b-133.dat upx behavioral2/memory/2772-135-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002343c-139.dat upx behavioral2/memory/4416-141-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002343d-144.dat upx behavioral2/files/0x000700000002343e-149.dat upx behavioral2/files/0x0007000000023442-154.dat upx behavioral2/memory/8-158-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023443-160.dat upx behavioral2/memory/2520-169-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023446-172.dat upx behavioral2/files/0x0007000000023445-166.dat upx behavioral2/files/0x0007000000023447-177.dat upx behavioral2/files/0x0007000000023448-184.dat upx behavioral2/memory/544-186-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1976-179-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1788-193-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1476-199-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/116-204-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2296-210-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2212-217-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3484-230-0x0000000000400000-0x000000000043A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4568 wrote to memory of 3272 4568 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 83 PID 4568 wrote to memory of 3272 4568 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 83 PID 4568 wrote to memory of 3272 4568 b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe 83 PID 3272 wrote to memory of 3148 3272 djjjv.exe 84 PID 3272 wrote to memory of 3148 3272 djjjv.exe 84 PID 3272 wrote to memory of 3148 3272 djjjv.exe 84 PID 3148 wrote to memory of 4812 3148 xxfffff.exe 85 PID 3148 wrote to memory of 4812 3148 xxfffff.exe 85 PID 3148 wrote to memory of 4812 3148 xxfffff.exe 85 PID 4812 wrote to memory of 212 4812 hhnhhb.exe 86 PID 4812 wrote to memory of 212 4812 hhnhhb.exe 86 PID 4812 wrote to memory of 212 4812 hhnhhb.exe 86 PID 212 wrote to memory of 1732 212 pjjjd.exe 87 PID 212 wrote to memory of 1732 212 pjjjd.exe 87 PID 212 wrote to memory of 1732 212 pjjjd.exe 87 PID 1732 wrote to memory of 2696 1732 ppjdd.exe 89 PID 1732 wrote to memory of 2696 1732 ppjdd.exe 89 PID 1732 wrote to memory of 2696 1732 ppjdd.exe 89 PID 2696 wrote to memory of 3992 2696 nhnhnt.exe 91 PID 2696 wrote to memory of 3992 2696 nhnhnt.exe 91 PID 2696 wrote to memory of 3992 2696 nhnhnt.exe 91 PID 3992 wrote to memory of 1032 3992 3jddv.exe 92 PID 3992 wrote to memory of 1032 3992 3jddv.exe 92 PID 3992 wrote to memory of 1032 3992 3jddv.exe 92 PID 1032 wrote to memory of 552 1032 frrlfrr.exe 93 PID 1032 wrote to memory of 552 1032 frrlfrr.exe 93 PID 1032 wrote to memory of 552 1032 frrlfrr.exe 93 PID 552 wrote to memory of 2928 552 ttbttn.exe 94 PID 552 wrote to memory of 2928 552 ttbttn.exe 94 PID 552 wrote to memory of 2928 552 ttbttn.exe 94 PID 2928 wrote to memory of 2100 2928 dvdjj.exe 95 PID 2928 wrote to memory of 2100 2928 dvdjj.exe 95 PID 2928 wrote to memory of 2100 2928 dvdjj.exe 95 PID 2100 wrote to memory of 4124 2100 lxrrlrr.exe 96 PID 2100 wrote to memory of 4124 2100 lxrrlrr.exe 96 PID 2100 wrote to memory of 4124 2100 lxrrlrr.exe 96 PID 4124 wrote to memory of 840 4124 htnhtn.exe 97 PID 4124 wrote to memory of 840 4124 htnhtn.exe 97 PID 4124 wrote to memory of 840 4124 htnhtn.exe 97 PID 840 wrote to memory of 1884 840 vvjjd.exe 98 PID 840 wrote to memory of 1884 840 vvjjd.exe 98 PID 840 wrote to memory of 1884 840 vvjjd.exe 98 PID 1884 wrote to memory of 3124 1884 ffrrlll.exe 99 PID 1884 wrote to memory of 3124 1884 ffrrlll.exe 99 PID 1884 wrote to memory of 3124 1884 ffrrlll.exe 99 PID 3124 wrote to memory of 2504 3124 bbnnhh.exe 101 PID 3124 wrote to memory of 2504 3124 bbnnhh.exe 101 PID 3124 wrote to memory of 2504 3124 bbnnhh.exe 101 PID 2504 wrote to memory of 1868 2504 jdvdd.exe 102 PID 2504 wrote to memory of 1868 2504 jdvdd.exe 102 PID 2504 wrote to memory of 1868 2504 jdvdd.exe 102 PID 1868 wrote to memory of 1436 1868 3tbbhh.exe 103 PID 1868 wrote to memory of 1436 1868 3tbbhh.exe 103 PID 1868 wrote to memory of 1436 1868 3tbbhh.exe 103 PID 1436 wrote to memory of 712 1436 ppdvv.exe 105 PID 1436 wrote to memory of 712 1436 ppdvv.exe 105 PID 1436 wrote to memory of 712 1436 ppdvv.exe 105 PID 712 wrote to memory of 3008 712 bhhthn.exe 106 PID 712 wrote to memory of 3008 712 bhhthn.exe 106 PID 712 wrote to memory of 3008 712 bhhthn.exe 106 PID 3008 wrote to memory of 612 3008 vvdjd.exe 107 PID 3008 wrote to memory of 612 3008 vvdjd.exe 107 PID 3008 wrote to memory of 612 3008 vvdjd.exe 107 PID 612 wrote to memory of 512 612 hthbtn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b29899458e09404ba9fe3e41e124e480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\djjjv.exec:\djjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\xxfffff.exec:\xxfffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\hhnhhb.exec:\hhnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\pjjjd.exec:\pjjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\ppjdd.exec:\ppjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\nhnhnt.exec:\nhnhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\3jddv.exec:\3jddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\frrlfrr.exec:\frrlfrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\ttbttn.exec:\ttbttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\dvdjj.exec:\dvdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\htnhtn.exec:\htnhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\vvjjd.exec:\vvjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\ffrrlll.exec:\ffrrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\bbnnhh.exec:\bbnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\jdvdd.exec:\jdvdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\3tbbhh.exec:\3tbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\ppdvv.exec:\ppdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\bhhthn.exec:\bhhthn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\vvdjd.exec:\vvdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hthbtn.exec:\hthbtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe23⤵
- Executes dropped EXE
PID:512 -
\??\c:\nbhtbb.exec:\nbhtbb.exe24⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xfffxrr.exec:\xfffxrr.exe25⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tthhhh.exec:\tthhhh.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pppjd.exec:\pppjd.exe27⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdjdp.exec:\jdjdp.exe28⤵
- Executes dropped EXE
PID:8 -
\??\c:\lfxrffx.exec:\lfxrffx.exe29⤵
- Executes dropped EXE
PID:532 -
\??\c:\pvpjj.exec:\pvpjj.exe30⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lffxxff.exec:\lffxxff.exe31⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9hbbtn.exec:\9hbbtn.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ddppj.exec:\ddppj.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\5xflflf.exec:\5xflflf.exe34⤵
- Executes dropped EXE
PID:2264 -
\??\c:\pdppj.exec:\pdppj.exe35⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tbbttt.exec:\tbbttt.exe36⤵
- Executes dropped EXE
PID:1028 -
\??\c:\3djpj.exec:\3djpj.exe37⤵
- Executes dropped EXE
PID:1476 -
\??\c:\tntnhh.exec:\tntnhh.exe38⤵
- Executes dropped EXE
PID:116 -
\??\c:\jdjdv.exec:\jdjdv.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\llffllf.exec:\llffllf.exe40⤵
- Executes dropped EXE
PID:3928 -
\??\c:\rflffxr.exec:\rflffxr.exe41⤵
- Executes dropped EXE
PID:2212 -
\??\c:\nntnhb.exec:\nntnhb.exe42⤵
- Executes dropped EXE
PID:3160 -
\??\c:\5ffxrxr.exec:\5ffxrxr.exe43⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xxlffxf.exec:\xxlffxf.exe44⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1ppjd.exec:\1ppjd.exe45⤵
- Executes dropped EXE
PID:3484 -
\??\c:\xlfxfrf.exec:\xlfxfrf.exe46⤵
- Executes dropped EXE
PID:1492 -
\??\c:\hnttbt.exec:\hnttbt.exe47⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ddddv.exec:\ddddv.exe48⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jpjdd.exec:\jpjdd.exe49⤵
- Executes dropped EXE
PID:668 -
\??\c:\bnnnnb.exec:\bnnnnb.exe50⤵
- Executes dropped EXE
PID:3736 -
\??\c:\dvppj.exec:\dvppj.exe51⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ffffrxl.exec:\ffffrxl.exe52⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3tnbtb.exec:\3tnbtb.exe53⤵
- Executes dropped EXE
PID:1224 -
\??\c:\5jdvd.exec:\5jdvd.exe54⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe55⤵
- Executes dropped EXE
PID:3124 -
\??\c:\fflffff.exec:\fflffff.exe56⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tbhbtt.exec:\tbhbtt.exe57⤵
- Executes dropped EXE
PID:3236 -
\??\c:\vvpjj.exec:\vvpjj.exe58⤵
- Executes dropped EXE
PID:4640 -
\??\c:\jdvpj.exec:\jdvpj.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rflffxx.exec:\rflffxx.exe60⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ntbthb.exec:\ntbthb.exe61⤵
- Executes dropped EXE
PID:3216 -
\??\c:\vvpjd.exec:\vvpjd.exe62⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lrfrrxx.exec:\lrfrrxx.exe63⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dvjjj.exec:\dvjjj.exe64⤵
- Executes dropped EXE
PID:4500 -
\??\c:\jjdvp.exec:\jjdvp.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3nttbt.exec:\3nttbt.exe66⤵PID:4144
-
\??\c:\tnhtnn.exec:\tnhtnn.exe67⤵PID:4240
-
\??\c:\9vddv.exec:\9vddv.exe68⤵PID:1856
-
\??\c:\9lllxxf.exec:\9lllxxf.exe69⤵PID:4012
-
\??\c:\tntnnh.exec:\tntnnh.exe70⤵PID:468
-
\??\c:\pdjdd.exec:\pdjdd.exe71⤵PID:1036
-
\??\c:\xxxlfrl.exec:\xxxlfrl.exe72⤵PID:404
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe73⤵PID:1988
-
\??\c:\jdddd.exec:\jdddd.exe74⤵PID:920
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe75⤵PID:1020
-
\??\c:\bntttb.exec:\bntttb.exe76⤵PID:4728
-
\??\c:\vjvvp.exec:\vjvvp.exe77⤵PID:2264
-
\??\c:\xllxrlr.exec:\xllxrlr.exe78⤵PID:1788
-
\??\c:\nntttt.exec:\nntttt.exe79⤵PID:2448
-
\??\c:\btbnnn.exec:\btbnnn.exe80⤵PID:3536
-
\??\c:\jdjjj.exec:\jdjjj.exe81⤵PID:1696
-
\??\c:\3xxrlff.exec:\3xxrlff.exe82⤵PID:4480
-
\??\c:\hhtntb.exec:\hhtntb.exe83⤵PID:4204
-
\??\c:\bnhtnb.exec:\bnhtnb.exe84⤵PID:4028
-
\??\c:\djppj.exec:\djppj.exe85⤵PID:4812
-
\??\c:\xxlrlrr.exec:\xxlrlrr.exe86⤵PID:5100
-
\??\c:\tntbnh.exec:\tntbnh.exe87⤵PID:232
-
\??\c:\htbbbt.exec:\htbbbt.exe88⤵PID:1872
-
\??\c:\vvppp.exec:\vvppp.exe89⤵PID:2696
-
\??\c:\xrfxxrr.exec:\xrfxxrr.exe90⤵PID:744
-
\??\c:\3ntthh.exec:\3ntthh.exe91⤵PID:2972
-
\??\c:\pdpdj.exec:\pdpdj.exe92⤵PID:760
-
\??\c:\frlxlxl.exec:\frlxlxl.exe93⤵PID:1692
-
\??\c:\ttnnhn.exec:\ttnnhn.exe94⤵PID:3472
-
\??\c:\1pvvd.exec:\1pvvd.exe95⤵PID:4736
-
\??\c:\rxrfrlr.exec:\rxrfrlr.exe96⤵PID:3892
-
\??\c:\1bhhhn.exec:\1bhhhn.exe97⤵PID:1408
-
\??\c:\pvjjj.exec:\pvjjj.exe98⤵PID:2104
-
\??\c:\bnhnnt.exec:\bnhnnt.exe99⤵PID:2752
-
\??\c:\3ttbbh.exec:\3ttbbh.exe100⤵PID:872
-
\??\c:\jdvvv.exec:\jdvvv.exe101⤵PID:3284
-
\??\c:\rrrxxff.exec:\rrrxxff.exe102⤵PID:4156
-
\??\c:\hhbtnb.exec:\hhbtnb.exe103⤵PID:4932
-
\??\c:\7ttbbh.exec:\7ttbbh.exe104⤵PID:3764
-
\??\c:\1jddj.exec:\1jddj.exe105⤵PID:1436
-
\??\c:\xxffxlx.exec:\xxffxlx.exe106⤵PID:3344
-
\??\c:\fxlffff.exec:\fxlffff.exe107⤵PID:4740
-
\??\c:\bthbtb.exec:\bthbtb.exe108⤵PID:3612
-
\??\c:\tnhhhn.exec:\tnhhhn.exe109⤵PID:3252
-
\??\c:\jpjjv.exec:\jpjjv.exe110⤵PID:2488
-
\??\c:\xxrllxl.exec:\xxrllxl.exe111⤵PID:528
-
\??\c:\7tbttt.exec:\7tbttt.exe112⤵PID:4748
-
\??\c:\jjvvd.exec:\jjvvd.exe113⤵PID:1108
-
\??\c:\xrfxxfl.exec:\xrfxxfl.exe114⤵PID:1036
-
\??\c:\5bbtnt.exec:\5bbtnt.exe115⤵PID:4724
-
\??\c:\flxxxll.exec:\flxxxll.exe116⤵PID:1172
-
\??\c:\1lllfll.exec:\1lllfll.exe117⤵PID:1976
-
\??\c:\3vvvv.exec:\3vvvv.exe118⤵PID:3464
-
\??\c:\ntnttt.exec:\ntnttt.exe119⤵PID:1944
-
\??\c:\jpvvd.exec:\jpvvd.exe120⤵PID:940
-
\??\c:\llrrxff.exec:\llrrxff.exe121⤵PID:2308
-
\??\c:\hhnntb.exec:\hhnntb.exe122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-