Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:38
Behavioral task
behavioral1
Sample
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe
Resource
win7-20231129-en
General
-
Target
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe
-
Size
464KB
-
MD5
2cac3e4945f62ba8bf2580e940e0bab0
-
SHA1
67eb1d11b9e08fac5e58a7d0fa974be45220f458
-
SHA256
ec03ebfc883301f6edc58dd3a42d9c4f682c9f792b4557ebf9df7cbf4cc5a482
-
SHA512
9ebd0d8875220a18b68b1a5d106d1a125e1baf46a1a6d9bfd158c86042f61fb54c7ff91dfefdeef0d61b85c5d8ec58c2b0fba8d14046aa08aea5091a05a895f6
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Va:VeR0oykayRFp3lztP+OKaf1Va
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2968-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1108-12-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1712-21-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2296-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2592-54-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2772-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2848-88-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2908-132-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1660-178-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/888-180-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/668-223-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/796-252-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1536-301-0x0000000000320000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2612-339-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2104-599-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2104-594-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2560-624-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/692-480-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2136-447-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1376-433-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3032-382-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2420-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1060-267-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1560-249-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1560-248-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2180-232-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/988-220-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3044-159-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2768-692-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1540-123-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2652-112-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2604-75-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2988-712-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1128-774-0x0000000000440000-0x000000000047A000-memory.dmp family_blackmoon behavioral1/memory/892-839-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1736-887-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1096-973-0x00000000003C0000-0x00000000003FA000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2968-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2968-3-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/memory/2968-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\rfrxrll.exe family_berbew behavioral1/memory/1108-12-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hbnhtb.exe family_berbew behavioral1/memory/1712-21-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pvppj.exe family_berbew behavioral1/memory/2296-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\lxrrrrx.exe family_berbew \??\c:\xxrxlrr.exe family_berbew behavioral1/memory/2592-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vddpj.exe family_berbew behavioral1/memory/2772-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2772-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lxrfflx.exe family_berbew behavioral1/memory/2480-76-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nnnbhn.exe family_berbew C:\jpdpv.exe family_berbew behavioral1/memory/2848-88-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hnbbnt.exe family_berbew behavioral1/memory/1540-114-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jjdpd.exe family_berbew behavioral1/memory/2908-124-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2908-132-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1btnbn.exe family_berbew C:\dvpvd.exe family_berbew \??\c:\rlffrxx.exe family_berbew \??\c:\nbntbh.exe family_berbew \??\c:\jdpvj.exe family_berbew \??\c:\xxlxxxx.exe family_berbew behavioral1/memory/1660-178-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/888-180-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\3xxflrx.exe family_berbew C:\jdvjp.exe family_berbew \??\c:\hhtbtt.exe family_berbew behavioral1/memory/668-223-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\9vvdp.exe family_berbew behavioral1/memory/1560-240-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\lxllrrr.exe family_berbew behavioral1/memory/796-252-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\3jpjp.exe family_berbew \??\c:\9lffrxl.exe family_berbew C:\3htbnt.exe family_berbew \??\c:\frxxfxl.exe family_berbew behavioral1/memory/2612-339-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2272-448-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1748-505-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/812-550-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2288-564-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2104-591-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2104-599-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2104-594-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/memory/2592-637-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2560-624-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1208-584-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1776-571-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2024-563-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew behavioral1/memory/1852-531-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1704-518-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/692-480-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2332-461-0x0000000000260000-0x000000000029A000-memory.dmp family_berbew behavioral1/memory/2136-447-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2136-440-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rfrxrll.exehbnhtb.exepvppj.exelxrrrrx.exexxrxlrr.exevddpj.exelxrfflx.exennnbhn.exejpdpv.exexxrxfxx.exehnbbnt.exejjdpd.exellxflrf.exe1btnbn.exedvpvd.exerlffrxx.exenbntbh.exejdpvj.exexxlxxxx.exe3xxflrx.exejdvjp.exerlfxlfr.exehhtbtt.exebtnbnt.exe9vvdp.exelxllrrr.exe3jpjp.exe9lffrxl.exehnnthh.exe3htbnt.exe7vvvj.exefrxxfxl.exehthhnt.exe3ppjp.exefxlrflf.exe1lxrrrf.exettntht.exehtnbhh.exedpdvj.exe7jdvj.exe3rlrflr.exehbhhbt.exe9thtbh.exe3jvpd.exerlxlrrl.exexrrfflr.exetnhnht.exevpjjd.exedvpdp.exexrxflll.exeflxffrf.exehthbbb.exepjvjp.exedvvpj.exe1lfrxrr.exexlrflrr.exebtbnbh.exe1jvpp.exedvvjp.exefrfxxrx.exehbthtb.exe1nbhtb.exejdvpj.exejddpd.exepid process 1108 rfrxrll.exe 1712 hbnhtb.exe 2296 pvppj.exe 2696 lxrrrrx.exe 2592 xxrxlrr.exe 2772 vddpj.exe 2604 lxrfflx.exe 2480 nnnbhn.exe 2848 jpdpv.exe 2064 xxrxfxx.exe 2652 hnbbnt.exe 1540 jjdpd.exe 2908 llxflrf.exe 2820 1btnbn.exe 3016 dvpvd.exe 2276 rlffrxx.exe 3044 nbntbh.exe 1660 jdpvj.exe 888 xxlxxxx.exe 1896 3xxflrx.exe 540 jdvjp.exe 1192 rlfxlfr.exe 988 hhtbtt.exe 668 btnbnt.exe 2180 9vvdp.exe 1560 lxllrrr.exe 796 3jpjp.exe 1060 9lffrxl.exe 972 hnnthh.exe 644 3htbnt.exe 2420 7vvvj.exe 1536 frxxfxl.exe 900 hthhnt.exe 2104 3ppjp.exe 2148 fxlrflf.exe 1632 1lxrrrf.exe 2028 ttntht.exe 2612 htnbhh.exe 2572 dpdvj.exe 2616 7jdvj.exe 2668 3rlrflr.exe 2876 hbhhbt.exe 2504 9thtbh.exe 2584 3jvpd.exe 2588 rlxlrrl.exe 3032 xrrfflr.exe 2848 tnhnht.exe 2064 vpjjd.exe 1164 dvpdp.exe 2336 xrxflll.exe 2536 flxffrf.exe 2716 hthbbb.exe 2828 pjvjp.exe 1376 dvvpj.exe 2136 1lfrxrr.exe 2272 xlrflrr.exe 2332 btbnbh.exe 1908 1jvpp.exe 1652 dvvjp.exe 2340 frfxxrx.exe 692 hbthtb.exe 1452 1nbhtb.exe 1676 jdvpj.exe 2952 jddpd.exe -
Processes:
resource yara_rule behavioral1/memory/2968-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2968-3-0x0000000000220000-0x000000000025A000-memory.dmp upx behavioral1/memory/2968-8-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\rfrxrll.exe upx behavioral1/memory/1108-12-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hbnhtb.exe upx behavioral1/memory/1712-21-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pvppj.exe upx behavioral1/memory/2296-30-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\lxrrrrx.exe upx \??\c:\xxrxlrr.exe upx behavioral1/memory/2592-54-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vddpj.exe upx behavioral1/memory/2772-55-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2772-66-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lxrfflx.exe upx behavioral1/memory/2772-62-0x0000000000440000-0x000000000047A000-memory.dmp upx behavioral1/memory/2480-76-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nnnbhn.exe upx C:\jpdpv.exe upx behavioral1/memory/2848-88-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hnbbnt.exe upx behavioral1/memory/1540-114-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jjdpd.exe upx behavioral1/memory/2908-124-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2908-132-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1btnbn.exe upx C:\dvpvd.exe upx \??\c:\rlffrxx.exe upx \??\c:\nbntbh.exe upx \??\c:\jdpvj.exe upx \??\c:\xxlxxxx.exe upx behavioral1/memory/1660-178-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/888-180-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3xxflrx.exe upx C:\jdvjp.exe upx \??\c:\hhtbtt.exe upx behavioral1/memory/668-223-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\9vvdp.exe upx behavioral1/memory/1560-240-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\lxllrrr.exe upx behavioral1/memory/796-252-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\3jpjp.exe upx \??\c:\9lffrxl.exe upx C:\3htbnt.exe upx \??\c:\frxxfxl.exe upx behavioral1/memory/2612-339-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2272-448-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1748-505-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/812-550-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2288-564-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2104-591-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2104-599-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2592-637-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2560-624-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1208-584-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1776-571-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1852-531-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1704-518-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/692-480-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2136-447-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2136-440-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1376-433-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2828-430-0x0000000000220000-0x000000000025A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exerfrxrll.exehbnhtb.exepvppj.exelxrrrrx.exexxrxlrr.exevddpj.exelxrfflx.exennnbhn.exejpdpv.exexxrxfxx.exehnbbnt.exejjdpd.exellxflrf.exe1btnbn.exedvpvd.exedescription pid process target process PID 2968 wrote to memory of 1108 2968 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe rfrxrll.exe PID 2968 wrote to memory of 1108 2968 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe rfrxrll.exe PID 2968 wrote to memory of 1108 2968 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe rfrxrll.exe PID 2968 wrote to memory of 1108 2968 2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe rfrxrll.exe PID 1108 wrote to memory of 1712 1108 rfrxrll.exe hbnhtb.exe PID 1108 wrote to memory of 1712 1108 rfrxrll.exe hbnhtb.exe PID 1108 wrote to memory of 1712 1108 rfrxrll.exe hbnhtb.exe PID 1108 wrote to memory of 1712 1108 rfrxrll.exe hbnhtb.exe PID 1712 wrote to memory of 2296 1712 hbnhtb.exe pvppj.exe PID 1712 wrote to memory of 2296 1712 hbnhtb.exe pvppj.exe PID 1712 wrote to memory of 2296 1712 hbnhtb.exe pvppj.exe PID 1712 wrote to memory of 2296 1712 hbnhtb.exe pvppj.exe PID 2296 wrote to memory of 2696 2296 pvppj.exe lxrrrrx.exe PID 2296 wrote to memory of 2696 2296 pvppj.exe lxrrrrx.exe PID 2296 wrote to memory of 2696 2296 pvppj.exe lxrrrrx.exe PID 2296 wrote to memory of 2696 2296 pvppj.exe lxrrrrx.exe PID 2696 wrote to memory of 2592 2696 lxrrrrx.exe xxrxlrr.exe PID 2696 wrote to memory of 2592 2696 lxrrrrx.exe xxrxlrr.exe PID 2696 wrote to memory of 2592 2696 lxrrrrx.exe xxrxlrr.exe PID 2696 wrote to memory of 2592 2696 lxrrrrx.exe xxrxlrr.exe PID 2592 wrote to memory of 2772 2592 xxrxlrr.exe vddpj.exe PID 2592 wrote to memory of 2772 2592 xxrxlrr.exe vddpj.exe PID 2592 wrote to memory of 2772 2592 xxrxlrr.exe vddpj.exe PID 2592 wrote to memory of 2772 2592 xxrxlrr.exe vddpj.exe PID 2772 wrote to memory of 2604 2772 vddpj.exe lxrfflx.exe PID 2772 wrote to memory of 2604 2772 vddpj.exe lxrfflx.exe PID 2772 wrote to memory of 2604 2772 vddpj.exe lxrfflx.exe PID 2772 wrote to memory of 2604 2772 vddpj.exe lxrfflx.exe PID 2604 wrote to memory of 2480 2604 lxrfflx.exe nnnbhn.exe PID 2604 wrote to memory of 2480 2604 lxrfflx.exe nnnbhn.exe PID 2604 wrote to memory of 2480 2604 lxrfflx.exe nnnbhn.exe PID 2604 wrote to memory of 2480 2604 lxrfflx.exe nnnbhn.exe PID 2480 wrote to memory of 2848 2480 nnnbhn.exe jpdpv.exe PID 2480 wrote to memory of 2848 2480 nnnbhn.exe jpdpv.exe PID 2480 wrote to memory of 2848 2480 nnnbhn.exe jpdpv.exe PID 2480 wrote to memory of 2848 2480 nnnbhn.exe jpdpv.exe PID 2848 wrote to memory of 2064 2848 jpdpv.exe xxrxfxx.exe PID 2848 wrote to memory of 2064 2848 jpdpv.exe xxrxfxx.exe PID 2848 wrote to memory of 2064 2848 jpdpv.exe xxrxfxx.exe PID 2848 wrote to memory of 2064 2848 jpdpv.exe xxrxfxx.exe PID 2064 wrote to memory of 2652 2064 xxrxfxx.exe hnbbnt.exe PID 2064 wrote to memory of 2652 2064 xxrxfxx.exe hnbbnt.exe PID 2064 wrote to memory of 2652 2064 xxrxfxx.exe hnbbnt.exe PID 2064 wrote to memory of 2652 2064 xxrxfxx.exe hnbbnt.exe PID 2652 wrote to memory of 1540 2652 hnbbnt.exe jjdpd.exe PID 2652 wrote to memory of 1540 2652 hnbbnt.exe jjdpd.exe PID 2652 wrote to memory of 1540 2652 hnbbnt.exe jjdpd.exe PID 2652 wrote to memory of 1540 2652 hnbbnt.exe jjdpd.exe PID 1540 wrote to memory of 2908 1540 jjdpd.exe llxflrf.exe PID 1540 wrote to memory of 2908 1540 jjdpd.exe llxflrf.exe PID 1540 wrote to memory of 2908 1540 jjdpd.exe llxflrf.exe PID 1540 wrote to memory of 2908 1540 jjdpd.exe llxflrf.exe PID 2908 wrote to memory of 2820 2908 llxflrf.exe 1btnbn.exe PID 2908 wrote to memory of 2820 2908 llxflrf.exe 1btnbn.exe PID 2908 wrote to memory of 2820 2908 llxflrf.exe 1btnbn.exe PID 2908 wrote to memory of 2820 2908 llxflrf.exe 1btnbn.exe PID 2820 wrote to memory of 3016 2820 1btnbn.exe dvpvd.exe PID 2820 wrote to memory of 3016 2820 1btnbn.exe dvpvd.exe PID 2820 wrote to memory of 3016 2820 1btnbn.exe dvpvd.exe PID 2820 wrote to memory of 3016 2820 1btnbn.exe dvpvd.exe PID 3016 wrote to memory of 2276 3016 dvpvd.exe rlffrxx.exe PID 3016 wrote to memory of 2276 3016 dvpvd.exe rlffrxx.exe PID 3016 wrote to memory of 2276 3016 dvpvd.exe rlffrxx.exe PID 3016 wrote to memory of 2276 3016 dvpvd.exe rlffrxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2cac3e4945f62ba8bf2580e940e0bab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\rfrxrll.exec:\rfrxrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\hbnhtb.exec:\hbnhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pvppj.exec:\pvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xxrxlrr.exec:\xxrxlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vddpj.exec:\vddpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lxrfflx.exec:\lxrfflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nnnbhn.exec:\nnnbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jpdpv.exec:\jpdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxrxfxx.exec:\xxrxfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\hnbbnt.exec:\hnbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\jjdpd.exec:\jjdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\llxflrf.exec:\llxflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\1btnbn.exec:\1btnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvpvd.exec:\dvpvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\rlffrxx.exec:\rlffrxx.exe17⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nbntbh.exec:\nbntbh.exe18⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jdpvj.exec:\jdpvj.exe19⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xxlxxxx.exec:\xxlxxxx.exe20⤵
- Executes dropped EXE
PID:888 -
\??\c:\3xxflrx.exec:\3xxflrx.exe21⤵
- Executes dropped EXE
PID:1896 -
\??\c:\jdvjp.exec:\jdvjp.exe22⤵
- Executes dropped EXE
PID:540 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe23⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hhtbtt.exec:\hhtbtt.exe24⤵
- Executes dropped EXE
PID:988 -
\??\c:\btnbnt.exec:\btnbnt.exe25⤵
- Executes dropped EXE
PID:668 -
\??\c:\9vvdp.exec:\9vvdp.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lxllrrr.exec:\lxllrrr.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3jpjp.exec:\3jpjp.exe28⤵
- Executes dropped EXE
PID:796 -
\??\c:\9lffrxl.exec:\9lffrxl.exe29⤵
- Executes dropped EXE
PID:1060 -
\??\c:\hnnthh.exec:\hnnthh.exe30⤵
- Executes dropped EXE
PID:972 -
\??\c:\3htbnt.exec:\3htbnt.exe31⤵
- Executes dropped EXE
PID:644 -
\??\c:\7vvvj.exec:\7vvvj.exe32⤵
- Executes dropped EXE
PID:2420 -
\??\c:\frxxfxl.exec:\frxxfxl.exe33⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hthhnt.exec:\hthhnt.exe34⤵
- Executes dropped EXE
PID:900 -
\??\c:\3ppjp.exec:\3ppjp.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\fxlrflf.exec:\fxlrflf.exe36⤵
- Executes dropped EXE
PID:2148 -
\??\c:\1lxrrrf.exec:\1lxrrrf.exe37⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ttntht.exec:\ttntht.exe38⤵
- Executes dropped EXE
PID:2028 -
\??\c:\htnbhh.exec:\htnbhh.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpdvj.exec:\dpdvj.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7jdvj.exec:\7jdvj.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3rlrflr.exec:\3rlrflr.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\hbhhbt.exec:\hbhhbt.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9thtbh.exec:\9thtbh.exe44⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3jvpd.exec:\3jvpd.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\rlxlrrl.exec:\rlxlrrl.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrrfflr.exec:\xrrfflr.exe47⤵
- Executes dropped EXE
PID:3032 -
\??\c:\tnhnht.exec:\tnhnht.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpjjd.exec:\vpjjd.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvpdp.exec:\dvpdp.exe50⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xrxflll.exec:\xrxflll.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\flxffrf.exec:\flxffrf.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hthbbb.exec:\hthbbb.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\pjvjp.exec:\pjvjp.exe54⤵
- Executes dropped EXE
PID:2828 -
\??\c:\dvvpj.exec:\dvvpj.exe55⤵
- Executes dropped EXE
PID:1376 -
\??\c:\1lfrxrr.exec:\1lfrxrr.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xlrflrr.exec:\xlrflrr.exe57⤵
- Executes dropped EXE
PID:2272 -
\??\c:\btbnbh.exec:\btbnbh.exe58⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1jvpp.exec:\1jvpp.exe59⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvvjp.exec:\dvvjp.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\frfxxrx.exec:\frfxxrx.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hbthtb.exec:\hbthtb.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\1nbhtb.exec:\1nbhtb.exe63⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jdvpj.exec:\jdvpj.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jddpd.exec:\jddpd.exe65⤵
- Executes dropped EXE
PID:2952 -
\??\c:\lllxrfx.exec:\lllxrfx.exe66⤵PID:1748
-
\??\c:\btbbnh.exec:\btbbnh.exe67⤵PID:668
-
\??\c:\btnbnn.exec:\btnbnn.exe68⤵PID:1704
-
\??\c:\jvddj.exec:\jvddj.exe69⤵PID:1648
-
\??\c:\pddjp.exec:\pddjp.exe70⤵PID:1852
-
\??\c:\fxrrrll.exec:\fxrrrll.exe71⤵PID:1640
-
\??\c:\5htttt.exec:\5htttt.exe72⤵PID:892
-
\??\c:\1bnhbn.exec:\1bnhbn.exe73⤵PID:812
-
\??\c:\jjvjp.exec:\jjvjp.exe74⤵PID:2024
-
\??\c:\jvjpp.exec:\jvjpp.exe75⤵PID:2288
-
\??\c:\frflrxx.exec:\frflrxx.exe76⤵PID:1776
-
\??\c:\xrlfffl.exec:\xrlfffl.exe77⤵PID:1528
-
\??\c:\tnbtbb.exec:\tnbtbb.exe78⤵PID:1208
-
\??\c:\3vjpd.exec:\3vjpd.exe79⤵PID:2104
-
\??\c:\3pjjp.exec:\3pjjp.exe80⤵PID:2148
-
\??\c:\frxllfl.exec:\frxllfl.exe81⤵PID:1632
-
\??\c:\xxrfllf.exec:\xxrfllf.exe82⤵PID:1784
-
\??\c:\7bbnbh.exec:\7bbnbh.exe83⤵PID:2932
-
\??\c:\pdppv.exec:\pdppv.exe84⤵PID:2560
-
\??\c:\dpdvd.exec:\dpdvd.exe85⤵PID:2424
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe86⤵PID:2592
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe87⤵PID:2676
-
\??\c:\1thbbb.exec:\1thbbb.exe88⤵PID:2756
-
\??\c:\dvddp.exec:\dvddp.exe89⤵PID:2512
-
\??\c:\vpvdv.exec:\vpvdv.exe90⤵PID:2464
-
\??\c:\xllfrxl.exec:\xllfrxl.exe91⤵PID:3028
-
\??\c:\fxllrxf.exec:\fxllrxf.exe92⤵PID:2520
-
\??\c:\nntntt.exec:\nntntt.exe93⤵PID:2360
-
\??\c:\5pdpd.exec:\5pdpd.exe94⤵PID:2768
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe95⤵PID:2644
-
\??\c:\1bhbbb.exec:\1bhbbb.exe96⤵PID:1956
-
\??\c:\jjvdv.exec:\jjvdv.exe97⤵PID:2540
-
\??\c:\rrxlllx.exec:\rrxlllx.exe98⤵PID:2988
-
\??\c:\bnbttt.exec:\bnbttt.exe99⤵PID:2716
-
\??\c:\vdvpp.exec:\vdvpp.exe100⤵PID:1788
-
\??\c:\lfxfllr.exec:\lfxfllr.exe101⤵PID:2456
-
\??\c:\bhnhht.exec:\bhnhht.exe102⤵PID:1100
-
\??\c:\vvpvd.exec:\vvpvd.exe103⤵PID:2880
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe104⤵PID:2252
-
\??\c:\fxxxlrf.exec:\fxxxlrf.exe105⤵PID:1768
-
\??\c:\hbthtt.exec:\hbthtt.exe106⤵PID:1896
-
\??\c:\3jvpv.exec:\3jvpv.exe107⤵PID:1128
-
\??\c:\lfxflrl.exec:\lfxflrl.exe108⤵PID:960
-
\??\c:\hbttbt.exec:\hbttbt.exe109⤵PID:1216
-
\??\c:\jjdpd.exec:\jjdpd.exe110⤵PID:1676
-
\??\c:\lrlfxll.exec:\lrlfxll.exe111⤵PID:2952
-
\??\c:\hbntnt.exec:\hbntnt.exe112⤵PID:1552
-
\??\c:\rllxrxx.exec:\rllxrxx.exe113⤵PID:668
-
\??\c:\nhbhbh.exec:\nhbhbh.exe114⤵PID:108
-
\??\c:\dvvvj.exec:\dvvvj.exe115⤵PID:2000
-
\??\c:\pddpj.exec:\pddpj.exe116⤵PID:1984
-
\??\c:\5rfxllr.exec:\5rfxllr.exe117⤵PID:1640
-
\??\c:\pppdj.exec:\pppdj.exe118⤵PID:892
-
\??\c:\jjppv.exec:\jjppv.exe119⤵PID:812
-
\??\c:\bbtbnt.exec:\bbtbnt.exe120⤵PID:2284
-
\??\c:\jjppj.exec:\jjppj.exe121⤵PID:2288
-
\??\c:\xrflrxr.exec:\xrflrxr.exe122⤵PID:2352
-
\??\c:\3hhtbn.exec:\3hhtbn.exe123⤵PID:1848
-
\??\c:\9rflfxf.exec:\9rflfxf.exe124⤵PID:1108
-
\??\c:\frxfxxl.exec:\frxfxxl.exe125⤵PID:1760
-
\??\c:\7hbbhn.exec:\7hbbhn.exe126⤵PID:1736
-
\??\c:\pdvvd.exec:\pdvvd.exe127⤵PID:1712
-
\??\c:\lxlrllr.exec:\lxlrllr.exe128⤵PID:2596
-
\??\c:\rxrrfxl.exec:\rxrrfxl.exe129⤵PID:1420
-
\??\c:\nbnhbt.exec:\nbnhbt.exe130⤵PID:2776
-
\??\c:\bhbbhb.exec:\bhbbhb.exe131⤵PID:2792
-
\??\c:\vdjjj.exec:\vdjjj.exe132⤵PID:2784
-
\??\c:\rlllxxl.exec:\rlllxxl.exe133⤵PID:2780
-
\??\c:\7frxlrx.exec:\7frxlrx.exe134⤵PID:2292
-
\??\c:\nhthnt.exec:\nhthnt.exe135⤵PID:2604
-
\??\c:\jpdjj.exec:\jpdjj.exe136⤵PID:2512
-
\??\c:\5dvdp.exec:\5dvdp.exe137⤵PID:2204
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe138⤵PID:3028
-
\??\c:\9tnhnt.exec:\9tnhnt.exe139⤵PID:1096
-
\??\c:\9dpvp.exec:\9dpvp.exe140⤵PID:2468
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe141⤵PID:1112
-
\??\c:\rlllrrf.exec:\rlllrrf.exe142⤵PID:2568
-
\??\c:\3tbnnn.exec:\3tbnnn.exe143⤵PID:2940
-
\??\c:\pvjpp.exec:\pvjpp.exe144⤵PID:2904
-
\??\c:\jdvjp.exec:\jdvjp.exe145⤵PID:3024
-
\??\c:\ffrffrr.exec:\ffrffrr.exe146⤵PID:3008
-
\??\c:\tttbnt.exec:\tttbnt.exe147⤵PID:916
-
\??\c:\9hhnht.exec:\9hhnht.exe148⤵PID:2276
-
\??\c:\5jpdp.exec:\5jpdp.exe149⤵PID:1100
-
\??\c:\fxfrxfr.exec:\fxfrxfr.exe150⤵PID:1332
-
\??\c:\7tntht.exec:\7tntht.exe151⤵PID:1796
-
\??\c:\bthhtn.exec:\bthhtn.exe152⤵PID:1652
-
\??\c:\pjddp.exec:\pjddp.exe153⤵PID:964
-
\??\c:\7llrrrr.exec:\7llrrrr.exe154⤵PID:2924
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe155⤵PID:576
-
\??\c:\hbhnth.exec:\hbhnth.exe156⤵PID:1476
-
\??\c:\pjddj.exec:\pjddj.exe157⤵PID:1140
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe158⤵PID:2448
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe159⤵PID:1844
-
\??\c:\tnhnhh.exec:\tnhnhh.exe160⤵PID:1616
-
\??\c:\jvdjj.exec:\jvdjj.exe161⤵PID:592
-
\??\c:\dvppp.exec:\dvppp.exe162⤵PID:108
-
\??\c:\lflffxx.exec:\lflffxx.exe163⤵PID:1900
-
\??\c:\tnttbh.exec:\tnttbh.exe164⤵PID:1492
-
\??\c:\vpddp.exec:\vpddp.exe165⤵PID:972
-
\??\c:\jpvpp.exec:\jpvpp.exe166⤵PID:2308
-
\??\c:\9fflxxf.exec:\9fflxxf.exe167⤵PID:644
-
\??\c:\5bbntn.exec:\5bbntn.exe168⤵PID:1200
-
\??\c:\ttttbb.exec:\ttttbb.exe169⤵PID:856
-
\??\c:\ddpvd.exec:\ddpvd.exe170⤵PID:2656
-
\??\c:\ffrlxlf.exec:\ffrlxlf.exe171⤵PID:1596
-
\??\c:\frllllr.exec:\frllllr.exe172⤵PID:2920
-
\??\c:\bntntt.exec:\bntntt.exe173⤵PID:2552
-
\??\c:\jvpdp.exec:\jvpdp.exe174⤵PID:2692
-
\??\c:\ppvdj.exec:\ppvdj.exe175⤵PID:1712
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe176⤵PID:2984
-
\??\c:\llxlrxl.exec:\llxlrxl.exe177⤵PID:1420
-
\??\c:\nhbhbh.exec:\nhbhbh.exe178⤵PID:2236
-
\??\c:\9jdpd.exec:\9jdpd.exe179⤵PID:2792
-
\??\c:\ppjvp.exec:\ppjvp.exe180⤵PID:2784
-
\??\c:\1xrxffr.exec:\1xrxffr.exe181⤵PID:2504
-
\??\c:\5hhnhn.exec:\5hhnhn.exe182⤵PID:2292
-
\??\c:\ddjpv.exec:\ddjpv.exe183⤵PID:2440
-
\??\c:\dvpvj.exec:\dvpvj.exe184⤵PID:2588
-
\??\c:\lrflrlf.exec:\lrflrlf.exe185⤵PID:2528
-
\??\c:\nttbht.exec:\nttbht.exe186⤵PID:3028
-
\??\c:\bbtnbt.exec:\bbtnbt.exe187⤵PID:2844
-
\??\c:\ddjpv.exec:\ddjpv.exe188⤵PID:2636
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe189⤵PID:2184
-
\??\c:\lllrffl.exec:\lllrffl.exe190⤵PID:2336
-
\??\c:\ttntnn.exec:\ttntnn.exe191⤵PID:2860
-
\??\c:\9jvjv.exec:\9jvjv.exe192⤵PID:2540
-
\??\c:\pjddv.exec:\pjddv.exe193⤵PID:2800
-
\??\c:\fxlflrx.exec:\fxlflrx.exe194⤵PID:3016
-
\??\c:\btthhh.exec:\btthhh.exe195⤵PID:3052
-
\??\c:\tnnnhn.exec:\tnnnhn.exe196⤵PID:2200
-
\??\c:\3pjpj.exec:\3pjpj.exe197⤵PID:2044
-
\??\c:\fxflxxr.exec:\fxflxxr.exe198⤵PID:1604
-
\??\c:\tnbhnt.exec:\tnbhnt.exe199⤵PID:1276
-
\??\c:\hnnttt.exec:\hnnttt.exe200⤵PID:2256
-
\??\c:\fxrfrxf.exec:\fxrfrxf.exe201⤵PID:324
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe202⤵PID:580
-
\??\c:\thbtbt.exec:\thbtbt.exe203⤵PID:3048
-
\??\c:\vjdjj.exec:\vjdjj.exe204⤵PID:564
-
\??\c:\vjppp.exec:\vjppp.exe205⤵PID:3056
-
\??\c:\xxlflrl.exec:\xxlflrl.exe206⤵PID:3044
-
\??\c:\thhntt.exec:\thhntt.exe207⤵PID:952
-
\??\c:\nhtbht.exec:\nhtbht.exe208⤵PID:1748
-
\??\c:\dvpvd.exec:\dvpvd.exe209⤵PID:1168
-
\??\c:\5xrxxff.exec:\5xrxxff.exe210⤵PID:920
-
\??\c:\rrrxflr.exec:\rrrxflr.exe211⤵PID:2016
-
\??\c:\hthtbb.exec:\hthtbb.exe212⤵PID:2080
-
\??\c:\pjvpv.exec:\pjvpv.exe213⤵PID:1640
-
\??\c:\vjvpp.exec:\vjvpp.exe214⤵PID:2120
-
\??\c:\xxlrrxf.exec:\xxlrrxf.exe215⤵PID:1512
-
\??\c:\hbbbnt.exec:\hbbbnt.exe216⤵PID:1732
-
\??\c:\dpddv.exec:\dpddv.exe217⤵PID:2284
-
\??\c:\ddjpv.exec:\ddjpv.exe218⤵PID:2352
-
\??\c:\xlxxxrf.exec:\xlxxxrf.exe219⤵PID:1208
-
\??\c:\bbtbnb.exec:\bbtbnb.exe220⤵PID:2980
-
\??\c:\htbbtt.exec:\htbbtt.exe221⤵PID:2608
-
\??\c:\dvppv.exec:\dvppv.exe222⤵PID:1628
-
\??\c:\3flxlxf.exec:\3flxlxf.exe223⤵PID:1784
-
\??\c:\fffrflx.exec:\fffrflx.exe224⤵PID:292
-
\??\c:\hthhnt.exec:\hthhnt.exe225⤵PID:2296
-
\??\c:\jdpvd.exec:\jdpvd.exe226⤵PID:2496
-
\??\c:\dvjjp.exec:\dvjjp.exe227⤵PID:2788
-
\??\c:\1frfxrl.exec:\1frfxrl.exe228⤵PID:1952
-
\??\c:\tnbttt.exec:\tnbttt.exe229⤵PID:2580
-
\??\c:\9dvpv.exec:\9dvpv.exe230⤵PID:1772
-
\??\c:\9jpvv.exec:\9jpvv.exe231⤵PID:2492
-
\??\c:\7fxxffl.exec:\7fxxffl.exe232⤵PID:2292
-
\??\c:\hbtnbh.exec:\hbtnbh.exe233⤵PID:2112
-
\??\c:\nhbbnt.exec:\nhbbnt.exe234⤵PID:2888
-
\??\c:\vpppv.exec:\vpppv.exe235⤵PID:1940
-
\??\c:\vvjjd.exec:\vvjjd.exe236⤵PID:2076
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe237⤵PID:556
-
\??\c:\btnbnt.exec:\btnbnt.exe238⤵PID:1812
-
\??\c:\bbttbh.exec:\bbttbh.exe239⤵PID:1112
-
\??\c:\dvpvp.exec:\dvpvp.exe240⤵PID:2736
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe241⤵PID:2032
-
\??\c:\rrffllr.exec:\rrffllr.exe242⤵PID:2540