Analysis
-
max time kernel
152s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 19:54
Behavioral task
behavioral1
Sample
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
Resource
win7-20240221-en
General
-
Target
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
-
Size
464KB
-
MD5
3dec43c7be61490b7de0f0039ee57d70
-
SHA1
3598d955d6aab03de714a078da703fdf7a1b067c
-
SHA256
1f0ee41fb65b04cd416b7e06c781a80e7194055829d284f4d80718c8264fcdac
-
SHA512
5fc7e21de1027cadcf3282b14a3d51af0a8ddc0ed6e86350a8eb3e5c0f9050b648e60533afda4804ba795d41512f518553adfc924e7eb058376638baedad2b45
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vq:VeR0oykayRFp3lztP+OKaf1Vq
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2200-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3040-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2672-37-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2504-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2748-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2624-56-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2944-76-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2472-85-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2324-95-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/580-105-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2764-122-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1232-131-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/896-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1796-171-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1624-183-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1708-180-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2280-193-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2116-209-0x0000000000540000-0x000000000057A000-memory.dmp family_blackmoon behavioral1/memory/2264-230-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2948-228-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2084-254-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1724-264-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/884-273-0x0000000000440000-0x000000000047A000-memory.dmp family_blackmoon behavioral1/memory/1532-282-0x00000000001B0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1492-300-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1492-301-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2192-316-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/436-406-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1652-438-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1448-476-0x00000000002C0000-0x00000000002FA000-memory.dmp family_blackmoon behavioral1/memory/2244-511-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1944-570-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/536-610-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1600-617-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2628-631-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2016-724-0x00000000003A0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2880-739-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1748-789-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/1280-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rndfvr.exe family_berbew behavioral1/memory/1280-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2200-11-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hbjnrvd.exe family_berbew behavioral1/memory/3040-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/3040-21-0x0000000000220000-0x000000000025A000-memory.dmp family_berbew C:\lxdhrd.exe family_berbew behavioral1/memory/3040-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2504-39-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\xtbtv.exe family_berbew behavioral1/memory/2672-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pdnxl.exe family_berbew behavioral1/memory/2504-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hrpbln.exe family_berbew behavioral1/memory/2748-58-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pfplhl.exe family_berbew behavioral1/memory/2748-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2624-56-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\tthpbpl.exe family_berbew behavioral1/memory/2944-76-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\lrhppj.exe family_berbew behavioral1/memory/2472-85-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vttndr.exe family_berbew behavioral1/memory/2324-95-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jnrnvlt.exe family_berbew behavioral1/memory/580-105-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jlntdhv.exe family_berbew behavioral1/memory/2764-114-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rrbxrvx.exe family_berbew behavioral1/memory/2764-122-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1232-131-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bdlxb.exe family_berbew behavioral1/memory/896-142-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1948-143-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\hjtlpnd.exe family_berbew \??\c:\vbphrn.exe family_berbew C:\dnvbhf.exe family_berbew behavioral1/memory/1796-163-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dxjvv.exe family_berbew behavioral1/memory/1796-171-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1624-183-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jhvfhnt.exe family_berbew behavioral1/memory/1708-180-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2280-193-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\vbvrvt.exe family_berbew C:\xnphxtl.exe family_berbew \??\c:\jrhjnv.exe family_berbew behavioral1/memory/3028-211-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2116-209-0x0000000000540000-0x000000000057A000-memory.dmp family_berbew C:\jthfdvt.exe family_berbew behavioral1/memory/2264-230-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\btrfl.exe family_berbew behavioral1/memory/2948-228-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tnvhrfp.exe family_berbew C:\hrxtb.exe family_berbew behavioral1/memory/2084-254-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jhvhv.exe family_berbew \??\c:\tpbnj.exe family_berbew behavioral1/memory/1724-264-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\rhrvh.exe family_berbew behavioral1/memory/1532-274-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/884-273-0x0000000000440000-0x000000000047A000-memory.dmp family_berbew behavioral1/memory/1532-282-0x00000000001B0000-0x00000000001EA000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
rndfvr.exehbjnrvd.exelxdhrd.exextbtv.exepdnxl.exehrpbln.exepfplhl.exetthpbpl.exelrhppj.exevttndr.exejnrnvlt.exejlntdhv.exerrbxrvx.exebdlxb.exehjtlpnd.exevbphrn.exednvbhf.exedxjvv.exejhvfhnt.exevbvrvt.exexnphxtl.exejrhjnv.exejthfdvt.exebtrfl.exetnvhrfp.exehrxtb.exejhvhv.exetpbnj.exerhrvh.exefpbrl.exejjhdjf.exebjrrdrn.exetnvfj.exefthfdbl.exebfphvf.exehfbhrhx.exehxfhd.exehdvtvh.exertdnlbv.exetrjpdvp.exexnxjjnb.exefxtlj.exednxfpr.exebtjvvtp.exedhrjpl.exelvltpll.exevrfjrrd.exehbjbpv.exelbxbbpn.exervrfx.exepnbhrxr.exevrjnpx.exeffpbrlf.exettdhttb.exenxnxjl.exexfhbvl.exexrfdpnh.exexfxvjf.exexnlrn.exenpljl.exednfhnxn.exervtdnv.exerdjtj.exebnflrv.exepid process 2200 rndfvr.exe 3040 hbjnrvd.exe 2672 lxdhrd.exe 2504 xtbtv.exe 2624 pdnxl.exe 2748 hrpbln.exe 2944 pfplhl.exe 2472 tthpbpl.exe 2324 lrhppj.exe 580 vttndr.exe 2696 jnrnvlt.exe 2764 jlntdhv.exe 1232 rrbxrvx.exe 896 bdlxb.exe 1948 hjtlpnd.exe 1844 vbphrn.exe 1796 dnvbhf.exe 1708 dxjvv.exe 1624 jhvfhnt.exe 2280 vbvrvt.exe 2116 xnphxtl.exe 3028 jrhjnv.exe 2948 jthfdvt.exe 2264 btrfl.exe 1776 tnvhrfp.exe 2084 hrxtb.exe 1724 jhvhv.exe 884 tpbnj.exe 1532 rhrvh.exe 1756 fpbrl.exe 1492 jjhdjf.exe 876 bjrrdrn.exe 2192 tnvfj.exe 2920 fthfdbl.exe 2864 bfphvf.exe 2120 hfbhrhx.exe 2996 hxfhd.exe 2556 hdvtvh.exe 2064 rtdnlbv.exe 2436 trjpdvp.exe 2424 xnxjjnb.exe 2572 fxtlj.exe 2412 dnxfpr.exe 2464 btjvvtp.exe 2892 dhrjpl.exe 2452 lvltpll.exe 268 vrfjrrd.exe 436 hbjbpv.exe 1288 lbxbbpn.exe 1460 rvrfx.exe 924 pnbhrxr.exe 1652 vrjnpx.exe 2884 ffpbrlf.exe 1508 ttdhttb.exe 2652 nxnxjl.exe 1420 xfhbvl.exe 1576 xrfdpnh.exe 1448 xfxvjf.exe 1512 xnlrn.exe 2096 npljl.exe 2288 dnfhnxn.exe 1308 rvtdnv.exe 2244 rdjtj.exe 396 bnflrv.exe -
Processes:
resource yara_rule behavioral1/memory/1280-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rndfvr.exe upx behavioral1/memory/1280-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2200-11-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hbjnrvd.exe upx behavioral1/memory/3040-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3040-21-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\lxdhrd.exe upx behavioral1/memory/3040-27-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2504-39-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\xtbtv.exe upx behavioral1/memory/2672-37-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pdnxl.exe upx behavioral1/memory/2504-47-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hrpbln.exe upx behavioral1/memory/2748-58-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pfplhl.exe upx behavioral1/memory/2748-66-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2624-56-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\tthpbpl.exe upx behavioral1/memory/2944-76-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\lrhppj.exe upx behavioral1/memory/2472-85-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vttndr.exe upx behavioral1/memory/2324-95-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jnrnvlt.exe upx behavioral1/memory/580-105-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jlntdhv.exe upx behavioral1/memory/2764-114-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rrbxrvx.exe upx behavioral1/memory/2764-122-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1232-131-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bdlxb.exe upx behavioral1/memory/896-139-0x0000000000230000-0x000000000026A000-memory.dmp upx behavioral1/memory/896-142-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1948-143-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\hjtlpnd.exe upx \??\c:\vbphrn.exe upx behavioral1/memory/1844-161-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\dnvbhf.exe upx behavioral1/memory/1796-163-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dxjvv.exe upx behavioral1/memory/1796-171-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1624-183-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jhvfhnt.exe upx behavioral1/memory/1708-180-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2280-193-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\vbvrvt.exe upx C:\xnphxtl.exe upx \??\c:\jrhjnv.exe upx behavioral1/memory/3028-211-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jthfdvt.exe upx behavioral1/memory/2264-230-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\btrfl.exe upx behavioral1/memory/2948-228-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tnvhrfp.exe upx C:\hrxtb.exe upx behavioral1/memory/2084-254-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jhvhv.exe upx \??\c:\tpbnj.exe upx behavioral1/memory/1724-264-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\rhrvh.exe upx behavioral1/memory/1532-274-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\fpbrl.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exerndfvr.exehbjnrvd.exelxdhrd.exextbtv.exepdnxl.exehrpbln.exepfplhl.exetthpbpl.exelrhppj.exevttndr.exejnrnvlt.exejlntdhv.exerrbxrvx.exebdlxb.exehjtlpnd.exedescription pid process target process PID 1280 wrote to memory of 2200 1280 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe rndfvr.exe PID 1280 wrote to memory of 2200 1280 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe rndfvr.exe PID 1280 wrote to memory of 2200 1280 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe rndfvr.exe PID 1280 wrote to memory of 2200 1280 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe rndfvr.exe PID 2200 wrote to memory of 3040 2200 rndfvr.exe hbjnrvd.exe PID 2200 wrote to memory of 3040 2200 rndfvr.exe hbjnrvd.exe PID 2200 wrote to memory of 3040 2200 rndfvr.exe hbjnrvd.exe PID 2200 wrote to memory of 3040 2200 rndfvr.exe hbjnrvd.exe PID 3040 wrote to memory of 2672 3040 hbjnrvd.exe lxdhrd.exe PID 3040 wrote to memory of 2672 3040 hbjnrvd.exe lxdhrd.exe PID 3040 wrote to memory of 2672 3040 hbjnrvd.exe lxdhrd.exe PID 3040 wrote to memory of 2672 3040 hbjnrvd.exe lxdhrd.exe PID 2672 wrote to memory of 2504 2672 lxdhrd.exe xtbtv.exe PID 2672 wrote to memory of 2504 2672 lxdhrd.exe xtbtv.exe PID 2672 wrote to memory of 2504 2672 lxdhrd.exe xtbtv.exe PID 2672 wrote to memory of 2504 2672 lxdhrd.exe xtbtv.exe PID 2504 wrote to memory of 2624 2504 xtbtv.exe pdnxl.exe PID 2504 wrote to memory of 2624 2504 xtbtv.exe pdnxl.exe PID 2504 wrote to memory of 2624 2504 xtbtv.exe pdnxl.exe PID 2504 wrote to memory of 2624 2504 xtbtv.exe pdnxl.exe PID 2624 wrote to memory of 2748 2624 pdnxl.exe hrpbln.exe PID 2624 wrote to memory of 2748 2624 pdnxl.exe hrpbln.exe PID 2624 wrote to memory of 2748 2624 pdnxl.exe hrpbln.exe PID 2624 wrote to memory of 2748 2624 pdnxl.exe hrpbln.exe PID 2748 wrote to memory of 2944 2748 hrpbln.exe pfplhl.exe PID 2748 wrote to memory of 2944 2748 hrpbln.exe pfplhl.exe PID 2748 wrote to memory of 2944 2748 hrpbln.exe pfplhl.exe PID 2748 wrote to memory of 2944 2748 hrpbln.exe pfplhl.exe PID 2944 wrote to memory of 2472 2944 pfplhl.exe tthpbpl.exe PID 2944 wrote to memory of 2472 2944 pfplhl.exe tthpbpl.exe PID 2944 wrote to memory of 2472 2944 pfplhl.exe tthpbpl.exe PID 2944 wrote to memory of 2472 2944 pfplhl.exe tthpbpl.exe PID 2472 wrote to memory of 2324 2472 tthpbpl.exe lrhppj.exe PID 2472 wrote to memory of 2324 2472 tthpbpl.exe lrhppj.exe PID 2472 wrote to memory of 2324 2472 tthpbpl.exe lrhppj.exe PID 2472 wrote to memory of 2324 2472 tthpbpl.exe lrhppj.exe PID 2324 wrote to memory of 580 2324 lrhppj.exe vttndr.exe PID 2324 wrote to memory of 580 2324 lrhppj.exe vttndr.exe PID 2324 wrote to memory of 580 2324 lrhppj.exe vttndr.exe PID 2324 wrote to memory of 580 2324 lrhppj.exe vttndr.exe PID 580 wrote to memory of 2696 580 vttndr.exe jnrnvlt.exe PID 580 wrote to memory of 2696 580 vttndr.exe jnrnvlt.exe PID 580 wrote to memory of 2696 580 vttndr.exe jnrnvlt.exe PID 580 wrote to memory of 2696 580 vttndr.exe jnrnvlt.exe PID 2696 wrote to memory of 2764 2696 jnrnvlt.exe jlntdhv.exe PID 2696 wrote to memory of 2764 2696 jnrnvlt.exe jlntdhv.exe PID 2696 wrote to memory of 2764 2696 jnrnvlt.exe jlntdhv.exe PID 2696 wrote to memory of 2764 2696 jnrnvlt.exe jlntdhv.exe PID 2764 wrote to memory of 1232 2764 jlntdhv.exe rrbxrvx.exe PID 2764 wrote to memory of 1232 2764 jlntdhv.exe rrbxrvx.exe PID 2764 wrote to memory of 1232 2764 jlntdhv.exe rrbxrvx.exe PID 2764 wrote to memory of 1232 2764 jlntdhv.exe rrbxrvx.exe PID 1232 wrote to memory of 896 1232 rrbxrvx.exe bdlxb.exe PID 1232 wrote to memory of 896 1232 rrbxrvx.exe bdlxb.exe PID 1232 wrote to memory of 896 1232 rrbxrvx.exe bdlxb.exe PID 1232 wrote to memory of 896 1232 rrbxrvx.exe bdlxb.exe PID 896 wrote to memory of 1948 896 bdlxb.exe hjtlpnd.exe PID 896 wrote to memory of 1948 896 bdlxb.exe hjtlpnd.exe PID 896 wrote to memory of 1948 896 bdlxb.exe hjtlpnd.exe PID 896 wrote to memory of 1948 896 bdlxb.exe hjtlpnd.exe PID 1948 wrote to memory of 1844 1948 hjtlpnd.exe vbphrn.exe PID 1948 wrote to memory of 1844 1948 hjtlpnd.exe vbphrn.exe PID 1948 wrote to memory of 1844 1948 hjtlpnd.exe vbphrn.exe PID 1948 wrote to memory of 1844 1948 hjtlpnd.exe vbphrn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\rndfvr.exec:\rndfvr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\hbjnrvd.exec:\hbjnrvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lxdhrd.exec:\lxdhrd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xtbtv.exec:\xtbtv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\pdnxl.exec:\pdnxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\hrpbln.exec:\hrpbln.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pfplhl.exec:\pfplhl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tthpbpl.exec:\tthpbpl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\lrhppj.exec:\lrhppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\vttndr.exec:\vttndr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\jnrnvlt.exec:\jnrnvlt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jlntdhv.exec:\jlntdhv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rrbxrvx.exec:\rrbxrvx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\bdlxb.exec:\bdlxb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\hjtlpnd.exec:\hjtlpnd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\vbphrn.exec:\vbphrn.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\dnvbhf.exec:\dnvbhf.exe18⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dxjvv.exec:\dxjvv.exe19⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jhvfhnt.exec:\jhvfhnt.exe20⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vbvrvt.exec:\vbvrvt.exe21⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xnphxtl.exec:\xnphxtl.exe22⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jrhjnv.exec:\jrhjnv.exe23⤵
- Executes dropped EXE
PID:3028 -
\??\c:\jthfdvt.exec:\jthfdvt.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\btrfl.exec:\btrfl.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\tnvhrfp.exec:\tnvhrfp.exe26⤵
- Executes dropped EXE
PID:1776 -
\??\c:\hrxtb.exec:\hrxtb.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\jhvhv.exec:\jhvhv.exe28⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tpbnj.exec:\tpbnj.exe29⤵
- Executes dropped EXE
PID:884 -
\??\c:\rhrvh.exec:\rhrvh.exe30⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fpbrl.exec:\fpbrl.exe31⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jjhdjf.exec:\jjhdjf.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\bjrrdrn.exec:\bjrrdrn.exe33⤵
- Executes dropped EXE
PID:876 -
\??\c:\tnvfj.exec:\tnvfj.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fthfdbl.exec:\fthfdbl.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bfphvf.exec:\bfphvf.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hfbhrhx.exec:\hfbhrhx.exe37⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hxfhd.exec:\hxfhd.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hdvtvh.exec:\hdvtvh.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rtdnlbv.exec:\rtdnlbv.exe40⤵
- Executes dropped EXE
PID:2064 -
\??\c:\trjpdvp.exec:\trjpdvp.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xnxjjnb.exec:\xnxjjnb.exe42⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fxtlj.exec:\fxtlj.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dnxfpr.exec:\dnxfpr.exe44⤵
- Executes dropped EXE
PID:2412 -
\??\c:\btjvvtp.exec:\btjvvtp.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dhrjpl.exec:\dhrjpl.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lvltpll.exec:\lvltpll.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\vrfjrrd.exec:\vrfjrrd.exe48⤵
- Executes dropped EXE
PID:268 -
\??\c:\hbjbpv.exec:\hbjbpv.exe49⤵
- Executes dropped EXE
PID:436 -
\??\c:\lbxbbpn.exec:\lbxbbpn.exe50⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rvrfx.exec:\rvrfx.exe51⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pnbhrxr.exec:\pnbhrxr.exe52⤵
- Executes dropped EXE
PID:924 -
\??\c:\vrjnpx.exec:\vrjnpx.exe53⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ffpbrlf.exec:\ffpbrlf.exe54⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ttdhttb.exec:\ttdhttb.exe55⤵
- Executes dropped EXE
PID:1508 -
\??\c:\nxnxjl.exec:\nxnxjl.exe56⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfhbvl.exec:\xfhbvl.exe57⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xrfdpnh.exec:\xrfdpnh.exe58⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xfxvjf.exec:\xfxvjf.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xnlrn.exec:\xnlrn.exe60⤵
- Executes dropped EXE
PID:1512 -
\??\c:\npljl.exec:\npljl.exe61⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dnfhnxn.exec:\dnfhnxn.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rvtdnv.exec:\rvtdnv.exe63⤵
- Executes dropped EXE
PID:1308 -
\??\c:\rdjtj.exec:\rdjtj.exe64⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bnflrv.exec:\bnflrv.exe65⤵
- Executes dropped EXE
PID:396 -
\??\c:\dfbhnxn.exec:\dfbhnxn.exe66⤵PID:1716
-
\??\c:\xftdt.exec:\xftdt.exe67⤵PID:1096
-
\??\c:\xvhhnr.exec:\xvhhnr.exe68⤵PID:1184
-
\??\c:\nnxffjl.exec:\nnxffjl.exe69⤵PID:2328
-
\??\c:\rjxlddj.exec:\rjxlddj.exe70⤵PID:1856
-
\??\c:\nhpvxl.exec:\nhpvxl.exe71⤵PID:2124
-
\??\c:\lprvhjf.exec:\lprvhjf.exe72⤵PID:1984
-
\??\c:\tlnrfr.exec:\tlnrfr.exe73⤵PID:1944
-
\??\c:\fnbjp.exec:\fnbjp.exe74⤵PID:1212
-
\??\c:\rfvnpxp.exec:\rfvnpxp.exe75⤵PID:1628
-
\??\c:\rnxfp.exec:\rnxfp.exe76⤵PID:1588
-
\??\c:\hnbxxp.exec:\hnbxxp.exe77⤵PID:2232
-
\??\c:\pdlfvx.exec:\pdlfvx.exe78⤵PID:728
-
\??\c:\rrjpbrt.exec:\rrjpbrt.exe79⤵PID:536
-
\??\c:\vnjdpj.exec:\vnjdpj.exe80⤵PID:1704
-
\??\c:\drpjpn.exec:\drpjpn.exe81⤵PID:1600
-
\??\c:\dtjhpv.exec:\dtjhpv.exe82⤵PID:2940
-
\??\c:\njbnfx.exec:\njbnfx.exe83⤵PID:2628
-
\??\c:\bjfbfbb.exec:\bjfbfbb.exe84⤵PID:2664
-
\??\c:\bpbjh.exec:\bpbjh.exe85⤵PID:2532
-
\??\c:\txrjlrp.exec:\txrjlrp.exe86⤵PID:2792
-
\??\c:\bhnbv.exec:\bhnbv.exe87⤵PID:2744
-
\??\c:\lpnbb.exec:\lpnbb.exe88⤵PID:1916
-
\??\c:\bfpnxjj.exec:\bfpnxjj.exe89⤵PID:2396
-
\??\c:\rtxnvp.exec:\rtxnvp.exe90⤵PID:2432
-
\??\c:\hdtvxn.exec:\hdtvxn.exe91⤵PID:2336
-
\??\c:\hrbnfd.exec:\hrbnfd.exe92⤵PID:2016
-
\??\c:\fnblhtx.exec:\fnblhtx.exe93⤵PID:520
-
\??\c:\nrbtlt.exec:\nrbtlt.exe94⤵PID:656
-
\??\c:\lptrv.exec:\lptrv.exe95⤵PID:2488
-
\??\c:\hrjfbjf.exec:\hrjfbjf.exe96⤵PID:2736
-
\??\c:\drhhtr.exec:\drhhtr.exe97⤵PID:2144
-
\??\c:\rvrjvt.exec:\rvrjvt.exe98⤵PID:2880
-
\??\c:\jjjphrx.exec:\jjjphrx.exe99⤵PID:1652
-
\??\c:\btfjp.exec:\btfjp.exe100⤵PID:744
-
\??\c:\ndxtr.exec:\ndxtr.exe101⤵PID:788
-
\??\c:\dxbpb.exec:\dxbpb.exe102⤵PID:1836
-
\??\c:\btlhtrr.exec:\btlhtrr.exe103⤵PID:1168
-
\??\c:\bldbf.exec:\bldbf.exe104⤵PID:1640
-
\??\c:\bpflhhv.exec:\bpflhhv.exe105⤵PID:1748
-
\??\c:\llxhn.exec:\llxhn.exe106⤵PID:3048
-
\??\c:\bhrhjh.exec:\bhrhjh.exe107⤵PID:2080
-
\??\c:\jdnhl.exec:\jdnhl.exe108⤵PID:2300
-
\??\c:\ljrhn.exec:\ljrhn.exe109⤵PID:2052
-
\??\c:\jftbpld.exec:\jftbpld.exe110⤵PID:2276
-
\??\c:\vnvxdrd.exec:\vnvxdrd.exe111⤵PID:432
-
\??\c:\bpllld.exec:\bpllld.exe112⤵PID:1548
-
\??\c:\bjnfrf.exec:\bjnfrf.exe113⤵PID:3020
-
\??\c:\tbjjpt.exec:\tbjjpt.exe114⤵PID:2000
-
\??\c:\vlrrb.exec:\vlrrb.exe115⤵PID:3012
-
\??\c:\tdhnbtp.exec:\tdhnbtp.exe116⤵PID:1980
-
\??\c:\vrvnjvx.exec:\vrvnjvx.exe117⤵PID:1772
-
\??\c:\pjxfrff.exec:\pjxfrff.exe118⤵PID:2092
-
\??\c:\hptptjd.exec:\hptptjd.exe119⤵PID:1428
-
\??\c:\tjrvdf.exec:\tjrvdf.exe120⤵PID:1468
-
\??\c:\jpvlx.exec:\jpvlx.exe121⤵PID:1756
-
\??\c:\vfdhhv.exec:\vfdhhv.exe122⤵PID:1340
-
\??\c:\nvvtrh.exec:\nvvtrh.exe123⤵PID:1992
-
\??\c:\ndjvxdj.exec:\ndjvxdj.exe124⤵PID:876
-
\??\c:\frbht.exec:\frbht.exe125⤵PID:1736
-
\??\c:\tbbrfdr.exec:\tbbrfdr.exe126⤵PID:2920
-
\??\c:\fvdlfff.exec:\fvdlfff.exe127⤵PID:1600
-
\??\c:\dvtfll.exec:\dvtfll.exe128⤵PID:2120
-
\??\c:\xhbpf.exec:\xhbpf.exe129⤵PID:2628
-
\??\c:\pvnvrth.exec:\pvnvrth.exe130⤵PID:2516
-
\??\c:\bnjtlbd.exec:\bnjtlbd.exe131⤵PID:2716
-
\??\c:\dftrjt.exec:\dftrjt.exe132⤵PID:2504
-
\??\c:\ffjxxn.exec:\ffjxxn.exe133⤵PID:2576
-
\??\c:\xnhtj.exec:\xnhtj.exe134⤵PID:2400
-
\??\c:\fpxplnv.exec:\fpxplnv.exe135⤵PID:1804
-
\??\c:\pnntn.exec:\pnntn.exe136⤵PID:2872
-
\??\c:\trnxpv.exec:\trnxpv.exe137⤵PID:3044
-
\??\c:\dtbxb.exec:\dtbxb.exe138⤵PID:2224
-
\??\c:\bjjvbjj.exec:\bjjvbjj.exe139⤵PID:760
-
\??\c:\htbbtdh.exec:\htbbtdh.exe140⤵PID:2500
-
\??\c:\rjnpl.exec:\rjnpl.exe141⤵PID:2308
-
\??\c:\jhpvbjl.exec:\jhpvbjl.exe142⤵PID:928
-
\??\c:\jvhpnd.exec:\jvhpnd.exe143⤵PID:1968
-
\??\c:\vjpbdx.exec:\vjpbdx.exe144⤵PID:2040
-
\??\c:\rlfjljd.exec:\rlfjljd.exe145⤵PID:1100
-
\??\c:\ffhjj.exec:\ffhjj.exe146⤵PID:364
-
\??\c:\xvthnnx.exec:\xvthnnx.exe147⤵PID:744
-
\??\c:\ltdpxjj.exec:\ltdpxjj.exe148⤵PID:788
-
\??\c:\fdrhvp.exec:\fdrhvp.exe149⤵PID:1860
-
\??\c:\bhhpnxv.exec:\bhhpnxv.exe150⤵PID:1168
-
\??\c:\hxpjl.exec:\hxpjl.exe151⤵PID:1640
-
\??\c:\jlpfthh.exec:\jlpfthh.exe152⤵PID:1512
-
\??\c:\phbxvh.exec:\phbxvh.exe153⤵PID:3004
-
\??\c:\txjvxjn.exec:\txjvxjn.exe154⤵PID:1284
-
\??\c:\vldxvrp.exec:\vldxvrp.exe155⤵PID:1308
-
\??\c:\hlhrdb.exec:\hlhrdb.exe156⤵PID:1848
-
\??\c:\jjlpdlj.exec:\jjlpdlj.exe157⤵PID:796
-
\??\c:\hdxlprt.exec:\hdxlprt.exe158⤵PID:1356
-
\??\c:\vhbbxjh.exec:\vhbbxjh.exe159⤵PID:2948
-
\??\c:\jvjvrd.exec:\jvjvrd.exe160⤵PID:1776
-
\??\c:\lnxbrl.exec:\lnxbrl.exe161⤵PID:1328
-
\??\c:\thhndd.exec:\thhndd.exe162⤵PID:1800
-
\??\c:\pnhbffx.exec:\pnhbffx.exe163⤵PID:2204
-
\??\c:\lrlvtl.exec:\lrlvtl.exe164⤵PID:1768
-
\??\c:\dbhhl.exec:\dbhhl.exe165⤵PID:1740
-
\??\c:\blbrtr.exec:\blbrtr.exe166⤵PID:2956
-
\??\c:\fprtjrn.exec:\fprtjrn.exe167⤵PID:2212
-
\??\c:\jnjvb.exec:\jnjvb.exe168⤵PID:1628
-
\??\c:\nlxhh.exec:\nlxhh.exe169⤵PID:1588
-
\??\c:\fjfbbh.exec:\fjfbbh.exe170⤵PID:1492
-
\??\c:\jtvfvff.exec:\jtvfvff.exe171⤵PID:1520
-
\??\c:\lhldv.exec:\lhldv.exe172⤵PID:1568
-
\??\c:\tjlrrr.exec:\tjlrrr.exe173⤵PID:1280
-
\??\c:\dplnn.exec:\dplnn.exe174⤵PID:2312
-
\??\c:\tjpphrb.exec:\tjpphrb.exe175⤵PID:2920
-
\??\c:\vhdlf.exec:\vhdlf.exe176⤵PID:2864
-
\??\c:\ttdrl.exec:\ttdrl.exe177⤵PID:2700
-
\??\c:\pbfbdb.exec:\pbfbdb.exe178⤵PID:2664
-
\??\c:\njnxxff.exec:\njnxxff.exe179⤵PID:2516
-
\??\c:\xjtfv.exec:\xjtfv.exe180⤵PID:2784
-
\??\c:\vfntbh.exec:\vfntbh.exe181⤵PID:2504
-
\??\c:\nhlbn.exec:\nhlbn.exe182⤵PID:2564
-
\??\c:\bhjfhxv.exec:\bhjfhxv.exe183⤵PID:2404
-
\??\c:\ptfnv.exec:\ptfnv.exe184⤵PID:2432
-
\??\c:\fthjjx.exec:\fthjjx.exe185⤵PID:2436
-
\??\c:\jtxjblv.exec:\jtxjblv.exe186⤵PID:2036
-
\??\c:\tlblx.exec:\tlblx.exe187⤵PID:2452
-
\??\c:\pnfrhr.exec:\pnfrhr.exe188⤵PID:1688
-
\??\c:\vvvjt.exec:\vvvjt.exe189⤵PID:1360
-
\??\c:\tnpxvvx.exec:\tnpxvvx.exe190⤵PID:2756
-
\??\c:\frflt.exec:\frflt.exe191⤵PID:1952
-
\??\c:\dxlflr.exec:\dxlflr.exe192⤵PID:928
-
\??\c:\pvhjd.exec:\pvhjd.exe193⤵PID:1968
-
\??\c:\vfvhhf.exec:\vfvhhf.exe194⤵PID:2040
-
\??\c:\drjjhft.exec:\drjjhft.exe195⤵PID:1508
-
\??\c:\drjrtp.exec:\drjrtp.exe196⤵PID:364
-
\??\c:\lxhvn.exec:\lxhvn.exe197⤵PID:920
-
\??\c:\dlrvj.exec:\dlrvj.exe198⤵PID:788
-
\??\c:\pvnvbj.exec:\pvnvbj.exe199⤵PID:1448
-
\??\c:\vvjhhrt.exec:\vvjhhrt.exe200⤵PID:1168
-
\??\c:\pvbxfjf.exec:\pvbxfjf.exe201⤵PID:1900
-
\??\c:\lrpfrrb.exec:\lrpfrrb.exe202⤵PID:1336
-
\??\c:\dlrftp.exec:\dlrftp.exe203⤵PID:3004
-
\??\c:\lrbvpj.exec:\lrbvpj.exe204⤵PID:2288
-
\??\c:\xxnnb.exec:\xxnnb.exe205⤵PID:1312
-
\??\c:\hpdvjr.exec:\hpdvjr.exe206⤵PID:2300
-
\??\c:\tjrfhhx.exec:\tjrfhhx.exe207⤵PID:1976
-
\??\c:\hbvbnfh.exec:\hbvbnfh.exe208⤵PID:1092
-
\??\c:\fhjvx.exec:\fhjvx.exe209⤵PID:432
-
\??\c:\ntbjtt.exec:\ntbjtt.exe210⤵PID:2060
-
\??\c:\xllvhb.exec:\xllvhb.exe211⤵PID:1712
-
\??\c:\vrbttfb.exec:\vrbttfb.exe212⤵PID:960
-
\??\c:\bnvvf.exec:\bnvvf.exe213⤵PID:3008
-
\??\c:\trdxtff.exec:\trdxtff.exe214⤵PID:1768
-
\??\c:\lbdlx.exec:\lbdlx.exe215⤵PID:1740
-
\??\c:\brhvr.exec:\brhvr.exe216⤵PID:2956
-
\??\c:\ndphf.exec:\ndphf.exe217⤵PID:2212
-
\??\c:\lvxnvdh.exec:\lvxnvdh.exe218⤵PID:1628
-
\??\c:\jbnltt.exec:\jbnltt.exe219⤵PID:1416
-
\??\c:\vndfthb.exec:\vndfthb.exe220⤵PID:2348
-
\??\c:\phlrr.exec:\phlrr.exe221⤵PID:2840
-
\??\c:\rrxtjvv.exec:\rrxtjvv.exe222⤵PID:2180
-
\??\c:\drhhxjn.exec:\drhhxjn.exe223⤵PID:2724
-
\??\c:\vlpfr.exec:\vlpfr.exe224⤵PID:2540
-
\??\c:\bnvfdbx.exec:\bnvfdbx.exe225⤵PID:2028
-
\??\c:\nbdtx.exec:\nbdtx.exe226⤵PID:1600
-
\??\c:\xlrhvv.exec:\xlrhvv.exe227⤵PID:2176
-
\??\c:\rdjvfpn.exec:\rdjvfpn.exe228⤵PID:2556
-
\??\c:\xttfhp.exec:\xttfhp.exe229⤵PID:2020
-
\??\c:\pbhjbt.exec:\pbhjbt.exe230⤵PID:2596
-
\??\c:\tjjjnx.exec:\tjjjnx.exe231⤵PID:1916
-
\??\c:\vbntj.exec:\vbntj.exe232⤵PID:2576
-
\??\c:\ppjlrp.exec:\ppjlrp.exe233⤵PID:2464
-
\??\c:\fvjnlj.exec:\fvjnlj.exe234⤵PID:2420
-
\??\c:\pxvjxnv.exec:\pxvjxnv.exe235⤵PID:2384
-
\??\c:\tdvhh.exec:\tdvhh.exe236⤵PID:2192
-
\??\c:\pbvbhh.exec:\pbvbhh.exe237⤵PID:760
-
\??\c:\trbfx.exec:\trbfx.exe238⤵PID:2728
-
\??\c:\fxdpj.exec:\fxdpj.exe239⤵PID:528
-
\??\c:\tlfnrr.exec:\tlfnrr.exe240⤵PID:1324
-
\??\c:\bjptjdr.exec:\bjptjdr.exe241⤵PID:2012
-
\??\c:\nlrddx.exec:\nlrddx.exe242⤵PID:1228