Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:11
Behavioral task
behavioral1
Sample
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
-
Size
211KB
-
MD5
028dd507a78a4791cbdc0018877b4480
-
SHA1
d4f31113b3394559707aeab3852f731656c0d707
-
SHA256
727cb528e82374bdda6fb1fbd54829e9f54380b0c39468c3cbfe82f0cfc777e5
-
SHA512
5410b122c2cb1242ed84e8881abf512208e488d54064f9362cfe6b64ef975166840c06e679b73a3814da04a40b705cc0c75d3e0758e4295ae569d4657d4e788a
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+ly:V4wFHoSBK/ubLcfo
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2424-76-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1772-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2704-131-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1272-160-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3048-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2224-260-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/624-307-0x00000000003C0000-0x00000000003F4000-memory.dmp family_blackmoon behavioral1/memory/2788-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1196-460-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2356-637-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2884-682-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3024-707-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2032-741-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1028-780-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2432-879-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2328-1058-0x0000000000220000-0x0000000000254000-memory.dmp family_blackmoon behavioral1/memory/1356-839-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/900-819-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/472-523-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2192-515-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2328-482-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2440-468-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2184-462-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2104-441-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1488-410-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2956-342-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2476-328-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1416-227-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2136-202-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2748-185-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1372-158-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2120-149-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2572-113-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1632-94-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/1632-92-0x00000000001B0000-0x00000000001E4000-memory.dmp family_blackmoon behavioral1/memory/2424-84-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2376-65-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2456-47-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2544-31-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2492-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/3068-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral1/memory/2908-8-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x000d00000001230f-10.dat family_berbew behavioral1/memory/2492-21-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x000a000000012343-30.dat family_berbew behavioral1/files/0x0009000000012345-37.dat family_berbew behavioral1/files/0x000900000001234d-57.dat family_berbew behavioral1/files/0x0009000000012351-67.dat family_berbew behavioral1/memory/2424-76-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0009000000013144-75.dat family_berbew behavioral1/memory/1772-104-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0007000000013309-102.dat family_berbew behavioral1/files/0x00070000000133bc-114.dat family_berbew behavioral1/memory/2704-122-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2704-131-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0007000000013599-141.dat family_berbew behavioral1/files/0x0007000000013708-150.dat family_berbew behavioral1/memory/1272-160-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0007000000013a53-174.dat family_berbew behavioral1/files/0x0007000000013a88-186.dat family_berbew behavioral1/files/0x0006000000013f2c-201.dat family_berbew behavioral1/memory/3048-211-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/files/0x0006000000014251-237.dat family_berbew behavioral1/files/0x000600000001431b-245.dat family_berbew behavioral1/files/0x000600000001432f-253.dat family_berbew behavioral1/memory/2224-260-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/624-307-0x00000000003C0000-0x00000000003F4000-memory.dmp family_berbew behavioral1/memory/2788-314-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2956-335-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2416-355-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1196-460-0x00000000001B0000-0x00000000001E4000-memory.dmp family_berbew behavioral1/memory/2328-475-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2320-587-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2456-618-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2356-637-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2680-675-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1768-656-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2884-682-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/3024-707-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1264-727-0x00000000003A0000-0x00000000003D4000-memory.dmp family_berbew behavioral1/memory/2032-741-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1572-773-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1028-780-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2192-799-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/108-806-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2432-879-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2376-922-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2400-943-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1608-1051-0x0000000000220000-0x0000000000254000-memory.dmp family_berbew behavioral1/memory/1556-1109-0x0000000000230000-0x0000000000264000-memory.dmp family_berbew behavioral1/memory/2776-1024-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2364-962-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1992-859-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1356-832-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/900-819-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1660-754-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/472-523-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2192-515-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2192-508-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2328-482-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2440-468-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2184-462-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2104-441-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/1488-410-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral1/memory/2956-342-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 3068 1fxrxrr.exe 2492 nbnbtb.exe 2544 nhhnbt.exe 2456 vvjvj.exe 2676 lrfrxxx.exe 2376 rlrlflx.exe 2100 ttbtbn.exe 2424 jdvjp.exe 1632 jdvvj.exe 1772 rffxffx.exe 2572 nhhtbb.exe 2708 pdjdp.exe 2704 xxrrllx.exe 2072 lxlrxfl.exe 2120 hbbnnn.exe 1372 5ppdj.exe 1272 rxxlfrr.exe 1196 bntbhh.exe 2748 7jpvv.exe 2900 pjvdj.exe 2136 rlfrflx.exe 3048 bhbttb.exe 768 vpddj.exe 1416 dvpvj.exe 1680 xlxlxrf.exe 1708 htnbnb.exe 1816 5bbtbb.exe 2224 jddpd.exe 600 5ffxrlf.exe 2240 hhthtt.exe 1716 pjddp.exe 2208 jdjpv.exe 2840 lxlxxff.exe 624 rrfrxfl.exe 1532 nhtbnt.exe 2788 pjjpd.exe 2276 rxllfxl.exe 2476 7xlxxfl.exe 2956 5bbnth.exe 2576 hhntht.exe 2516 dpjdv.exe 2416 xfrrrxl.exe 2472 1rllxxf.exe 2756 bhhhtt.exe 1464 hnthhb.exe 1632 7pppd.exe 2964 vpdvj.exe 2596 rfxxxrr.exe 2620 5frxrff.exe 1488 tbbbth.exe 1976 jjdjp.exe 1508 7ppjd.exe 2132 lffxxxx.exe 1204 rfrrlrf.exe 2692 btthtb.exe 2104 bthbbb.exe 2612 vdpvv.exe 1196 1jdjp.exe 2184 xlrrfxx.exe 2440 rrffllf.exe 2328 bttntb.exe 2016 9thnbh.exe 1028 pvdvp.exe 1808 pjjvp.exe -
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000d00000001230f-10.dat upx behavioral1/memory/2492-21-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x000a000000012343-30.dat upx behavioral1/files/0x0009000000012345-37.dat upx behavioral1/files/0x000900000001234d-57.dat upx behavioral1/files/0x0009000000012351-67.dat upx behavioral1/memory/2424-76-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0009000000013144-75.dat upx behavioral1/memory/1772-104-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000013309-102.dat upx behavioral1/files/0x00070000000133bc-114.dat upx behavioral1/memory/2704-122-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2704-131-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000013599-141.dat upx behavioral1/files/0x0007000000013708-150.dat upx behavioral1/memory/1272-160-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0007000000013a53-174.dat upx behavioral1/files/0x0007000000013a88-186.dat upx behavioral1/files/0x0006000000013f2c-201.dat upx behavioral1/memory/3048-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/files/0x0006000000014251-237.dat upx behavioral1/files/0x000600000001431b-245.dat upx behavioral1/files/0x000600000001432f-253.dat upx behavioral1/memory/2224-260-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2788-314-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2956-335-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2416-355-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2328-475-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2320-587-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2456-618-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2356-637-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2680-675-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1768-656-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2884-682-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/3024-707-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2032-741-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1572-773-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1028-780-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2192-799-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/108-806-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1992-862-0x0000000000220000-0x0000000000254000-memory.dmp upx behavioral1/memory/2432-879-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2376-922-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2400-943-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1556-1109-0x0000000000230000-0x0000000000264000-memory.dmp upx behavioral1/memory/2776-1024-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2364-962-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1992-859-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1356-832-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/900-819-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1660-754-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/472-523-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2192-515-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2192-508-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2328-482-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2440-468-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2184-462-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2104-441-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/1488-410-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2956-342-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2476-328-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/2276-321-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral1/memory/624-299-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3068 2908 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 917 PID 2908 wrote to memory of 3068 2908 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 917 PID 2908 wrote to memory of 3068 2908 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 917 PID 2908 wrote to memory of 3068 2908 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 917 PID 3068 wrote to memory of 2492 3068 1fxrxrr.exe 29 PID 3068 wrote to memory of 2492 3068 1fxrxrr.exe 29 PID 3068 wrote to memory of 2492 3068 1fxrxrr.exe 29 PID 3068 wrote to memory of 2492 3068 1fxrxrr.exe 29 PID 2492 wrote to memory of 2544 2492 nbnbtb.exe 30 PID 2492 wrote to memory of 2544 2492 nbnbtb.exe 30 PID 2492 wrote to memory of 2544 2492 nbnbtb.exe 30 PID 2492 wrote to memory of 2544 2492 nbnbtb.exe 30 PID 2544 wrote to memory of 2456 2544 nhhnbt.exe 31 PID 2544 wrote to memory of 2456 2544 nhhnbt.exe 31 PID 2544 wrote to memory of 2456 2544 nhhnbt.exe 31 PID 2544 wrote to memory of 2456 2544 nhhnbt.exe 31 PID 2456 wrote to memory of 2676 2456 vvjvj.exe 32 PID 2456 wrote to memory of 2676 2456 vvjvj.exe 32 PID 2456 wrote to memory of 2676 2456 vvjvj.exe 32 PID 2456 wrote to memory of 2676 2456 vvjvj.exe 32 PID 2676 wrote to memory of 2376 2676 lrfrxxx.exe 927 PID 2676 wrote to memory of 2376 2676 lrfrxxx.exe 927 PID 2676 wrote to memory of 2376 2676 lrfrxxx.exe 927 PID 2676 wrote to memory of 2376 2676 lrfrxxx.exe 927 PID 2376 wrote to memory of 2100 2376 rlrlflx.exe 34 PID 2376 wrote to memory of 2100 2376 rlrlflx.exe 34 PID 2376 wrote to memory of 2100 2376 rlrlflx.exe 34 PID 2376 wrote to memory of 2100 2376 rlrlflx.exe 34 PID 2100 wrote to memory of 2424 2100 ttbtbn.exe 35 PID 2100 wrote to memory of 2424 2100 ttbtbn.exe 35 PID 2100 wrote to memory of 2424 2100 ttbtbn.exe 35 PID 2100 wrote to memory of 2424 2100 ttbtbn.exe 35 PID 2424 wrote to memory of 1632 2424 jdvjp.exe 925 PID 2424 wrote to memory of 1632 2424 jdvjp.exe 925 PID 2424 wrote to memory of 1632 2424 jdvjp.exe 925 PID 2424 wrote to memory of 1632 2424 jdvjp.exe 925 PID 1632 wrote to memory of 1772 1632 jdvvj.exe 690 PID 1632 wrote to memory of 1772 1632 jdvvj.exe 690 PID 1632 wrote to memory of 1772 1632 jdvvj.exe 690 PID 1632 wrote to memory of 1772 1632 jdvvj.exe 690 PID 1772 wrote to memory of 2572 1772 rffxffx.exe 883 PID 1772 wrote to memory of 2572 1772 rffxffx.exe 883 PID 1772 wrote to memory of 2572 1772 rffxffx.exe 883 PID 1772 wrote to memory of 2572 1772 rffxffx.exe 883 PID 2572 wrote to memory of 2708 2572 nhhtbb.exe 39 PID 2572 wrote to memory of 2708 2572 nhhtbb.exe 39 PID 2572 wrote to memory of 2708 2572 nhhtbb.exe 39 PID 2572 wrote to memory of 2708 2572 nhhtbb.exe 39 PID 2708 wrote to memory of 2704 2708 pdjdp.exe 40 PID 2708 wrote to memory of 2704 2708 pdjdp.exe 40 PID 2708 wrote to memory of 2704 2708 pdjdp.exe 40 PID 2708 wrote to memory of 2704 2708 pdjdp.exe 40 PID 2704 wrote to memory of 2072 2704 xxrrllx.exe 889 PID 2704 wrote to memory of 2072 2704 xxrrllx.exe 889 PID 2704 wrote to memory of 2072 2704 xxrrllx.exe 889 PID 2704 wrote to memory of 2072 2704 xxrrllx.exe 889 PID 2072 wrote to memory of 2120 2072 lxlrxfl.exe 886 PID 2072 wrote to memory of 2120 2072 lxlrxfl.exe 886 PID 2072 wrote to memory of 2120 2072 lxlrxfl.exe 886 PID 2072 wrote to memory of 2120 2072 lxlrxfl.exe 886 PID 2120 wrote to memory of 1372 2120 hbbnnn.exe 43 PID 2120 wrote to memory of 1372 2120 hbbnnn.exe 43 PID 2120 wrote to memory of 1372 2120 hbbnnn.exe 43 PID 2120 wrote to memory of 1372 2120 hbbnnn.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\1fxrxrr.exec:\1fxrxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nbnbtb.exec:\nbnbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\nhhnbt.exec:\nhhnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vvjvj.exec:\vvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\lrfrxxx.exec:\lrfrxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rlrlflx.exec:\rlrlflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\ttbtbn.exec:\ttbtbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\jdvjp.exec:\jdvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\jdvvj.exec:\jdvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rffxffx.exec:\rffxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\nhhtbb.exec:\nhhtbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pdjdp.exec:\pdjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xxrrllx.exec:\xxrrllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lxlrxfl.exec:\lxlrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\hbbnnn.exec:\hbbnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\5ppdj.exec:\5ppdj.exe17⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rxxlfrr.exec:\rxxlfrr.exe18⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bntbhh.exec:\bntbhh.exe19⤵
- Executes dropped EXE
PID:1196 -
\??\c:\7jpvv.exec:\7jpvv.exe20⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pjvdj.exec:\pjvdj.exe21⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rlfrflx.exec:\rlfrflx.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\bhbttb.exec:\bhbttb.exe23⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vpddj.exec:\vpddj.exe24⤵
- Executes dropped EXE
PID:768 -
\??\c:\dvpvj.exec:\dvpvj.exe25⤵
- Executes dropped EXE
PID:1416 -
\??\c:\xlxlxrf.exec:\xlxlxrf.exe26⤵
- Executes dropped EXE
PID:1680 -
\??\c:\htnbnb.exec:\htnbnb.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\5bbtbb.exec:\5bbtbb.exe28⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jddpd.exec:\jddpd.exe29⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5ffxrlf.exec:\5ffxrlf.exe30⤵
- Executes dropped EXE
PID:600 -
\??\c:\hhthtt.exec:\hhthtt.exe31⤵
- Executes dropped EXE
PID:2240 -
\??\c:\pjddp.exec:\pjddp.exe32⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jdjpv.exec:\jdjpv.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lxlxxff.exec:\lxlxxff.exe34⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rrfrxfl.exec:\rrfrxfl.exe35⤵
- Executes dropped EXE
PID:624 -
\??\c:\nhtbnt.exec:\nhtbnt.exe36⤵
- Executes dropped EXE
PID:1532 -
\??\c:\pjjpd.exec:\pjjpd.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rxllfxl.exec:\rxllfxl.exe38⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7xlxxfl.exec:\7xlxxfl.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\5bbnth.exec:\5bbnth.exe40⤵
- Executes dropped EXE
PID:2956 -
\??\c:\hhntht.exec:\hhntht.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dpjdv.exec:\dpjdv.exe42⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xfrrrxl.exec:\xfrrrxl.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1rllxxf.exec:\1rllxxf.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bhhhtt.exec:\bhhhtt.exe45⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hnthhb.exec:\hnthhb.exe46⤵
- Executes dropped EXE
PID:1464 -
\??\c:\7pppd.exec:\7pppd.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vpdvj.exec:\vpdvj.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rfxxxrr.exec:\rfxxxrr.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\5frxrff.exec:\5frxrff.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tbbbth.exec:\tbbbth.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jjdjp.exec:\jjdjp.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\7ppjd.exec:\7ppjd.exe53⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lffxxxx.exec:\lffxxxx.exe54⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rfrrlrf.exec:\rfrrlrf.exe55⤵
- Executes dropped EXE
PID:1204 -
\??\c:\btthtb.exec:\btthtb.exe56⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bthbbb.exec:\bthbbb.exe57⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vdpvv.exec:\vdpvv.exe58⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1jdjp.exec:\1jdjp.exe59⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xlrrfxx.exec:\xlrrfxx.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrffllf.exec:\rrffllf.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bttntb.exec:\bttntb.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9thnbh.exec:\9thnbh.exe63⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pvdvp.exec:\pvdvp.exe64⤵
- Executes dropped EXE
PID:1028 -
\??\c:\pjjvp.exec:\pjjvp.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xlxfffl.exec:\xlxfffl.exe66⤵PID:2040
-
\??\c:\xrlrrfr.exec:\xrlrrfr.exe67⤵PID:2192
-
\??\c:\9hnhbb.exec:\9hnhbb.exe68⤵PID:1888
-
\??\c:\hbbnbb.exec:\hbbnbb.exe69⤵PID:472
-
\??\c:\vpdvp.exec:\vpdvp.exe70⤵PID:900
-
\??\c:\vjdjd.exec:\vjdjd.exe71⤵PID:680
-
\??\c:\1rrrflr.exec:\1rrrflr.exe72⤵PID:1356
-
\??\c:\llflxfl.exec:\llflxfl.exe73⤵PID:536
-
\??\c:\bnnnbt.exec:\bnnnbt.exe74⤵PID:1248
-
\??\c:\3tnntt.exec:\3tnntt.exe75⤵PID:1820
-
\??\c:\ddvdp.exec:\ddvdp.exe76⤵PID:2208
-
\??\c:\jdvvj.exec:\jdvvj.exe77⤵PID:1800
-
\??\c:\ppjjp.exec:\ppjjp.exe78⤵PID:2936
-
\??\c:\1flrxrr.exec:\1flrxrr.exe79⤵PID:2320
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe80⤵PID:2148
-
\??\c:\hbtbnt.exec:\hbtbnt.exe81⤵PID:2788
-
\??\c:\hbntbb.exec:\hbntbb.exe82⤵PID:2552
-
\??\c:\9vvdj.exec:\9vvdj.exe83⤵PID:2568
-
\??\c:\3vpvj.exec:\3vpvj.exe84⤵PID:2456
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe85⤵PID:1432
-
\??\c:\tntbhn.exec:\tntbhn.exe86⤵PID:2500
-
\??\c:\thhbnn.exec:\thhbnn.exe87⤵PID:2356
-
\??\c:\pjdjp.exec:\pjdjp.exe88⤵PID:2100
-
\??\c:\pdvdp.exec:\pdvdp.exe89⤵PID:1948
-
\??\c:\9xlxllr.exec:\9xlxllr.exe90⤵PID:1768
-
\??\c:\xrfrfrf.exec:\xrfrfrf.exe91⤵PID:2372
-
\??\c:\lllxxfx.exec:\lllxxfx.exe92⤵PID:1120
-
\??\c:\nhnnbh.exec:\nhnnbh.exe93⤵PID:2680
-
\??\c:\btnnth.exec:\btnnth.exe94⤵PID:2884
-
\??\c:\5jdpj.exec:\5jdpj.exe95⤵PID:2716
-
\??\c:\vpdvd.exec:\vpdvd.exe96⤵PID:1912
-
\??\c:\lfflxfx.exec:\lfflxfx.exe97⤵PID:2600
-
\??\c:\5rrlrrx.exec:\5rrlrrx.exe98⤵PID:3024
-
\??\c:\bhbnhb.exec:\bhbnhb.exe99⤵PID:2124
-
\??\c:\thnttn.exec:\thnttn.exe100⤵PID:1264
-
\??\c:\ddppv.exec:\ddppv.exe101⤵PID:2036
-
\??\c:\vjjvv.exec:\vjjvv.exe102⤵PID:2032
-
\??\c:\fffrfrx.exec:\fffrfrx.exe103⤵PID:1364
-
\??\c:\1bnnbn.exec:\1bnnbn.exe104⤵PID:1520
-
\??\c:\tbtbnt.exec:\tbtbnt.exe105⤵PID:1660
-
\??\c:\ddpdv.exec:\ddpdv.exe106⤵PID:2816
-
\??\c:\flxfrxx.exec:\flxfrxx.exe107⤵PID:880
-
\??\c:\rfxlrxf.exec:\rfxlrxf.exe108⤵PID:1572
-
\??\c:\xlflfxl.exec:\xlflfxl.exe109⤵PID:1028
-
\??\c:\bbtntn.exec:\bbtntn.exe110⤵PID:2236
-
\??\c:\bhhhbt.exec:\bhhhbt.exe111⤵PID:2764
-
\??\c:\9ddpv.exec:\9ddpv.exe112⤵PID:2192
-
\??\c:\xllxfxr.exec:\xllxfxr.exe113⤵PID:108
-
\??\c:\rrrxlfl.exec:\rrrxlfl.exe114⤵PID:984
-
\??\c:\ttbnht.exec:\ttbnht.exe115⤵PID:900
-
\??\c:\vvvjj.exec:\vvvjj.exe116⤵PID:800
-
\??\c:\pjdvj.exec:\pjdvj.exe117⤵PID:1356
-
\??\c:\lfxrlll.exec:\lfxrlll.exe118⤵PID:856
-
\??\c:\xrxfrrr.exec:\xrxfrrr.exe119⤵PID:1452
-
\??\c:\bnnnhb.exec:\bnnnhb.exe120⤵PID:1308
-
\??\c:\hbbnht.exec:\hbbnht.exe121⤵PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-