Analysis
-
max time kernel
143s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:11
Behavioral task
behavioral1
Sample
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
General
-
Target
028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe
-
Size
211KB
-
MD5
028dd507a78a4791cbdc0018877b4480
-
SHA1
d4f31113b3394559707aeab3852f731656c0d707
-
SHA256
727cb528e82374bdda6fb1fbd54829e9f54380b0c39468c3cbfe82f0cfc777e5
-
SHA512
5410b122c2cb1242ed84e8881abf512208e488d54064f9362cfe6b64ef975166840c06e679b73a3814da04a40b705cc0c75d3e0758e4295ae569d4657d4e788a
-
SSDEEP
6144:Hcm4FmowdHoSrXZf8l/ubPzYNLPf4t+ly:V4wFHoSBK/ubLcfo
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2028-397-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3972-377-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4032-350-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-346-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1108-314-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3540-309-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4196-308-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4632-286-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4492-277-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-275-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4028-270-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4844-232-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3056-206-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3768-196-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4684-186-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1668-155-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1108-150-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3036-132-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4408-121-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/824-114-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/2500-104-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/696-93-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1624-87-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4772-85-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1772-75-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/552-73-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/4848-61-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/1588-594-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/5068-626-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon behavioral2/memory/3252-633-0x0000000000400000-0x0000000000434000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000800000002340d-4.dat family_berbew behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023414-12.dat family_berbew behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0008000000023410-10.dat family_berbew behavioral2/memory/4348-24-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023416-30.dat family_berbew behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/5008-43-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023418-42.dat family_berbew behavioral2/memory/4848-56-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341b-55.dat family_berbew behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341c-62.dat family_berbew behavioral2/files/0x000700000002341d-68.dat family_berbew behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002341e-71.dat family_berbew behavioral2/files/0x0007000000023420-86.dat family_berbew behavioral2/files/0x0007000000023422-98.dat family_berbew behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x0007000000023424-109.dat family_berbew behavioral2/files/0x0007000000023425-115.dat family_berbew behavioral2/files/0x0007000000023428-126.dat family_berbew behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/files/0x000700000002342f-165.dat family_berbew behavioral2/files/0x0007000000023431-173.dat family_berbew behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3608-221-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4196-304-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4772-416-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3300-437-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/844-459-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1108-474-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3468-531-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4512-488-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/3696-426-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/2056-409-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew behavioral2/memory/4696-401-0x0000000000400000-0x0000000000434000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
pid Process 4752 rrlfrlf.exe 852 9hnbnh.exe 4948 5bbthh.exe 4348 vpdvj.exe 3368 1rfxxxl.exe 4036 9xllrrx.exe 5008 ttnbht.exe 3468 pvvvp.exe 4848 7jpjj.exe 3040 fxlfrrf.exe 552 tnhbbb.exe 1772 vvpdp.exe 4772 3vdpj.exe 1624 1llfrrf.exe 696 rlrffxf.exe 2500 hbnbtn.exe 2780 vdvpj.exe 824 jjdvp.exe 4408 5flflfr.exe 1336 nnhbbt.exe 1712 vdjdv.exe 3036 jppdp.exe 1912 lxflrxf.exe 3460 lflxrlf.exe 1108 htnbnh.exe 1668 7jvjp.exe 2344 ppdpd.exe 4500 fxlfllx.exe 4572 5bbnnh.exe 2700 3vvpj.exe 4684 pvdpv.exe 2776 3xxrrrr.exe 3008 lrlfxxr.exe 3768 9ttnhh.exe 4868 vpvpp.exe 4832 pdvpp.exe 3056 rlxrlfx.exe 3728 xlrllfx.exe 4284 5httbb.exe 3644 pjppp.exe 4592 vdjjp.exe 3608 flrlffl.exe 1304 bhhhhb.exe 1984 hhhhbb.exe 4844 ppjpd.exe 4828 jvdvp.exe 5096 rflfxxr.exe 1280 flffxxr.exe 2068 hbntht.exe 3672 nntnnn.exe 3724 vvdvv.exe 1772 5ddpv.exe 1420 lrxrffx.exe 5044 xffxlfr.exe 2356 hbtbnh.exe 4028 vvvpd.exe 2500 ppdvd.exe 4492 flxxxxx.exe 2388 7ffrfxr.exe 4872 1tbtnn.exe 4632 pjdpd.exe 3848 dvvpv.exe 4012 1xlxfxx.exe 4132 xrlfrlx.exe -
resource yara_rule behavioral2/memory/5004-0-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000800000002340d-4.dat upx behavioral2/memory/4752-7-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023414-12.dat upx behavioral2/memory/4948-19-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/852-13-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0008000000023410-10.dat upx behavioral2/memory/4348-24-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023416-30.dat upx behavioral2/memory/4348-29-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4036-37-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3368-36-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5008-43-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023418-42.dat upx behavioral2/memory/4848-56-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341b-55.dat upx behavioral2/memory/3468-50-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/5008-49-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341c-62.dat upx behavioral2/files/0x000700000002341d-68.dat upx behavioral2/memory/3040-67-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002341e-71.dat upx behavioral2/files/0x0007000000023420-86.dat upx behavioral2/files/0x0007000000023422-98.dat upx behavioral2/memory/2780-105-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x0007000000023424-109.dat upx behavioral2/files/0x0007000000023425-115.dat upx behavioral2/files/0x0007000000023428-126.dat upx behavioral2/memory/1912-143-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/files/0x000700000002342f-165.dat upx behavioral2/files/0x0007000000023431-173.dat upx behavioral2/memory/3008-192-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3728-211-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3608-221-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2068-247-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3724-254-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1420-259-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3848-293-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4196-304-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3940-320-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2824-332-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2592-360-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4696-405-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4772-416-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3300-437-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3064-444-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/532-448-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/844-459-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1108-474-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3468-535-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2860-539-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3468-531-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4032-503-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1752-499-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3828-495-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4512-488-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4224-481-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3424-473-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/844-463-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/1436-452-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4580-433-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/3696-426-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/2056-409-0x0000000000400000-0x0000000000434000-memory.dmp upx behavioral2/memory/4696-401-0x0000000000400000-0x0000000000434000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 82 PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 82 PID 5004 wrote to memory of 4752 5004 028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe 82 PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 83 PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 83 PID 4752 wrote to memory of 852 4752 rrlfrlf.exe 83 PID 852 wrote to memory of 4948 852 9hnbnh.exe 84 PID 852 wrote to memory of 4948 852 9hnbnh.exe 84 PID 852 wrote to memory of 4948 852 9hnbnh.exe 84 PID 4948 wrote to memory of 4348 4948 5bbthh.exe 85 PID 4948 wrote to memory of 4348 4948 5bbthh.exe 85 PID 4948 wrote to memory of 4348 4948 5bbthh.exe 85 PID 4348 wrote to memory of 3368 4348 vpdvj.exe 86 PID 4348 wrote to memory of 3368 4348 vpdvj.exe 86 PID 4348 wrote to memory of 3368 4348 vpdvj.exe 86 PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 87 PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 87 PID 3368 wrote to memory of 4036 3368 1rfxxxl.exe 87 PID 4036 wrote to memory of 5008 4036 9xllrrx.exe 88 PID 4036 wrote to memory of 5008 4036 9xllrrx.exe 88 PID 4036 wrote to memory of 5008 4036 9xllrrx.exe 88 PID 5008 wrote to memory of 3468 5008 ttnbht.exe 89 PID 5008 wrote to memory of 3468 5008 ttnbht.exe 89 PID 5008 wrote to memory of 3468 5008 ttnbht.exe 89 PID 3468 wrote to memory of 4848 3468 pvvvp.exe 90 PID 3468 wrote to memory of 4848 3468 pvvvp.exe 90 PID 3468 wrote to memory of 4848 3468 pvvvp.exe 90 PID 4848 wrote to memory of 3040 4848 7jpjj.exe 91 PID 4848 wrote to memory of 3040 4848 7jpjj.exe 91 PID 4848 wrote to memory of 3040 4848 7jpjj.exe 91 PID 3040 wrote to memory of 552 3040 fxlfrrf.exe 92 PID 3040 wrote to memory of 552 3040 fxlfrrf.exe 92 PID 3040 wrote to memory of 552 3040 fxlfrrf.exe 92 PID 552 wrote to memory of 1772 552 tnhbbb.exe 93 PID 552 wrote to memory of 1772 552 tnhbbb.exe 93 PID 552 wrote to memory of 1772 552 tnhbbb.exe 93 PID 1772 wrote to memory of 4772 1772 vvpdp.exe 94 PID 1772 wrote to memory of 4772 1772 vvpdp.exe 94 PID 1772 wrote to memory of 4772 1772 vvpdp.exe 94 PID 4772 wrote to memory of 1624 4772 3vdpj.exe 95 PID 4772 wrote to memory of 1624 4772 3vdpj.exe 95 PID 4772 wrote to memory of 1624 4772 3vdpj.exe 95 PID 1624 wrote to memory of 696 1624 1llfrrf.exe 96 PID 1624 wrote to memory of 696 1624 1llfrrf.exe 96 PID 1624 wrote to memory of 696 1624 1llfrrf.exe 96 PID 696 wrote to memory of 2500 696 rlrffxf.exe 141 PID 696 wrote to memory of 2500 696 rlrffxf.exe 141 PID 696 wrote to memory of 2500 696 rlrffxf.exe 141 PID 2500 wrote to memory of 2780 2500 hbnbtn.exe 99 PID 2500 wrote to memory of 2780 2500 hbnbtn.exe 99 PID 2500 wrote to memory of 2780 2500 hbnbtn.exe 99 PID 2780 wrote to memory of 824 2780 vdvpj.exe 100 PID 2780 wrote to memory of 824 2780 vdvpj.exe 100 PID 2780 wrote to memory of 824 2780 vdvpj.exe 100 PID 824 wrote to memory of 4408 824 jjdvp.exe 101 PID 824 wrote to memory of 4408 824 jjdvp.exe 101 PID 824 wrote to memory of 4408 824 jjdvp.exe 101 PID 4408 wrote to memory of 1336 4408 5flflfr.exe 102 PID 4408 wrote to memory of 1336 4408 5flflfr.exe 102 PID 4408 wrote to memory of 1336 4408 5flflfr.exe 102 PID 1336 wrote to memory of 1712 1336 nnhbbt.exe 103 PID 1336 wrote to memory of 1712 1336 nnhbbt.exe 103 PID 1336 wrote to memory of 1712 1336 nnhbbt.exe 103 PID 1712 wrote to memory of 3036 1712 vdjdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\028dd507a78a4791cbdc0018877b4480_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\9hnbnh.exec:\9hnbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\5bbthh.exec:\5bbthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\vpdvj.exec:\vpdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\1rfxxxl.exec:\1rfxxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\9xllrrx.exec:\9xllrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\ttnbht.exec:\ttnbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pvvvp.exec:\pvvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\7jpjj.exec:\7jpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\tnhbbb.exec:\tnhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\vvpdp.exec:\vvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\3vdpj.exec:\3vdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\1llfrrf.exec:\1llfrrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\rlrffxf.exec:\rlrffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\hbnbtn.exec:\hbnbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vdvpj.exec:\vdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\jjdvp.exec:\jjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\5flflfr.exec:\5flflfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nnhbbt.exec:\nnhbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\vdjdv.exec:\vdjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\jppdp.exec:\jppdp.exe23⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lxflrxf.exec:\lxflrxf.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lflxrlf.exec:\lflxrlf.exe25⤵
- Executes dropped EXE
PID:3460 -
\??\c:\htnbnh.exec:\htnbnh.exe26⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7jvjp.exec:\7jvjp.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\ppdpd.exec:\ppdpd.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlfllx.exec:\fxlfllx.exe29⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5bbnnh.exec:\5bbnnh.exe30⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3vvpj.exec:\3vvpj.exe31⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvdpv.exec:\pvdpv.exe32⤵
- Executes dropped EXE
PID:4684 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9ttnhh.exec:\9ttnhh.exe35⤵
- Executes dropped EXE
PID:3768 -
\??\c:\vpvpp.exec:\vpvpp.exe36⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pdvpp.exec:\pdvpp.exe37⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\xlrllfx.exec:\xlrllfx.exe39⤵
- Executes dropped EXE
PID:3728 -
\??\c:\5httbb.exec:\5httbb.exe40⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pjppp.exec:\pjppp.exe41⤵
- Executes dropped EXE
PID:3644 -
\??\c:\vdjjp.exec:\vdjjp.exe42⤵
- Executes dropped EXE
PID:4592 -
\??\c:\flrlffl.exec:\flrlffl.exe43⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bhhhhb.exec:\bhhhhb.exe44⤵
- Executes dropped EXE
PID:1304 -
\??\c:\hhhhbb.exec:\hhhhbb.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\ppjpd.exec:\ppjpd.exe46⤵
- Executes dropped EXE
PID:4844 -
\??\c:\jvdvp.exec:\jvdvp.exe47⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rflfxxr.exec:\rflfxxr.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\flffxxr.exec:\flffxxr.exe49⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hbntht.exec:\hbntht.exe50⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nntnnn.exec:\nntnnn.exe51⤵
- Executes dropped EXE
PID:3672 -
\??\c:\vvdvv.exec:\vvdvv.exe52⤵
- Executes dropped EXE
PID:3724 -
\??\c:\5ddpv.exec:\5ddpv.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lrxrffx.exec:\lrxrffx.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\xffxlfr.exec:\xffxlfr.exe55⤵
- Executes dropped EXE
PID:5044 -
\??\c:\hbtbnh.exec:\hbtbnh.exe56⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vvvpd.exec:\vvvpd.exe57⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ppdvd.exec:\ppdvd.exe58⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flxxxxx.exec:\flxxxxx.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\7ffrfxr.exec:\7ffrfxr.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1tbtnn.exec:\1tbtnn.exe61⤵
- Executes dropped EXE
PID:4872 -
\??\c:\pjdpd.exec:\pjdpd.exe62⤵
- Executes dropped EXE
PID:4632 -
\??\c:\dvvpv.exec:\dvvpv.exe63⤵
- Executes dropped EXE
PID:3848 -
\??\c:\1xlxfxx.exec:\1xlxfxx.exe64⤵
- Executes dropped EXE
PID:4012 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe65⤵
- Executes dropped EXE
PID:4132 -
\??\c:\5httnn.exec:\5httnn.exe66⤵PID:1620
-
\??\c:\vjjvd.exec:\vjjvd.exe67⤵PID:4196
-
\??\c:\9vdvp.exec:\9vdvp.exe68⤵PID:3540
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe69⤵PID:1108
-
\??\c:\fxfxlxr.exec:\fxfxlxr.exe70⤵PID:3356
-
\??\c:\3ntnhb.exec:\3ntnhb.exe71⤵PID:3940
-
\??\c:\vvjdv.exec:\vvjdv.exe72⤵PID:3408
-
\??\c:\pvvvp.exec:\pvvvp.exe73⤵PID:2332
-
\??\c:\lfxxxlx.exec:\lfxxxlx.exe74⤵PID:2824
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe75⤵PID:3140
-
\??\c:\nthtnn.exec:\nthtnn.exe76⤵PID:1644
-
\??\c:\bntnht.exec:\bntnht.exe77⤵PID:1752
-
\??\c:\vppjv.exec:\vppjv.exe78⤵PID:3768
-
\??\c:\ddpvj.exec:\ddpvj.exe79⤵PID:5068
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe80⤵PID:4032
-
\??\c:\7xfxrlx.exec:\7xfxrlx.exe81⤵PID:1340
-
\??\c:\bhhhbt.exec:\bhhhbt.exe82⤵PID:3976
-
\??\c:\nnnhtb.exec:\nnnhtb.exe83⤵PID:2592
-
\??\c:\vpdvp.exec:\vpdvp.exe84⤵PID:3740
-
\??\c:\jjdvp.exec:\jjdvp.exe85⤵PID:3504
-
\??\c:\djjdp.exec:\djjdp.exe86⤵PID:4616
-
\??\c:\7flxfxx.exec:\7flxfxx.exe87⤵PID:3972
-
\??\c:\lxllffx.exec:\lxllffx.exe88⤵PID:4332
-
\??\c:\5nthhb.exec:\5nthhb.exe89⤵PID:4612
-
\??\c:\tnnbbt.exec:\tnnbbt.exe90⤵PID:2444
-
\??\c:\ppjvp.exec:\ppjvp.exe91⤵PID:4800
-
\??\c:\pjjdp.exec:\pjjdp.exe92⤵PID:4828
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe93⤵PID:5096
-
\??\c:\flxrflf.exec:\flxrflf.exe94⤵PID:2028
-
\??\c:\nnbttt.exec:\nnbttt.exe95⤵PID:4696
-
\??\c:\7jjvp.exec:\7jjvp.exe96⤵PID:636
-
\??\c:\jvdpp.exec:\jvdpp.exe97⤵PID:2056
-
\??\c:\lflfxrr.exec:\lflfxrr.exe98⤵PID:4776
-
\??\c:\rfxrllf.exec:\rfxrllf.exe99⤵PID:4772
-
\??\c:\bbbbbh.exec:\bbbbbh.exe100⤵PID:4840
-
\??\c:\jddpj.exec:\jddpj.exe101⤵PID:696
-
\??\c:\dvpdd.exec:\dvpdd.exe102⤵PID:3696
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe103⤵PID:2616
-
\??\c:\frrrlrf.exec:\frrrlrf.exe104⤵PID:4580
-
\??\c:\5bthbt.exec:\5bthbt.exe105⤵PID:3300
-
\??\c:\hnnhbb.exec:\hnnhbb.exe106⤵PID:3064
-
\??\c:\ppjjp.exec:\ppjjp.exe107⤵PID:532
-
\??\c:\vjdjp.exec:\vjdjp.exe108⤵PID:3012
-
\??\c:\xffxffx.exec:\xffxffx.exe109⤵PID:1436
-
\??\c:\xlrxrlf.exec:\xlrxrlf.exe110⤵PID:3112
-
\??\c:\hbhbbh.exec:\hbhbbh.exe111⤵PID:844
-
\??\c:\tthhnh.exec:\tthhnh.exe112⤵PID:1440
-
\??\c:\jjdvp.exec:\jjdvp.exe113⤵PID:4420
-
\??\c:\5vpjd.exec:\5vpjd.exe114⤵PID:3424
-
\??\c:\frlfllf.exec:\frlfllf.exe115⤵PID:1108
-
\??\c:\rlxxrfr.exec:\rlxxrfr.exe116⤵PID:4500
-
\??\c:\7tnbtn.exec:\7tnbtn.exe117⤵PID:4224
-
\??\c:\nttnnn.exec:\nttnnn.exe118⤵PID:1344
-
\??\c:\jdddv.exec:\jdddv.exe119⤵PID:4512
-
\??\c:\xlrfllf.exec:\xlrfllf.exe120⤵PID:3828
-
\??\c:\xrxxxlr.exec:\xrxxxlr.exe121⤵PID:1752
-
\??\c:\hhbtnn.exec:\hhbtnn.exe122⤵PID:4956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-