Analysis
-
max time kernel
144s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 01:08
Behavioral task
behavioral1
Sample
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
Resource
win7-20240220-en
General
-
Target
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe
-
Size
464KB
-
MD5
3dec43c7be61490b7de0f0039ee57d70
-
SHA1
3598d955d6aab03de714a078da703fdf7a1b067c
-
SHA256
1f0ee41fb65b04cd416b7e06c781a80e7194055829d284f4d80718c8264fcdac
-
SHA512
5fc7e21de1027cadcf3282b14a3d51af0a8ddc0ed6e86350a8eb3e5c0f9050b648e60533afda4804ba795d41512f518553adfc924e7eb058376638baedad2b45
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vq:VeR0oykayRFp3lztP+OKaf1Vq
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2188-16-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2936-25-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2532-30-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2792-47-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2936-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2708-55-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2444-74-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2460-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2564-93-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2128-183-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/596-218-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1784-229-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2776-361-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2856-386-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2448-401-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2448-408-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2156-415-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2168-467-0x00000000002C0000-0x00000000002FA000-memory.dmp family_blackmoon behavioral1/memory/1920-587-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2560-1000-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1348-668-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2588-636-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1588-606-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2004-460-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1060-393-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2508-348-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1424-304-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2976-303-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1200-253-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1836-226-0x0000000000250000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1836-225-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2836-209-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1916-200-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2128-191-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2308-158-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/112-156-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2476-120-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/352-102-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvpvv.exe family_berbew behavioral1/memory/2196-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\xrrrrrr.exe family_berbew behavioral1/memory/2188-16-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2792-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\ddjvd.exe family_berbew behavioral1/memory/2532-30-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\vvdpd.exe family_berbew behavioral1/memory/2792-47-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\5nbnbh.exe family_berbew behavioral1/memory/2936-28-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\bttbnh.exe family_berbew behavioral1/memory/2708-55-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\5frxxlx.exe family_berbew behavioral1/memory/2460-75-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2444-74-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\flfrxxr.exe family_berbew \??\c:\jvjjp.exe family_berbew behavioral1/memory/2460-84-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jdvpd.exe family_berbew behavioral1/memory/2564-93-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tntthh.exe family_berbew \??\c:\5lllllr.exe family_berbew \??\c:\ttnhtn.exe family_berbew behavioral1/memory/2136-130-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\pdvvd.exe family_berbew \??\c:\rfxrxfr.exe family_berbew behavioral1/memory/112-147-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\nhthth.exe family_berbew \??\c:\1jvjp.exe family_berbew C:\bnbnbb.exe family_berbew behavioral1/memory/2128-183-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\dpdjv.exe family_berbew \??\c:\thtbbb.exe family_berbew behavioral1/memory/2836-201-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/596-218-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\flfxfrf.exe family_berbew behavioral1/memory/1784-229-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bhbnhb.exe family_berbew \??\c:\xlrfxrf.exe family_berbew C:\3jpdp.exe family_berbew C:\llxxfxf.exe family_berbew \??\c:\btnbtt.exe family_berbew \??\c:\jppjv.exe family_berbew behavioral1/memory/2776-361-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2856-386-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2448-401-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2448-408-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2156-415-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2168-467-0x00000000002C0000-0x00000000002FA000-memory.dmp family_berbew behavioral1/memory/2980-511-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2580-525-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/580-556-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1920-587-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2220-621-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2596-649-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2716-687-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2432-700-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2284-776-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/656-863-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1524-886-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1424-885-0x00000000002D0000-0x000000000030A000-memory.dmp family_berbew behavioral1/memory/2612-942-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
vvpvv.exexrrrrrr.exe5nbnbh.exeddjvd.exevvdpd.exebttbnh.exe5frxxlx.exeflfrxxr.exejvjjp.exejdvpd.exe5lllllr.exetntthh.exejdvjp.exettnhtn.exepdvvd.exerfxrxfr.exenhthth.exe1jvjp.exexlllxlr.exebnbnbb.exedpdjv.exethtbbb.exevpdvp.exeflfxfrf.exebhbnhb.exedvvjj.exexlrfxrf.exebhntbh.exe3jpdp.exellxxfxf.exebtnbtt.exejppjv.exexrlrffr.exebhhnbb.exejppdv.exelxffrlf.exethnnhn.exepjdvp.exelrllrrx.exerfrxlrx.exetbnnbt.exevjvvd.exevpjvd.exerfrxxlf.exettnthn.exepppdp.exefxrfxfl.exetnbnbh.exehbttbb.exevvpjj.exelllrlxr.exexfxrfll.exebbntnn.exevdvjv.exeppjpj.exelrrlxfx.exehbthbh.exetnnhtb.exeddjvv.exe9llxflf.exe9rrxlrf.exetthnhn.exevdddv.exe3vdpj.exepid process 2188 vvpvv.exe 2936 xrrrrrr.exe 2532 5nbnbh.exe 2792 ddjvd.exe 2708 vvdpd.exe 2412 bttbnh.exe 2444 5frxxlx.exe 2460 flfrxxr.exe 2564 jvjjp.exe 352 jdvpd.exe 1184 5lllllr.exe 2476 tntthh.exe 2648 jdvjp.exe 2136 ttnhtn.exe 764 pdvvd.exe 112 rfxrxfr.exe 2308 nhthth.exe 2008 1jvjp.exe 2848 xlllxlr.exe 2128 bnbnbb.exe 1916 dpdjv.exe 2836 thtbbb.exe 596 vpdvp.exe 1836 flfxfrf.exe 1784 bhbnhb.exe 2800 dvvjj.exe 1200 xlrfxrf.exe 968 bhntbh.exe 348 3jpdp.exe 580 llxxfxf.exe 2212 btnbtt.exe 1196 jppjv.exe 2976 xrlrffr.exe 1424 bhhnbb.exe 1572 jppdv.exe 1588 lxffrlf.exe 2288 thnnhn.exe 3000 pjdvp.exe 2936 lrllrrx.exe 2544 rfrxlrx.exe 2508 tbnnbt.exe 2592 vjvvd.exe 2776 vpjvd.exe 2392 rfrxxlf.exe 2624 ttnthn.exe 2856 pppdp.exe 1060 fxrfxfl.exe 2564 tnbnbh.exe 2448 hbttbb.exe 2156 vvpjj.exe 2476 lllrlxr.exe 2160 xfxrfll.exe 2504 bbntnn.exe 1576 vdvjv.exe 356 ppjpj.exe 2296 lrrlxfx.exe 2004 hbthbh.exe 2168 tnnhtb.exe 2008 ddjvv.exe 1908 9llxflf.exe 1980 9rrxlrf.exe 2112 tthnhn.exe 680 vdddv.exe 2836 3vdpj.exe -
Processes:
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvpvv.exe upx behavioral1/memory/2196-8-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\xrrrrrr.exe upx behavioral1/memory/2188-16-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2936-25-0x0000000000220000-0x000000000025A000-memory.dmp upx behavioral1/memory/2792-38-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\ddjvd.exe upx behavioral1/memory/2532-30-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\vvdpd.exe upx behavioral1/memory/2792-47-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\5nbnbh.exe upx behavioral1/memory/2936-28-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\bttbnh.exe upx behavioral1/memory/2708-55-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\5frxxlx.exe upx behavioral1/memory/2460-75-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2444-74-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\flfrxxr.exe upx \??\c:\jvjjp.exe upx behavioral1/memory/2460-84-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jdvpd.exe upx behavioral1/memory/2564-93-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tntthh.exe upx \??\c:\5lllllr.exe upx \??\c:\ttnhtn.exe upx behavioral1/memory/2136-130-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\pdvvd.exe upx \??\c:\rfxrxfr.exe upx behavioral1/memory/112-147-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\nhthth.exe upx \??\c:\1jvjp.exe upx C:\bnbnbb.exe upx behavioral1/memory/2128-183-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\dpdjv.exe upx \??\c:\thtbbb.exe upx behavioral1/memory/2836-201-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/596-218-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\flfxfrf.exe upx behavioral1/memory/1784-229-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bhbnhb.exe upx \??\c:\xlrfxrf.exe upx C:\3jpdp.exe upx C:\llxxfxf.exe upx \??\c:\btnbtt.exe upx \??\c:\jppjv.exe upx behavioral1/memory/2776-361-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2856-386-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2448-401-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2448-408-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2156-415-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2980-511-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2580-525-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/580-556-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1920-587-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2220-621-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2596-649-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2716-687-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2432-700-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2284-776-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/656-863-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1524-886-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2612-942-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2656-1023-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exevvpvv.exexrrrrrr.exe5nbnbh.exeddjvd.exevvdpd.exebttbnh.exe5frxxlx.exeflfrxxr.exejvjjp.exejdvpd.exe5lllllr.exetntthh.exejdvjp.exettnhtn.exepdvvd.exedescription pid process target process PID 2196 wrote to memory of 2188 2196 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe vvpvv.exe PID 2196 wrote to memory of 2188 2196 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe vvpvv.exe PID 2196 wrote to memory of 2188 2196 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe vvpvv.exe PID 2196 wrote to memory of 2188 2196 3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe vvpvv.exe PID 2188 wrote to memory of 2936 2188 vvpvv.exe lrllrrx.exe PID 2188 wrote to memory of 2936 2188 vvpvv.exe lrllrrx.exe PID 2188 wrote to memory of 2936 2188 vvpvv.exe lrllrrx.exe PID 2188 wrote to memory of 2936 2188 vvpvv.exe lrllrrx.exe PID 2936 wrote to memory of 2532 2936 xrrrrrr.exe 5nbnbh.exe PID 2936 wrote to memory of 2532 2936 xrrrrrr.exe 5nbnbh.exe PID 2936 wrote to memory of 2532 2936 xrrrrrr.exe 5nbnbh.exe PID 2936 wrote to memory of 2532 2936 xrrrrrr.exe 5nbnbh.exe PID 2532 wrote to memory of 2792 2532 5nbnbh.exe ddjvd.exe PID 2532 wrote to memory of 2792 2532 5nbnbh.exe ddjvd.exe PID 2532 wrote to memory of 2792 2532 5nbnbh.exe ddjvd.exe PID 2532 wrote to memory of 2792 2532 5nbnbh.exe ddjvd.exe PID 2792 wrote to memory of 2708 2792 ddjvd.exe vvdpd.exe PID 2792 wrote to memory of 2708 2792 ddjvd.exe vvdpd.exe PID 2792 wrote to memory of 2708 2792 ddjvd.exe vvdpd.exe PID 2792 wrote to memory of 2708 2792 ddjvd.exe vvdpd.exe PID 2708 wrote to memory of 2412 2708 vvdpd.exe bttbnh.exe PID 2708 wrote to memory of 2412 2708 vvdpd.exe bttbnh.exe PID 2708 wrote to memory of 2412 2708 vvdpd.exe bttbnh.exe PID 2708 wrote to memory of 2412 2708 vvdpd.exe bttbnh.exe PID 2412 wrote to memory of 2444 2412 bttbnh.exe 5frxxlx.exe PID 2412 wrote to memory of 2444 2412 bttbnh.exe 5frxxlx.exe PID 2412 wrote to memory of 2444 2412 bttbnh.exe 5frxxlx.exe PID 2412 wrote to memory of 2444 2412 bttbnh.exe 5frxxlx.exe PID 2444 wrote to memory of 2460 2444 5frxxlx.exe flfrxxr.exe PID 2444 wrote to memory of 2460 2444 5frxxlx.exe flfrxxr.exe PID 2444 wrote to memory of 2460 2444 5frxxlx.exe flfrxxr.exe PID 2444 wrote to memory of 2460 2444 5frxxlx.exe flfrxxr.exe PID 2460 wrote to memory of 2564 2460 flfrxxr.exe jvjjp.exe PID 2460 wrote to memory of 2564 2460 flfrxxr.exe jvjjp.exe PID 2460 wrote to memory of 2564 2460 flfrxxr.exe jvjjp.exe PID 2460 wrote to memory of 2564 2460 flfrxxr.exe jvjjp.exe PID 2564 wrote to memory of 352 2564 jvjjp.exe jdvpd.exe PID 2564 wrote to memory of 352 2564 jvjjp.exe jdvpd.exe PID 2564 wrote to memory of 352 2564 jvjjp.exe jdvpd.exe PID 2564 wrote to memory of 352 2564 jvjjp.exe jdvpd.exe PID 352 wrote to memory of 1184 352 jdvpd.exe 5lllllr.exe PID 352 wrote to memory of 1184 352 jdvpd.exe 5lllllr.exe PID 352 wrote to memory of 1184 352 jdvpd.exe 5lllllr.exe PID 352 wrote to memory of 1184 352 jdvpd.exe 5lllllr.exe PID 1184 wrote to memory of 2476 1184 5lllllr.exe lllrlxr.exe PID 1184 wrote to memory of 2476 1184 5lllllr.exe lllrlxr.exe PID 1184 wrote to memory of 2476 1184 5lllllr.exe lllrlxr.exe PID 1184 wrote to memory of 2476 1184 5lllllr.exe lllrlxr.exe PID 2476 wrote to memory of 2648 2476 tntthh.exe jdvjp.exe PID 2476 wrote to memory of 2648 2476 tntthh.exe jdvjp.exe PID 2476 wrote to memory of 2648 2476 tntthh.exe jdvjp.exe PID 2476 wrote to memory of 2648 2476 tntthh.exe jdvjp.exe PID 2648 wrote to memory of 2136 2648 jdvjp.exe ttnhtn.exe PID 2648 wrote to memory of 2136 2648 jdvjp.exe ttnhtn.exe PID 2648 wrote to memory of 2136 2648 jdvjp.exe ttnhtn.exe PID 2648 wrote to memory of 2136 2648 jdvjp.exe ttnhtn.exe PID 2136 wrote to memory of 764 2136 ttnhtn.exe pdvvd.exe PID 2136 wrote to memory of 764 2136 ttnhtn.exe pdvvd.exe PID 2136 wrote to memory of 764 2136 ttnhtn.exe pdvvd.exe PID 2136 wrote to memory of 764 2136 ttnhtn.exe pdvvd.exe PID 764 wrote to memory of 112 764 pdvvd.exe rfxrxfr.exe PID 764 wrote to memory of 112 764 pdvvd.exe rfxrxfr.exe PID 764 wrote to memory of 112 764 pdvvd.exe rfxrxfr.exe PID 764 wrote to memory of 112 764 pdvvd.exe rfxrxfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3dec43c7be61490b7de0f0039ee57d70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\vvpvv.exec:\vvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5nbnbh.exec:\5nbnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ddjvd.exec:\ddjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vvdpd.exec:\vvdpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\bttbnh.exec:\bttbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5frxxlx.exec:\5frxxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\flfrxxr.exec:\flfrxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jvjjp.exec:\jvjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jdvpd.exec:\jdvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\5lllllr.exec:\5lllllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\tntthh.exec:\tntthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\jdvjp.exec:\jdvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\ttnhtn.exec:\ttnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\pdvvd.exec:\pdvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe17⤵
- Executes dropped EXE
PID:112 -
\??\c:\nhthth.exec:\nhthth.exe18⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1jvjp.exec:\1jvjp.exe19⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xlllxlr.exec:\xlllxlr.exe20⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bnbnbb.exec:\bnbnbb.exe21⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dpdjv.exec:\dpdjv.exe22⤵
- Executes dropped EXE
PID:1916 -
\??\c:\thtbbb.exec:\thtbbb.exe23⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vpdvp.exec:\vpdvp.exe24⤵
- Executes dropped EXE
PID:596 -
\??\c:\flfxfrf.exec:\flfxfrf.exe25⤵
- Executes dropped EXE
PID:1836 -
\??\c:\bhbnhb.exec:\bhbnhb.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvvjj.exec:\dvvjj.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlrfxrf.exec:\xlrfxrf.exe28⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bhntbh.exec:\bhntbh.exe29⤵
- Executes dropped EXE
PID:968 -
\??\c:\3jpdp.exec:\3jpdp.exe30⤵
- Executes dropped EXE
PID:348 -
\??\c:\llxxfxf.exec:\llxxfxf.exe31⤵
- Executes dropped EXE
PID:580 -
\??\c:\btnbtt.exec:\btnbtt.exe32⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jppjv.exec:\jppjv.exe33⤵
- Executes dropped EXE
PID:1196 -
\??\c:\xrlrffr.exec:\xrlrffr.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\bhhnbb.exec:\bhhnbb.exe35⤵
- Executes dropped EXE
PID:1424 -
\??\c:\jppdv.exec:\jppdv.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\lxffrlf.exec:\lxffrlf.exe37⤵
- Executes dropped EXE
PID:1588 -
\??\c:\thnnhn.exec:\thnnhn.exe38⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pjdvp.exec:\pjdvp.exe39⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lrllrrx.exec:\lrllrrx.exe40⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rfrxlrx.exec:\rfrxlrx.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tbnnbt.exec:\tbnnbt.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vjvvd.exec:\vjvvd.exe43⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpjvd.exec:\vpjvd.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rfrxxlf.exec:\rfrxxlf.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ttnthn.exec:\ttnthn.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pppdp.exec:\pppdp.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe48⤵
- Executes dropped EXE
PID:1060 -
\??\c:\tnbnbh.exec:\tnbnbh.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbttbb.exec:\hbttbb.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vvpjj.exec:\vvpjj.exe51⤵
- Executes dropped EXE
PID:2156 -
\??\c:\lllrlxr.exec:\lllrlxr.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xfxrfll.exec:\xfxrfll.exe53⤵
- Executes dropped EXE
PID:2160 -
\??\c:\bbntnn.exec:\bbntnn.exe54⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vdvjv.exec:\vdvjv.exe55⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ppjpj.exec:\ppjpj.exe56⤵
- Executes dropped EXE
PID:356 -
\??\c:\lrrlxfx.exec:\lrrlxfx.exe57⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hbthbh.exec:\hbthbh.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnnhtb.exec:\tnnhtb.exe59⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ddjvv.exec:\ddjvv.exe60⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9llxflf.exec:\9llxflf.exe61⤵
- Executes dropped EXE
PID:1908 -
\??\c:\9rrxlrf.exec:\9rrxlrf.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\tthnhn.exec:\tthnhn.exe63⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vdddv.exec:\vdddv.exe64⤵
- Executes dropped EXE
PID:680 -
\??\c:\3vdpj.exec:\3vdpj.exe65⤵
- Executes dropped EXE
PID:2836 -
\??\c:\fffxfrf.exec:\fffxfrf.exe66⤵PID:1780
-
\??\c:\tthnhh.exec:\tthnhh.exe67⤵PID:2980
-
\??\c:\3nntbb.exec:\3nntbb.exe68⤵PID:2796
-
\??\c:\dpvdj.exec:\dpvdj.exe69⤵PID:2580
-
\??\c:\vvjjd.exec:\vvjjd.exe70⤵PID:1684
-
\??\c:\frxllfl.exec:\frxllfl.exe71⤵PID:1200
-
\??\c:\nbhthh.exec:\nbhthh.exe72⤵PID:852
-
\??\c:\tbthtb.exec:\tbthtb.exe73⤵PID:348
-
\??\c:\tnnnbn.exec:\tnnnbn.exe74⤵PID:580
-
\??\c:\5ddvj.exec:\5ddvj.exe75⤵PID:984
-
\??\c:\lrfrxxf.exec:\lrfrxxf.exe76⤵PID:1716
-
\??\c:\rrxxlxl.exec:\rrxxlxl.exe77⤵PID:1400
-
\??\c:\nbbntt.exec:\nbbntt.exe78⤵PID:1920
-
\??\c:\ttnbtb.exec:\ttnbtb.exe79⤵PID:2088
-
\??\c:\5jddj.exec:\5jddj.exe80⤵PID:1476
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe81⤵PID:1588
-
\??\c:\xxfrxxx.exec:\xxfrxxx.exe82⤵PID:2336
-
\??\c:\thnhnt.exec:\thnhnt.exe83⤵PID:2092
-
\??\c:\5nnnbh.exec:\5nnnbh.exe84⤵PID:2220
-
\??\c:\dvpdp.exec:\dvpdp.exe85⤵PID:2152
-
\??\c:\xrxfllr.exec:\xrxfllr.exe86⤵PID:2588
-
\??\c:\lfxlxxf.exec:\lfxlxxf.exe87⤵PID:2428
-
\??\c:\hnhtnb.exec:\hnhtnb.exe88⤵PID:2596
-
\??\c:\pdpvd.exec:\pdpvd.exe89⤵PID:2388
-
\??\c:\1jvjv.exec:\1jvjv.exe90⤵PID:1348
-
\??\c:\lfxlxlf.exec:\lfxlxlf.exe91⤵PID:2444
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe92⤵PID:2856
-
\??\c:\7htbbh.exec:\7htbbh.exe93⤵PID:1032
-
\??\c:\jvpvj.exec:\jvpvj.exe94⤵PID:2716
-
\??\c:\9jjjv.exec:\9jjjv.exe95⤵PID:1796
-
\??\c:\xfxlxfx.exec:\xfxlxfx.exe96⤵PID:2432
-
\??\c:\9bhntb.exec:\9bhntb.exe97⤵PID:2956
-
\??\c:\jppjj.exec:\jppjj.exe98⤵PID:2648
-
\??\c:\9jpvj.exec:\9jpvj.exe99⤵PID:2408
-
\??\c:\7fxflxl.exec:\7fxflxl.exe100⤵PID:2656
-
\??\c:\5fxrxfr.exec:\5fxrxfr.exe101⤵PID:1360
-
\??\c:\hbtbnt.exec:\hbtbnt.exe102⤵PID:2376
-
\??\c:\nbnbnn.exec:\nbnbnn.exe103⤵PID:2012
-
\??\c:\vpdvp.exec:\vpdvp.exe104⤵PID:2744
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe105⤵PID:2872
-
\??\c:\lfxrflx.exec:\lfxrflx.exe106⤵PID:2848
-
\??\c:\tbbtbn.exec:\tbbtbn.exe107⤵PID:1952
-
\??\c:\jdvjv.exec:\jdvjv.exe108⤵PID:2284
-
\??\c:\3jdpd.exec:\3jdpd.exe109⤵PID:856
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe110⤵PID:600
-
\??\c:\fxlxffx.exec:\fxlxffx.exe111⤵PID:1412
-
\??\c:\hhntbb.exec:\hhntbb.exe112⤵PID:2052
-
\??\c:\1ththn.exec:\1ththn.exe113⤵PID:2036
-
\??\c:\5ppdp.exec:\5ppdp.exe114⤵PID:1308
-
\??\c:\fxrfxfx.exec:\fxrfxfx.exe115⤵PID:2120
-
\??\c:\3xrxfxf.exec:\3xrxfxf.exe116⤵PID:304
-
\??\c:\3tbbnt.exec:\3tbbnt.exe117⤵PID:2672
-
\??\c:\9bbbth.exec:\9bbbth.exe118⤵PID:1612
-
\??\c:\vpdjj.exec:\vpdjj.exe119⤵PID:1704
-
\??\c:\pjdpj.exec:\pjdpj.exe120⤵PID:2232
-
\??\c:\fxfrlxf.exec:\fxfrlxf.exe121⤵PID:332
-
\??\c:\bnttbb.exec:\bnttbb.exe122⤵PID:656
-
\??\c:\nbbhhb.exec:\nbbhhb.exe123⤵PID:2940
-
\??\c:\jvdvd.exec:\jvdvd.exe124⤵PID:1424
-
\??\c:\rlxxflr.exec:\rlxxflr.exe125⤵PID:1524
-
\??\c:\hnbtbt.exec:\hnbtbt.exe126⤵PID:2216
-
\??\c:\5nhhnh.exec:\5nhhnh.exe127⤵PID:912
-
\??\c:\jppdp.exec:\jppdp.exe128⤵PID:2124
-
\??\c:\1vppd.exec:\1vppd.exe129⤵PID:2536
-
\??\c:\9xffxfr.exec:\9xffxfr.exe130⤵PID:776
-
\??\c:\1rlxlrx.exec:\1rlxlrx.exe131⤵PID:2696
-
\??\c:\hnhthn.exec:\hnhthn.exe132⤵PID:788
-
\??\c:\dpjdj.exec:\dpjdj.exe133⤵PID:2620
-
\??\c:\jjdvj.exec:\jjdvj.exe134⤵PID:2612
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe135⤵PID:2384
-
\??\c:\xxrxllx.exec:\xxrxllx.exe136⤵PID:2560
-
\??\c:\7btbhh.exec:\7btbhh.exe137⤵PID:1696
-
\??\c:\tnhhtt.exec:\tnhhtt.exe138⤵PID:632
-
\??\c:\9dvdd.exec:\9dvdd.exe139⤵PID:2364
-
\??\c:\pjpvd.exec:\pjpvd.exe140⤵PID:2564
-
\??\c:\lfffffr.exec:\lfffffr.exe141⤵PID:2448
-
\??\c:\5lxrxlr.exec:\5lxrxlr.exe142⤵PID:2204
-
\??\c:\nhbhnb.exec:\nhbhnb.exe143⤵PID:2432
-
\??\c:\1hhbnb.exec:\1hhbnb.exe144⤵PID:1516
-
\??\c:\djjvj.exec:\djjvj.exe145⤵PID:2136
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe146⤵PID:1520
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe147⤵PID:2656
-
\??\c:\9htnbh.exec:\9htnbh.exe148⤵PID:1360
-
\??\c:\bbbnbh.exec:\bbbnbh.exe149⤵PID:2376
-
\??\c:\flflxfr.exec:\flflxfr.exe150⤵PID:2012
-
\??\c:\nnhbtt.exec:\nnhbtt.exe151⤵PID:2168
-
\??\c:\pddpd.exec:\pddpd.exe152⤵PID:2420
-
\??\c:\vpppv.exec:\vpppv.exe153⤵PID:1596
-
\??\c:\ttbnhb.exec:\ttbnhb.exe154⤵PID:1660
-
\??\c:\ttntnt.exec:\ttntnt.exe155⤵PID:588
-
\??\c:\bbntbh.exec:\bbntbh.exe156⤵PID:1396
-
\??\c:\vvjvj.exec:\vvjvj.exe157⤵PID:1700
-
\??\c:\rrflxrl.exec:\rrflxrl.exe158⤵PID:2348
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe159⤵PID:2972
-
\??\c:\nnnnbb.exec:\nnnnbb.exe160⤵PID:1204
-
\??\c:\btttbh.exec:\btttbh.exe161⤵PID:2728
-
\??\c:\jdpvd.exec:\jdpvd.exe162⤵PID:1996
-
\??\c:\1ppdj.exec:\1ppdj.exe163⤵PID:904
-
\??\c:\7rfrfrl.exec:\7rfrfrl.exe164⤵PID:948
-
\??\c:\bbbnht.exec:\bbbnht.exe165⤵PID:2116
-
\??\c:\tnhtbb.exec:\tnhtbb.exe166⤵PID:348
-
\??\c:\ppjvd.exec:\ppjvd.exe167⤵PID:1948
-
\??\c:\ppjpv.exec:\ppjpv.exe168⤵PID:1944
-
\??\c:\lllrllx.exec:\lllrllx.exe169⤵PID:1936
-
\??\c:\7xlrflr.exec:\7xlrflr.exe170⤵PID:1464
-
\??\c:\btntnt.exec:\btntnt.exe171⤵PID:1920
-
\??\c:\hnnntt.exec:\hnnntt.exe172⤵PID:2088
-
\??\c:\jvpdp.exec:\jvpdp.exe173⤵PID:2248
-
\??\c:\dvvjv.exec:\dvvjv.exe174⤵PID:2216
-
\??\c:\lfrxffr.exec:\lfrxffr.exe175⤵PID:2780
-
\??\c:\3nnnth.exec:\3nnnth.exe176⤵PID:996
-
\??\c:\hbnhnt.exec:\hbnhnt.exe177⤵PID:2536
-
\??\c:\vpjjp.exec:\vpjjp.exe178⤵PID:776
-
\??\c:\dvvdv.exec:\dvvdv.exe179⤵PID:2500
-
\??\c:\7lrrrxl.exec:\7lrrrxl.exe180⤵PID:2360
-
\??\c:\1nnthn.exec:\1nnthn.exe181⤵PID:2404
-
\??\c:\hbbbnt.exec:\hbbbnt.exe182⤵PID:2984
-
\??\c:\btbnbh.exec:\btbnbh.exe183⤵PID:1348
-
\??\c:\5pjpj.exec:\5pjpj.exe184⤵PID:1572
-
\??\c:\fxxrfff.exec:\fxxrfff.exe185⤵PID:2516
-
\??\c:\xlllrrf.exec:\xlllrrf.exe186⤵PID:2856
-
\??\c:\rlflxrf.exec:\rlflxrf.exe187⤵PID:1256
-
\??\c:\5nthnb.exec:\5nthnb.exe188⤵PID:2716
-
\??\c:\9jpvv.exec:\9jpvv.exe189⤵PID:2156
-
\??\c:\rxlfrxr.exec:\rxlfrxr.exe190⤵PID:2568
-
\??\c:\hhnthh.exec:\hhnthh.exe191⤵PID:1472
-
\??\c:\5dvdp.exec:\5dvdp.exe192⤵PID:2432
-
\??\c:\1vpdd.exec:\1vpdd.exe193⤵PID:2504
-
\??\c:\hbthnb.exec:\hbthnb.exe194⤵PID:2704
-
\??\c:\djdjv.exec:\djdjv.exe195⤵PID:2692
-
\??\c:\rxxlflf.exec:\rxxlflf.exe196⤵PID:2028
-
\??\c:\9nhnbh.exec:\9nhnbh.exe197⤵PID:1360
-
\??\c:\dvpvp.exec:\dvpvp.exe198⤵PID:2376
-
\??\c:\fffxxfx.exec:\fffxxfx.exe199⤵PID:1940
-
\??\c:\dpdjp.exec:\dpdjp.exe200⤵PID:2180
-
\??\c:\1lflxfr.exec:\1lflxfr.exe201⤵PID:2752
-
\??\c:\llxfxfx.exec:\llxfxfx.exe202⤵PID:2540
-
\??\c:\nhbnbh.exec:\nhbnbh.exe203⤵PID:764
-
\??\c:\jjdjd.exec:\jjdjd.exe204⤵PID:2352
-
\??\c:\rxrrrfx.exec:\rxrrrfx.exe205⤵PID:1404
-
\??\c:\3flrfrf.exec:\3flrfrf.exe206⤵PID:792
-
\??\c:\hbtthh.exec:\hbtthh.exe207⤵PID:2344
-
\??\c:\9lxlrxl.exec:\9lxlrxl.exe208⤵PID:1836
-
\??\c:\9hbhtn.exec:\9hbhtn.exe209⤵PID:1680
-
\??\c:\pjvpd.exec:\pjvpd.exe210⤵PID:1172
-
\??\c:\lrlxxlx.exec:\lrlxxlx.exe211⤵PID:2580
-
\??\c:\tnhbnb.exec:\tnhbnb.exe212⤵PID:2912
-
\??\c:\3jjjp.exec:\3jjjp.exe213⤵PID:968
-
\??\c:\dvjjv.exec:\dvjjv.exe214⤵PID:852
-
\??\c:\xlxxffr.exec:\xlxxffr.exe215⤵PID:2680
-
\??\c:\thtnhh.exec:\thtnhh.exe216⤵PID:1704
-
\??\c:\hthbtn.exec:\hthbtn.exe217⤵PID:2232
-
\??\c:\1vdjv.exec:\1vdjv.exe218⤵PID:2244
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe219⤵PID:2816
-
\??\c:\nnbhhh.exec:\nnbhhh.exe220⤵PID:2976
-
\??\c:\vpvpv.exec:\vpvpv.exe221⤵PID:1856
-
\??\c:\9lxlfxf.exec:\9lxlfxf.exe222⤵PID:620
-
\??\c:\9hbnnt.exec:\9hbnnt.exe223⤵PID:1752
-
\??\c:\jddpd.exec:\jddpd.exe224⤵PID:1840
-
\??\c:\xfxrfll.exec:\xfxrfll.exe225⤵PID:3048
-
\??\c:\lxllllx.exec:\lxllllx.exe226⤵PID:2636
-
\??\c:\bntnnt.exec:\bntnnt.exe227⤵PID:2544
-
\??\c:\7vvpj.exec:\7vvpj.exe228⤵PID:1716
-
\??\c:\jjpvp.exec:\jjpvp.exe229⤵PID:2592
-
\??\c:\9nnbnt.exec:\9nnbnt.exe230⤵PID:2528
-
\??\c:\jdvdv.exec:\jdvdv.exe231⤵PID:2644
-
\??\c:\xlllrrx.exec:\xlllrrx.exe232⤵PID:1232
-
\??\c:\ttnbnt.exec:\ttnbnt.exe233⤵PID:1320
-
\??\c:\dpvdv.exec:\dpvdv.exe234⤵PID:2460
-
\??\c:\pdpjd.exec:\pdpjd.exe235⤵PID:2436
-
\??\c:\fxxlxfl.exec:\fxxlxfl.exe236⤵PID:2676
-
\??\c:\nbtbtt.exec:\nbtbtt.exe237⤵PID:840
-
\??\c:\tnthth.exec:\tnthth.exe238⤵PID:2564
-
\??\c:\7vvpd.exec:\7vvpd.exe239⤵PID:2416
-
\??\c:\djpvv.exec:\djpvv.exe240⤵PID:888
-
\??\c:\flffflf.exec:\flffflf.exe241⤵PID:1016
-
\??\c:\tnhtbn.exec:\tnhtbn.exe242⤵PID:1516