Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:20
Behavioral task
behavioral1
Sample
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe
Resource
win7-20240508-en
General
-
Target
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe
-
Size
464KB
-
MD5
e166d727e89fa1c86a9d597c776a7220
-
SHA1
34e75f1872fd9cfbfaa2a7c2c5e43bbe12f22224
-
SHA256
2d8050ec94699e1c60872d18093730150647240a7ab2c97e58a9a9d314fa9f51
-
SHA512
9f312956f45aa722b7a5687ce359cf4eb303474c609aa658ca436ab9459140a0e5323c8a8ad0f47f85774696c55eeaa4122fba06b5f51c8275813dadb4900625
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1V5:VeR0oykayRFp3lztP+OKaf1V5
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1580-16-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2708-28-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1912-27-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2572-44-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2568-57-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2060-54-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1528-66-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2544-75-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2204-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2804-94-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2664-106-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2112-129-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/672-139-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2780-143-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1048-151-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1172-160-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/3016-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2344-229-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/328-255-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1588-266-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2388-282-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2100-307-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2100-306-0x00000000775E0000-0x00000000776DA000-memory.dmp family_blackmoon behavioral1/memory/2100-305-0x00000000776E0000-0x00000000777FF000-memory.dmp family_blackmoon behavioral1/memory/3044-320-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2616-333-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2512-372-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2824-399-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2872-407-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1340-415-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1824-428-0x0000000000320000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1976-468-0x00000000002B0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1648-520-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2708-634-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2516-681-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2308-751-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1092-772-0x0000000000220000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1728-803-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/2280-817-0x00000000001B0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/3044-900-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral1/memory/1784-967-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1580-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\9nbnbb.exe family_berbew \??\c:\3ntbnn.exe family_berbew behavioral1/memory/1580-16-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\7pvpv.exe family_berbew behavioral1/memory/2708-28-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1912-27-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1xlrffl.exe family_berbew behavioral1/memory/2572-37-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2572-44-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jvjjj.exe family_berbew C:\nhnhhn.exe family_berbew behavioral1/memory/2568-57-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2060-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1528-66-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\bnbhhn.exe family_berbew behavioral1/memory/1528-72-0x00000000003C0000-0x00000000003FA000-memory.dmp family_berbew behavioral1/memory/2544-75-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\jpjjj.exe family_berbew \??\c:\thtntt.exe family_berbew behavioral1/memory/2204-84-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2804-87-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\5tnhnh.exe family_berbew behavioral1/memory/2804-94-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\fxfffll.exe family_berbew behavioral1/memory/2664-106-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\1xlxflr.exe family_berbew \??\c:\5pddp.exe family_berbew C:\bththh.exe family_berbew behavioral1/memory/2112-129-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/672-131-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/672-139-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1jppd.exe family_berbew behavioral1/memory/2780-143-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/1048-151-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\fxlrxxl.exe family_berbew behavioral1/memory/1172-160-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\1thhnn.exe family_berbew C:\ddvdp.exe family_berbew \??\c:\vjvvd.exe family_berbew C:\xlflllr.exe family_berbew behavioral1/memory/2800-189-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\hbbbhn.exe family_berbew C:\flrlflx.exe family_berbew behavioral1/memory/3016-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\dvdjp.exe family_berbew C:\fxffflr.exe family_berbew behavioral1/memory/2344-229-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\nhtbhh.exe family_berbew C:\dvpvp.exe family_berbew \??\c:\5thntt.exe family_berbew C:\dvjpv.exe family_berbew behavioral1/memory/328-255-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\tthhtb.exe family_berbew behavioral1/memory/1588-266-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew C:\jdvdp.exe family_berbew behavioral1/memory/2388-282-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew \??\c:\frrrrxl.exe family_berbew C:\bthhbb.exe family_berbew behavioral1/memory/2100-307-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral1/memory/2100-306-0x00000000775E0000-0x00000000776DA000-memory.dmp family_berbew behavioral1/memory/2100-305-0x00000000776E0000-0x00000000777FF000-memory.dmp family_berbew behavioral1/memory/3044-320-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew -
Executes dropped EXE 64 IoCs
Processes:
9nbnbb.exe3ntbnn.exe7pvpv.exe1xlrffl.exejvjjj.exenhnhhn.exebnbhhn.exejpjjj.exethtntt.exejvjjj.exe5tnhnh.exefxfffll.exe1xlxflr.exe5pddp.exebththh.exe1jppd.exefxlrxxl.exe1thhnn.exeddvdp.exevjvvd.exexlflllr.exehbbbhn.exeflrlflx.exedvdjp.exefxffflr.exenhtbhh.exedvpvp.exe5thntt.exedvjpv.exetthhtb.exejdvdp.exefrrrrxl.exebthhbb.exefxllrrf.exenhbbhh.exedjdpd.exethttbh.exedvjpd.exe7frlfff.exetnnntb.exehhtbhn.exejjjjp.exerxxrlrl.exehbnnbh.exeddvdj.exeppjvj.exe3xrlxxx.exe3nnhhn.exeddvjv.exepjjpv.exe3tbtth.exe5nnnbb.exe7dvpp.exefxxflrf.exe9bbhhn.exennhhtt.exe3vvvv.exerlffrrl.exennhthh.exe1ttttb.exe5dddp.exexrlfrrx.exelxllrrx.exenhbnhn.exepid process 1580 9nbnbb.exe 1912 3ntbnn.exe 2708 7pvpv.exe 2572 1xlrffl.exe 2060 jvjjj.exe 2568 nhnhhn.exe 1528 bnbhhn.exe 2544 jpjjj.exe 2204 thtntt.exe 2804 jvjjj.exe 2860 5tnhnh.exe 2664 fxfffll.exe 1208 1xlxflr.exe 2112 5pddp.exe 672 bththh.exe 2780 1jppd.exe 1048 fxlrxxl.exe 1172 1thhnn.exe 1964 ddvdp.exe 3036 vjvvd.exe 2800 xlflllr.exe 2056 hbbbhn.exe 3016 flrlflx.exe 2052 dvdjp.exe 2344 fxffflr.exe 1972 nhtbhh.exe 1684 dvpvp.exe 328 5thntt.exe 788 dvjpv.exe 1588 tthhtb.exe 2388 jdvdp.exe 2332 frrrrxl.exe 1884 bthhbb.exe 2944 fxllrrf.exe 2100 nhbbhh.exe 3044 djdpd.exe 1580 thttbh.exe 2740 dvjpd.exe 2616 7frlfff.exe 1968 tnnntb.exe 2728 hhtbhn.exe 2488 jjjjp.exe 3064 rxxrlrl.exe 2512 hbnnbh.exe 2464 ddvdj.exe 2508 ppjvj.exe 3048 3xrlxxx.exe 2824 3nnhhn.exe 2872 ddvjv.exe 2884 pjjpv.exe 1340 3tbtth.exe 1824 5nnnbb.exe 568 7dvpp.exe 2776 fxxflrf.exe 2772 9bbhhn.exe 1436 nnhhtt.exe 2024 3vvvv.exe 1976 rlffrrl.exe 2028 nnhthh.exe 1948 1ttttb.exe 2120 5dddp.exe 2644 xrlfrrx.exe 1768 lxllrrx.exe 1728 nhbnhn.exe -
Processes:
resource yara_rule behavioral1/memory/2368-1-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1580-8-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\9nbnbb.exe upx \??\c:\3ntbnn.exe upx behavioral1/memory/1580-16-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\7pvpv.exe upx behavioral1/memory/2708-28-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1912-27-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1xlrffl.exe upx behavioral1/memory/2572-37-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2572-44-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jvjjj.exe upx C:\nhnhhn.exe upx behavioral1/memory/2568-57-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2060-54-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1528-66-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\bnbhhn.exe upx behavioral1/memory/2544-75-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\jpjjj.exe upx \??\c:\thtntt.exe upx behavioral1/memory/2204-84-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2804-87-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\5tnhnh.exe upx behavioral1/memory/2804-94-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2860-103-0x0000000000220000-0x000000000025A000-memory.dmp upx C:\fxfffll.exe upx behavioral1/memory/2664-106-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\1xlxflr.exe upx \??\c:\5pddp.exe upx C:\bththh.exe upx behavioral1/memory/2112-129-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/672-131-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/672-139-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1jppd.exe upx behavioral1/memory/2780-143-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/1048-151-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\fxlrxxl.exe upx behavioral1/memory/1172-160-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\1thhnn.exe upx C:\ddvdp.exe upx behavioral1/memory/1964-175-0x0000000000440000-0x000000000047A000-memory.dmp upx \??\c:\vjvvd.exe upx C:\xlflllr.exe upx behavioral1/memory/2800-189-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\hbbbhn.exe upx C:\flrlflx.exe upx behavioral1/memory/3016-212-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\dvdjp.exe upx C:\fxffflr.exe upx behavioral1/memory/2344-229-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\nhtbhh.exe upx C:\dvpvp.exe upx \??\c:\5thntt.exe upx C:\dvjpv.exe upx behavioral1/memory/328-255-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\tthhtb.exe upx behavioral1/memory/1588-266-0x0000000000400000-0x000000000043A000-memory.dmp upx C:\jdvdp.exe upx behavioral1/memory/2388-282-0x0000000000400000-0x000000000043A000-memory.dmp upx \??\c:\frrrrxl.exe upx C:\bthhbb.exe upx behavioral1/memory/2100-307-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/3044-320-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral1/memory/2616-333-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe9nbnbb.exe3ntbnn.exe7pvpv.exe1xlrffl.exejvjjj.exenhnhhn.exebnbhhn.exejpjjj.exethtntt.exejvjjj.exe5tnhnh.exefxfffll.exe1xlxflr.exe5pddp.exebththh.exedescription pid process target process PID 2368 wrote to memory of 1580 2368 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe 9nbnbb.exe PID 2368 wrote to memory of 1580 2368 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe 9nbnbb.exe PID 2368 wrote to memory of 1580 2368 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe 9nbnbb.exe PID 2368 wrote to memory of 1580 2368 e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe 9nbnbb.exe PID 1580 wrote to memory of 1912 1580 9nbnbb.exe 3ntbnn.exe PID 1580 wrote to memory of 1912 1580 9nbnbb.exe 3ntbnn.exe PID 1580 wrote to memory of 1912 1580 9nbnbb.exe 3ntbnn.exe PID 1580 wrote to memory of 1912 1580 9nbnbb.exe 3ntbnn.exe PID 1912 wrote to memory of 2708 1912 3ntbnn.exe 7pvpv.exe PID 1912 wrote to memory of 2708 1912 3ntbnn.exe 7pvpv.exe PID 1912 wrote to memory of 2708 1912 3ntbnn.exe 7pvpv.exe PID 1912 wrote to memory of 2708 1912 3ntbnn.exe 7pvpv.exe PID 2708 wrote to memory of 2572 2708 7pvpv.exe 1xlrffl.exe PID 2708 wrote to memory of 2572 2708 7pvpv.exe 1xlrffl.exe PID 2708 wrote to memory of 2572 2708 7pvpv.exe 1xlrffl.exe PID 2708 wrote to memory of 2572 2708 7pvpv.exe 1xlrffl.exe PID 2572 wrote to memory of 2060 2572 1xlrffl.exe jvjjj.exe PID 2572 wrote to memory of 2060 2572 1xlrffl.exe jvjjj.exe PID 2572 wrote to memory of 2060 2572 1xlrffl.exe jvjjj.exe PID 2572 wrote to memory of 2060 2572 1xlrffl.exe jvjjj.exe PID 2060 wrote to memory of 2568 2060 jvjjj.exe nhnhhn.exe PID 2060 wrote to memory of 2568 2060 jvjjj.exe nhnhhn.exe PID 2060 wrote to memory of 2568 2060 jvjjj.exe nhnhhn.exe PID 2060 wrote to memory of 2568 2060 jvjjj.exe nhnhhn.exe PID 2568 wrote to memory of 1528 2568 nhnhhn.exe bnbhhn.exe PID 2568 wrote to memory of 1528 2568 nhnhhn.exe bnbhhn.exe PID 2568 wrote to memory of 1528 2568 nhnhhn.exe bnbhhn.exe PID 2568 wrote to memory of 1528 2568 nhnhhn.exe bnbhhn.exe PID 1528 wrote to memory of 2544 1528 bnbhhn.exe jpjjj.exe PID 1528 wrote to memory of 2544 1528 bnbhhn.exe jpjjj.exe PID 1528 wrote to memory of 2544 1528 bnbhhn.exe jpjjj.exe PID 1528 wrote to memory of 2544 1528 bnbhhn.exe jpjjj.exe PID 2544 wrote to memory of 2204 2544 jpjjj.exe thtntt.exe PID 2544 wrote to memory of 2204 2544 jpjjj.exe thtntt.exe PID 2544 wrote to memory of 2204 2544 jpjjj.exe thtntt.exe PID 2544 wrote to memory of 2204 2544 jpjjj.exe thtntt.exe PID 2204 wrote to memory of 2804 2204 thtntt.exe jvjjj.exe PID 2204 wrote to memory of 2804 2204 thtntt.exe jvjjj.exe PID 2204 wrote to memory of 2804 2204 thtntt.exe jvjjj.exe PID 2204 wrote to memory of 2804 2204 thtntt.exe jvjjj.exe PID 2804 wrote to memory of 2860 2804 jvjjj.exe 5tnhnh.exe PID 2804 wrote to memory of 2860 2804 jvjjj.exe 5tnhnh.exe PID 2804 wrote to memory of 2860 2804 jvjjj.exe 5tnhnh.exe PID 2804 wrote to memory of 2860 2804 jvjjj.exe 5tnhnh.exe PID 2860 wrote to memory of 2664 2860 5tnhnh.exe fxfffll.exe PID 2860 wrote to memory of 2664 2860 5tnhnh.exe fxfffll.exe PID 2860 wrote to memory of 2664 2860 5tnhnh.exe fxfffll.exe PID 2860 wrote to memory of 2664 2860 5tnhnh.exe fxfffll.exe PID 2664 wrote to memory of 1208 2664 fxfffll.exe 1xlxflr.exe PID 2664 wrote to memory of 1208 2664 fxfffll.exe 1xlxflr.exe PID 2664 wrote to memory of 1208 2664 fxfffll.exe 1xlxflr.exe PID 2664 wrote to memory of 1208 2664 fxfffll.exe 1xlxflr.exe PID 1208 wrote to memory of 2112 1208 1xlxflr.exe 5pddp.exe PID 1208 wrote to memory of 2112 1208 1xlxflr.exe 5pddp.exe PID 1208 wrote to memory of 2112 1208 1xlxflr.exe 5pddp.exe PID 1208 wrote to memory of 2112 1208 1xlxflr.exe 5pddp.exe PID 2112 wrote to memory of 672 2112 5pddp.exe bththh.exe PID 2112 wrote to memory of 672 2112 5pddp.exe bththh.exe PID 2112 wrote to memory of 672 2112 5pddp.exe bththh.exe PID 2112 wrote to memory of 672 2112 5pddp.exe bththh.exe PID 672 wrote to memory of 2780 672 bththh.exe 1jppd.exe PID 672 wrote to memory of 2780 672 bththh.exe 1jppd.exe PID 672 wrote to memory of 2780 672 bththh.exe 1jppd.exe PID 672 wrote to memory of 2780 672 bththh.exe 1jppd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e166d727e89fa1c86a9d597c776a7220_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\9nbnbb.exec:\9nbnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\3ntbnn.exec:\3ntbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\7pvpv.exec:\7pvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\1xlrffl.exec:\1xlrffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\jvjjj.exec:\jvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nhnhhn.exec:\nhnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bnbhhn.exec:\bnbhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jpjjj.exec:\jpjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\thtntt.exec:\thtntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\jvjjj.exec:\jvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\5tnhnh.exec:\5tnhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fxfffll.exec:\fxfffll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1xlxflr.exec:\1xlxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\5pddp.exec:\5pddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\bththh.exec:\bththh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\1jppd.exec:\1jppd.exe17⤵
- Executes dropped EXE
PID:2780 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe18⤵
- Executes dropped EXE
PID:1048 -
\??\c:\1thhnn.exec:\1thhnn.exe19⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ddvdp.exec:\ddvdp.exe20⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vjvvd.exec:\vjvvd.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xlflllr.exec:\xlflllr.exe22⤵
- Executes dropped EXE
PID:2800 -
\??\c:\hbbbhn.exec:\hbbbhn.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flrlflx.exec:\flrlflx.exe24⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvdjp.exec:\dvdjp.exe25⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxffflr.exec:\fxffflr.exe26⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhtbhh.exec:\nhtbhh.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dvpvp.exec:\dvpvp.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5thntt.exec:\5thntt.exe29⤵
- Executes dropped EXE
PID:328 -
\??\c:\dvjpv.exec:\dvjpv.exe30⤵
- Executes dropped EXE
PID:788 -
\??\c:\tthhtb.exec:\tthhtb.exe31⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jdvdp.exec:\jdvdp.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\frrrrxl.exec:\frrrrxl.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bthhbb.exec:\bthhbb.exe34⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxllrrf.exec:\fxllrrf.exe35⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhbbhh.exec:\nhbbhh.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\hbhnbt.exec:\hbhnbt.exe37⤵PID:1500
-
\??\c:\djdpd.exec:\djdpd.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\thttbh.exec:\thttbh.exe39⤵
- Executes dropped EXE
PID:1580 -
\??\c:\dvjpd.exec:\dvjpd.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7frlfff.exec:\7frlfff.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnnntb.exec:\tnnntb.exe42⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hhtbhn.exec:\hhtbhn.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjjjp.exec:\jjjjp.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rxxrlrl.exec:\rxxrlrl.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbnnbh.exec:\hbnnbh.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ddvdj.exec:\ddvdj.exe47⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ppjvj.exec:\ppjvj.exe48⤵
- Executes dropped EXE
PID:2508 -
\??\c:\3xrlxxx.exec:\3xrlxxx.exe49⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3nnhhn.exec:\3nnhhn.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ddvjv.exec:\ddvjv.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjjpv.exec:\pjjpv.exe52⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3tbtth.exec:\3tbtth.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5nnnbb.exec:\5nnnbb.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\7dvpp.exec:\7dvpp.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\fxxflrf.exec:\fxxflrf.exe56⤵
- Executes dropped EXE
PID:2776 -
\??\c:\9bbhhn.exec:\9bbhhn.exe57⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nnhhtt.exec:\nnhhtt.exe58⤵
- Executes dropped EXE
PID:1436 -
\??\c:\3vvvv.exec:\3vvvv.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlffrrl.exec:\rlffrrl.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nnhthh.exec:\nnhthh.exe61⤵
- Executes dropped EXE
PID:2028 -
\??\c:\1ttttb.exec:\1ttttb.exe62⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5dddp.exec:\5dddp.exe63⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe64⤵
- Executes dropped EXE
PID:2644 -
\??\c:\lxllrrx.exec:\lxllrrx.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nhbnhn.exec:\nhbnhn.exe66⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjvdj.exec:\pjvdj.exe67⤵PID:1616
-
\??\c:\jdppv.exec:\jdppv.exe68⤵PID:1908
-
\??\c:\xrffrrf.exec:\xrffrrf.exe69⤵PID:1648
-
\??\c:\3httbh.exec:\3httbh.exe70⤵PID:820
-
\??\c:\vpjpd.exec:\vpjpd.exe71⤵PID:1568
-
\??\c:\dvvdp.exec:\dvvdp.exe72⤵PID:1684
-
\??\c:\rrffflr.exec:\rrffflr.exe73⤵PID:996
-
\??\c:\nnnntb.exec:\nnnntb.exe74⤵PID:336
-
\??\c:\nhtbnb.exec:\nhtbnb.exe75⤵PID:556
-
\??\c:\ppjpv.exec:\ppjpv.exe76⤵PID:1448
-
\??\c:\lffflrx.exec:\lffflrx.exe77⤵PID:2388
-
\??\c:\nhttnn.exec:\nhttnn.exe78⤵PID:880
-
\??\c:\pjddp.exec:\pjddp.exe79⤵PID:992
-
\??\c:\vvpvd.exec:\vvpvd.exe80⤵PID:1608
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe81⤵PID:2100
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe82⤵PID:2064
-
\??\c:\5hnthn.exec:\5hnthn.exe83⤵PID:2380
-
\??\c:\djdpd.exec:\djdpd.exe84⤵PID:2736
-
\??\c:\vjvpp.exec:\vjvpp.exe85⤵PID:2712
-
\??\c:\xrflxrf.exec:\xrflxrf.exe86⤵PID:2600
-
\??\c:\9nbbnn.exec:\9nbbnn.exe87⤵PID:2708
-
\??\c:\5thhtt.exec:\5thhtt.exe88⤵PID:2648
-
\??\c:\xlxfllr.exec:\xlxfllr.exe89⤵PID:2468
-
\??\c:\fxxlrlx.exec:\fxxlrlx.exe90⤵PID:2568
-
\??\c:\bbnhnn.exec:\bbnhnn.exe91⤵PID:2720
-
\??\c:\jjddp.exec:\jjddp.exe92⤵PID:1528
-
\??\c:\1jvjj.exec:\1jvjj.exe93⤵PID:2516
-
\??\c:\xrfrllx.exec:\xrfrllx.exe94⤵PID:2844
-
\??\c:\bthnht.exec:\bthnht.exe95⤵PID:2876
-
\??\c:\dvpvd.exec:\dvpvd.exe96⤵PID:2816
-
\??\c:\1lflrfl.exec:\1lflrfl.exe97⤵PID:2988
-
\??\c:\xflrflf.exec:\xflrflf.exe98⤵PID:2884
-
\??\c:\nnhnnt.exec:\nnhnnt.exe99⤵PID:840
-
\??\c:\hbtbnn.exec:\hbtbnn.exe100⤵PID:660
-
\??\c:\jdjvp.exec:\jdjvp.exe101⤵PID:320
-
\??\c:\9xrfrxl.exec:\9xrfrxl.exe102⤵PID:2776
-
\??\c:\nhttnh.exec:\nhttnh.exe103⤵PID:584
-
\??\c:\7bhbhb.exec:\7bhbhb.exe104⤵PID:2044
-
\??\c:\jdpjp.exec:\jdpjp.exe105⤵PID:2308
-
\??\c:\xrxrxfl.exec:\xrxrxfl.exe106⤵PID:2564
-
\??\c:\btthhb.exec:\btthhb.exe107⤵PID:1092
-
\??\c:\bnhntb.exec:\bnhntb.exe108⤵PID:1904
-
\??\c:\vvvdj.exec:\vvvdj.exe109⤵PID:1292
-
\??\c:\fxllxrx.exec:\fxllxrx.exe110⤵PID:1956
-
\??\c:\9hthnh.exec:\9hthnh.exe111⤵PID:2220
-
\??\c:\9bbhtb.exec:\9bbhtb.exe112⤵PID:1728
-
\??\c:\jvpvd.exec:\jvpvd.exe113⤵PID:2300
-
\??\c:\5fxxfrx.exec:\5fxxfrx.exe114⤵PID:2280
-
\??\c:\lxxfrrf.exec:\lxxfrrf.exe115⤵PID:2912
-
\??\c:\tttbhh.exec:\tttbhh.exe116⤵PID:1308
-
\??\c:\9dpjp.exec:\9dpjp.exe117⤵PID:3060
-
\??\c:\rlxxllr.exec:\rlxxllr.exe118⤵PID:844
-
\??\c:\hnnhth.exec:\hnnhth.exe119⤵PID:2240
-
\??\c:\dvdjp.exec:\dvdjp.exe120⤵PID:336
-
\??\c:\vppvj.exec:\vppvj.exe121⤵PID:1840
-
\??\c:\ffxxflx.exec:\ffxxflx.exe122⤵PID:2788
-
\??\c:\tbttbh.exec:\tbttbh.exe123⤵PID:1552
-
\??\c:\5dvdd.exec:\5dvdd.exe124⤵PID:2964
-
\??\c:\jdpjp.exec:\jdpjp.exe125⤵PID:2384
-
\??\c:\fxrxffr.exec:\fxrxffr.exe126⤵PID:1608
-
\??\c:\hbtbnt.exec:\hbtbnt.exe127⤵PID:2576
-
\??\c:\1btbhn.exec:\1btbhn.exe128⤵PID:3044
-
\??\c:\dvjjp.exec:\dvjjp.exe129⤵PID:2696
-
\??\c:\pjvdj.exec:\pjvdj.exe130⤵PID:2592
-
\??\c:\fxrxlfr.exec:\fxrxlfr.exe131⤵PID:2572
-
\??\c:\hbnnhh.exec:\hbnnhh.exe132⤵PID:1968
-
\??\c:\bthnhn.exec:\bthnhn.exe133⤵PID:2060
-
\??\c:\vpdjd.exec:\vpdjd.exe134⤵PID:2648
-
\??\c:\xxfxflx.exec:\xxfxflx.exe135⤵PID:2532
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe136⤵PID:2568
-
\??\c:\hbthtb.exec:\hbthtb.exe137⤵PID:2720
-
\??\c:\djjjd.exec:\djjjd.exe138⤵PID:1784
-
\??\c:\pvjpv.exec:\pvjpv.exe139⤵PID:2836
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe140⤵PID:2864
-
\??\c:\tnthth.exec:\tnthth.exe141⤵PID:2972
-
\??\c:\btnntb.exec:\btnntb.exe142⤵PID:1644
-
\??\c:\3vvjp.exec:\3vvjp.exe143⤵PID:2984
-
\??\c:\7flflrx.exec:\7flflrx.exe144⤵PID:1456
-
\??\c:\9nhnbh.exec:\9nhnbh.exe145⤵PID:1828
-
\??\c:\5ntbnt.exec:\5ntbnt.exe146⤵PID:1540
-
\??\c:\ppdvj.exec:\ppdvj.exe147⤵PID:672
-
\??\c:\jjppv.exec:\jjppv.exe148⤵PID:1400
-
\??\c:\7rllxfl.exec:\7rllxfl.exe149⤵PID:1436
-
\??\c:\9tntnn.exec:\9tntnn.exe150⤵PID:2024
-
\??\c:\nttnbt.exec:\nttnbt.exe151⤵PID:1676
-
\??\c:\9vjpv.exec:\9vjpv.exe152⤵PID:1368
-
\??\c:\3jjvv.exec:\3jjvv.exe153⤵PID:1992
-
\??\c:\xrllffx.exec:\xrllffx.exe154⤵PID:1204
-
\??\c:\bnnhnt.exec:\bnnhnt.exe155⤵PID:1088
-
\??\c:\hbtbnn.exec:\hbtbnn.exe156⤵PID:1072
-
\??\c:\jpjpd.exec:\jpjpd.exe157⤵PID:1832
-
\??\c:\lllfrrf.exec:\lllfrrf.exe158⤵PID:2220
-
\??\c:\9llrrrf.exec:\9llrrrf.exe159⤵PID:408
-
\??\c:\hhtbht.exec:\hhtbht.exe160⤵PID:2344
-
\??\c:\5jjvv.exec:\5jjvv.exe161⤵PID:2280
-
\??\c:\1dvdp.exec:\1dvdp.exe162⤵PID:2912
-
\??\c:\xfxfrxx.exec:\xfxfrxx.exe163⤵PID:328
-
\??\c:\1nhbnn.exec:\1nhbnn.exe164⤵PID:1780
-
\??\c:\tnnbnn.exec:\tnnbnn.exe165⤵PID:2236
-
\??\c:\jdpvj.exec:\jdpvj.exe166⤵PID:788
-
\??\c:\dvppv.exec:\dvppv.exe167⤵PID:556
-
\??\c:\fxxflrx.exec:\fxxflrx.exe168⤵PID:2116
-
\??\c:\ttthth.exec:\ttthth.exe169⤵PID:1576
-
\??\c:\3tntnt.exec:\3tntnt.exe170⤵PID:2336
-
\??\c:\jddvp.exec:\jddvp.exe171⤵PID:880
-
\??\c:\jpjvd.exec:\jpjvd.exe172⤵PID:340
-
\??\c:\lxlrflx.exec:\lxlrflx.exe173⤵PID:2180
-
\??\c:\9bhtht.exec:\9bhtht.exe174⤵PID:2248
-
\??\c:\vpjpj.exec:\vpjpj.exe175⤵PID:2064
-
\??\c:\7jjvd.exec:\7jjvd.exe176⤵PID:2596
-
\??\c:\xlxfffr.exec:\xlxfffr.exe177⤵PID:3044
-
\??\c:\5rrflll.exec:\5rrflll.exe178⤵PID:2704
-
\??\c:\hnhnbh.exec:\hnhnbh.exe179⤵PID:2592
-
\??\c:\dvvjd.exec:\dvvjd.exe180⤵PID:2500
-
\??\c:\jvpdp.exec:\jvpdp.exe181⤵PID:1968
-
\??\c:\llxfrrf.exec:\llxfrrf.exe182⤵PID:2484
-
\??\c:\bbtbtt.exec:\bbtbtt.exe183⤵PID:2476
-
\??\c:\bnnnbh.exec:\bnnnbh.exe184⤵PID:2532
-
\??\c:\pjjjd.exec:\pjjjd.exe185⤵PID:2328
-
\??\c:\lfxflrl.exec:\lfxflrl.exe186⤵PID:1528
-
\??\c:\9llxflx.exec:\9llxflx.exe187⤵PID:1784
-
\??\c:\hhbnnt.exec:\hhbnnt.exe188⤵PID:2836
-
\??\c:\jdvvj.exec:\jdvvj.exe189⤵PID:2824
-
\??\c:\5vpjp.exec:\5vpjp.exe190⤵PID:2972
-
\??\c:\lxfllrf.exec:\lxfllrf.exe191⤵PID:836
-
\??\c:\lrfflrf.exec:\lrfflrf.exe192⤵PID:2988
-
\??\c:\hhbnhh.exec:\hhbnhh.exe193⤵PID:624
-
\??\c:\pjppd.exec:\pjppd.exe194⤵PID:2372
-
\??\c:\jjjpp.exec:\jjjpp.exe195⤵PID:2684
-
\??\c:\ffxflrl.exec:\ffxflrl.exe196⤵PID:320
-
\??\c:\nnhtbh.exec:\nnhtbh.exe197⤵PID:584
-
\??\c:\hhtntb.exec:\hhtntb.exe198⤵PID:2676
-
\??\c:\vpjvd.exec:\vpjvd.exe199⤵PID:2252
-
\??\c:\dddjp.exec:\dddjp.exe200⤵PID:1976
-
\??\c:\lfrrllx.exec:\lfrrllx.exe201⤵PID:1948
-
\??\c:\tnhtbh.exec:\tnhtbh.exe202⤵PID:1628
-
\??\c:\ththnb.exec:\ththnb.exe203⤵PID:2800
-
\??\c:\pvvjv.exec:\pvvjv.exe204⤵PID:3008
-
\??\c:\3rffllx.exec:\3rffllx.exe205⤵PID:3016
-
\??\c:\1lfrfrl.exec:\1lfrfrl.exe206⤵PID:2320
-
\??\c:\hbtnbh.exec:\hbtnbh.exe207⤵PID:816
-
\??\c:\3bttbb.exec:\3bttbb.exe208⤵PID:784
-
\??\c:\3dvdj.exec:\3dvdj.exe209⤵PID:2084
-
\??\c:\flffxxf.exec:\flffxxf.exe210⤵PID:1844
-
\??\c:\1xxxlrx.exec:\1xxxlrx.exe211⤵PID:1308
-
\??\c:\btthhn.exec:\btthhn.exe212⤵PID:916
-
\??\c:\1tnhbh.exec:\1tnhbh.exe213⤵PID:856
-
\??\c:\5djdp.exec:\5djdp.exe214⤵PID:600
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe215⤵PID:2268
-
\??\c:\lfrxfrf.exec:\lfrxfrf.exe216⤵PID:1016
-
\??\c:\bhtbnt.exec:\bhtbnt.exe217⤵PID:2960
-
\??\c:\vpdvd.exec:\vpdvd.exe218⤵PID:1688
-
\??\c:\jjjjj.exec:\jjjjj.exe219⤵PID:1872
-
\??\c:\frrxlfx.exec:\frrxlfx.exe220⤵PID:992
-
\??\c:\btnnbb.exec:\btnnbb.exe221⤵PID:1480
-
\??\c:\5hhhnt.exec:\5hhhnt.exe222⤵PID:1516
-
\??\c:\dvpvd.exec:\dvpvd.exe223⤵PID:1508
-
\??\c:\3pjvv.exec:\3pjvv.exe224⤵PID:2608
-
\??\c:\xfllxxl.exec:\xfllxxl.exe225⤵PID:2752
-
\??\c:\tnbbhh.exec:\tnbbhh.exe226⤵PID:2716
-
\??\c:\3tbhtt.exec:\3tbhtt.exe227⤵PID:2880
-
\??\c:\pjdjp.exec:\pjdjp.exe228⤵PID:2600
-
\??\c:\jjjpv.exec:\jjjpv.exe229⤵PID:2628
-
\??\c:\llxxfxf.exec:\llxxfxf.exe230⤵PID:2480
-
\??\c:\5hbhnt.exec:\5hbhnt.exe231⤵PID:2496
-
\??\c:\bbtbnn.exec:\bbtbnn.exe232⤵PID:2588
-
\??\c:\pjdpj.exec:\pjdpj.exe233⤵PID:2568
-
\??\c:\1frxlll.exec:\1frxlll.exe234⤵PID:2720
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe235⤵PID:2464
-
\??\c:\htnnbh.exec:\htnnbh.exe236⤵PID:2516
-
\??\c:\3vjjj.exec:\3vjjj.exe237⤵PID:2876
-
\??\c:\3vvjv.exec:\3vvjv.exe238⤵PID:2832
-
\??\c:\rlxrxfl.exec:\rlxrxfl.exe239⤵PID:2664
-
\??\c:\nhhtnt.exec:\nhhtnt.exe240⤵PID:1372
-
\??\c:\9bhthn.exec:\9bhthn.exe241⤵PID:1456
-
\??\c:\dddjv.exec:\dddjv.exe242⤵PID:484