Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 17:50
Behavioral task
behavioral1
Sample
0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
- Target 0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe
- Size 464KB
- Sample240519-wez76aac43
- SHA256 9bb758e5dd3dd4b81872772337a04cdf285818ed2f14fd4f9c31a86e8f2ad2a6
- MD5 0b8602fa69521b6a56842bf54153bd20
- SHA1 d9529e4fa5eccc7e81234cb617bec7cd15a0e928
- SHA512 00408511d6cf6ca5e6cc0d9b83e46c414ee08d4685875fa025d7ae43ae4b4b031a7d9398fd0bd13e2aa8bb862dbe2e232f838288c67828dfa845240975b7674e
- SSDEEP 12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1VD:VeR0oykayRFp3lztP+OKaf1VD
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/348-7-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2260-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3040-13-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4484-33-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3512-54-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2792-38-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1992-29-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/828-59-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4564-62-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3780-71-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2400-82-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/696-91-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3008-96-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2756-90-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3652-117-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/944-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1984-109-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4528-108-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2032-141-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4120-150-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5016-157-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4840-188-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2168-202-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3272-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4440-218-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3640-227-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1176-228-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/836-241-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/968-252-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1724-259-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3972-269-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4528-285-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4648-290-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4852-296-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/708-309-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2876-317-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4480-327-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2000-342-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4620-349-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/348-353-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4368-354-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4440-364-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3608-371-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1168-378-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1432-386-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4588-392-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/696-414-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3008-418-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5008-428-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2316-435-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1028-467-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2388-487-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/348-494-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4560-502-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3056-506-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2216-528-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3972-547-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3068-560-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3852-611-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2756-820-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1820-863-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4856-930-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2176-989-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon - Malware Dropper & Backdoor - Berbew 64 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/memory/348-0-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0008000000022f51-4.dat family_berbew behavioral2/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/348-7-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000233fb-14.dat family_berbew behavioral2/memory/2260-18-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3040-13-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000a0000000233f2-11.dat family_berbew behavioral2/files/0x00070000000233fd-24.dat family_berbew behavioral2/memory/1992-25-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000233fe-30.dat family_berbew behavioral2/memory/4484-33-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x00070000000233ff-36.dat family_berbew behavioral2/files/0x0007000000023400-41.dat family_berbew behavioral2/files/0x0007000000023401-47.dat family_berbew behavioral2/files/0x0007000000023402-52.dat family_berbew behavioral2/memory/3512-54-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/828-53-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2792-38-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/1992-29-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023403-58.dat family_berbew behavioral2/memory/828-59-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4564-62-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023404-64.dat family_berbew behavioral2/files/0x0007000000023405-69.dat family_berbew behavioral2/memory/3780-71-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023406-75.dat family_berbew behavioral2/memory/2400-82-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023407-80.dat family_berbew behavioral2/files/0x000a0000000233f3-86.dat family_berbew behavioral2/memory/696-91-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023408-94.dat family_berbew behavioral2/memory/3008-96-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2756-90-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023409-99.dat family_berbew behavioral2/files/0x000700000002340b-104.dat family_berbew behavioral2/files/0x000700000002340d-119.dat family_berbew behavioral2/files/0x000700000002340e-124.dat family_berbew behavioral2/memory/3652-117-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/944-125-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002340c-113.dat family_berbew behavioral2/memory/1984-109-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4528-108-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x000700000002340f-128.dat family_berbew behavioral2/files/0x0007000000023410-134.dat family_berbew behavioral2/files/0x0007000000023411-139.dat family_berbew behavioral2/memory/2032-141-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023412-144.dat family_berbew behavioral2/files/0x0007000000023413-151.dat family_berbew behavioral2/memory/4120-150-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023411-155.dat family_berbew behavioral2/memory/5016-157-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023414-163.dat family_berbew behavioral2/memory/4424-164-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/files/0x0007000000023415-168.dat family_berbew behavioral2/files/0x0007000000023416-172.dat family_berbew behavioral2/files/0x0007000000023417-177.dat family_berbew behavioral2/files/0x0007000000023418-182.dat family_berbew behavioral2/memory/4840-188-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/744-195-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/2168-202-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3272-212-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/4440-218-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew behavioral2/memory/3640-223-0x0000000000400000-0x000000000043A000-memory.dmp family_berbew - Executes dropped EXE 64 IoCs
pid Process 2848 vvddd.exe 3040 dpdvp.exe 2260 fflffff.exe 1992 hhbtbh.exe 4484 djvvv.exe 2792 9xfffll.exe 3252 hhhhnt.exe 3512 3bhbbb.exe 828 vdpjj.exe 4564 ddjjj.exe 3780 xflffff.exe 3328 jpddp.exe 2400 xfxxffr.exe 2756 rrrrrlf.exe 696 vdvpv.exe 3008 lxxrxfr.exe 4528 btntnt.exe 1984 hbhhhh.exe 3652 pjvdp.exe 4420 lxllllf.exe 944 bbbbtt.exe 4348 5fxrllf.exe 4872 1hthhh.exe 2032 ddvpj.exe 4120 1hnhtn.exe 5016 frxxrrr.exe 3456 ddvpj.exe 4424 xfrrlll.exe 564 vvdvp.exe 4764 7bnhbb.exe 2864 9pvjv.exe 1736 3ffxxxx.exe 4840 httttt.exe 4892 vpvpv.exe 744 rlrlfrl.exe 2168 tbhbtt.exe 4320 jpvpj.exe 2624 xffrrlx.exe 3272 jdpjj.exe 4956 frfxfxx.exe 4440 nnnnnh.exe 860 hhtnbh.exe 3640 9pvdv.exe 1176 rffffff.exe 900 vpdvj.exe 3252 vjpdv.exe 836 1lrfrfr.exe 4112 vpjpd.exe 2024 9pppj.exe 968 5thbtt.exe 2216 jpvpd.exe 1724 lxxrfxr.exe 1472 bbbtnh.exe 3020 vddvj.exe 3972 lxllffx.exe 2044 vdvpd.exe 468 xlrlxfx.exe 1676 rffxrxx.exe 656 bnbtnh.exe 1480 vdjdp.exe 4528 jjpdv.exe 4648 xffxllf.exe 4852 tthbbb.exe 3568 rrxlrll.exe -
resource yara_rule behavioral2/memory/348-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/2848-8-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/348-7-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233fb-14.dat upx behavioral2/memory/2260-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3040-13-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000a0000000233f2-11.dat upx behavioral2/files/0x00070000000233fd-24.dat upx behavioral2/memory/1992-25-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233fe-30.dat upx behavioral2/memory/4484-33-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233ff-36.dat upx behavioral2/files/0x0007000000023400-41.dat upx behavioral2/files/0x0007000000023401-47.dat upx behavioral2/files/0x0007000000023402-52.dat upx behavioral2/memory/3512-54-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/828-53-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2792-38-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1992-29-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023403-58.dat upx behavioral2/memory/828-59-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4564-62-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023404-64.dat upx behavioral2/files/0x0007000000023405-69.dat upx behavioral2/memory/3780-71-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023406-75.dat upx behavioral2/memory/2400-82-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023407-80.dat upx behavioral2/files/0x000a0000000233f3-86.dat upx behavioral2/memory/696-91-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023408-94.dat upx behavioral2/memory/3008-96-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2756-90-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023409-99.dat upx behavioral2/files/0x000700000002340b-104.dat upx behavioral2/files/0x000700000002340d-119.dat upx behavioral2/files/0x000700000002340e-124.dat upx behavioral2/memory/3652-117-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/944-125-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002340c-113.dat upx behavioral2/memory/1984-109-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4528-108-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000700000002340f-128.dat upx behavioral2/files/0x0007000000023410-134.dat upx behavioral2/files/0x0007000000023411-139.dat upx behavioral2/memory/2032-141-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023412-144.dat upx behavioral2/files/0x0007000000023413-151.dat upx behavioral2/memory/4120-150-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023411-155.dat upx behavioral2/memory/5016-157-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023414-163.dat upx behavioral2/memory/4424-164-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x0007000000023415-168.dat upx behavioral2/files/0x0007000000023416-172.dat upx behavioral2/files/0x0007000000023417-177.dat upx behavioral2/files/0x0007000000023418-182.dat upx behavioral2/memory/4840-188-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/744-195-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2168-202-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3272-212-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4440-218-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3640-223-0x0000000000400000-0x000000000043A000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 348 wrote to memory of 2848 348 0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe 84 PID 348 wrote to memory of 2848 348 0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe 84 PID 348 wrote to memory of 2848 348 0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe 84 PID 2848 wrote to memory of 3040 2848 vvddd.exe 85 PID 2848 wrote to memory of 3040 2848 vvddd.exe 85 PID 2848 wrote to memory of 3040 2848 vvddd.exe 85 PID 3040 wrote to memory of 2260 3040 dpdvp.exe 86 PID 3040 wrote to memory of 2260 3040 dpdvp.exe 86 PID 3040 wrote to memory of 2260 3040 dpdvp.exe 86 PID 2260 wrote to memory of 1992 2260 fflffff.exe 87 PID 2260 wrote to memory of 1992 2260 fflffff.exe 87 PID 2260 wrote to memory of 1992 2260 fflffff.exe 87 PID 1992 wrote to memory of 4484 1992 hhbtbh.exe 88 PID 1992 wrote to memory of 4484 1992 hhbtbh.exe 88 PID 1992 wrote to memory of 4484 1992 hhbtbh.exe 88 PID 4484 wrote to memory of 2792 4484 djvvv.exe 89 PID 4484 wrote to memory of 2792 4484 djvvv.exe 89 PID 4484 wrote to memory of 2792 4484 djvvv.exe 89 PID 2792 wrote to memory of 3252 2792 9xfffll.exe 90 PID 2792 wrote to memory of 3252 2792 9xfffll.exe 90 PID 2792 wrote to memory of 3252 2792 9xfffll.exe 90 PID 3252 wrote to memory of 3512 3252 hhhhnt.exe 91 PID 3252 wrote to memory of 3512 3252 hhhhnt.exe 91 PID 3252 wrote to memory of 3512 3252 hhhhnt.exe 91 PID 3512 wrote to memory of 828 3512 3bhbbb.exe 92 PID 3512 wrote to memory of 828 3512 3bhbbb.exe 92 PID 3512 wrote to memory of 828 3512 3bhbbb.exe 92 PID 828 wrote to memory of 4564 828 vdpjj.exe 93 PID 828 wrote to memory of 4564 828 vdpjj.exe 93 PID 828 wrote to memory of 4564 828 vdpjj.exe 93 PID 4564 wrote to memory of 3780 4564 ddjjj.exe 94 PID 4564 wrote to memory of 3780 4564 ddjjj.exe 94 PID 4564 wrote to memory of 3780 4564 ddjjj.exe 94 PID 3780 wrote to memory of 3328 3780 xflffff.exe 96 PID 3780 wrote to memory of 3328 3780 xflffff.exe 96 PID 3780 wrote to memory of 3328 3780 xflffff.exe 96 PID 3328 wrote to memory of 2400 3328 jpddp.exe 97 PID 3328 wrote to memory of 2400 3328 jpddp.exe 97 PID 3328 wrote to memory of 2400 3328 jpddp.exe 97 PID 2400 wrote to memory of 2756 2400 xfxxffr.exe 98 PID 2400 wrote to memory of 2756 2400 xfxxffr.exe 98 PID 2400 wrote to memory of 2756 2400 xfxxffr.exe 98 PID 2756 wrote to memory of 696 2756 rrrrrlf.exe 99 PID 2756 wrote to memory of 696 2756 rrrrrlf.exe 99 PID 2756 wrote to memory of 696 2756 rrrrrlf.exe 99 PID 696 wrote to memory of 3008 696 vdvpv.exe 100 PID 696 wrote to memory of 3008 696 vdvpv.exe 100 PID 696 wrote to memory of 3008 696 vdvpv.exe 100 PID 3008 wrote to memory of 4528 3008 lxxrxfr.exe 101 PID 3008 wrote to memory of 4528 3008 lxxrxfr.exe 101 PID 3008 wrote to memory of 4528 3008 lxxrxfr.exe 101 PID 4528 wrote to memory of 1984 4528 btntnt.exe 102 PID 4528 wrote to memory of 1984 4528 btntnt.exe 102 PID 4528 wrote to memory of 1984 4528 btntnt.exe 102 PID 1984 wrote to memory of 3652 1984 hbhhhh.exe 103 PID 1984 wrote to memory of 3652 1984 hbhhhh.exe 103 PID 1984 wrote to memory of 3652 1984 hbhhhh.exe 103 PID 3652 wrote to memory of 4420 3652 pjvdp.exe 104 PID 3652 wrote to memory of 4420 3652 pjvdp.exe 104 PID 3652 wrote to memory of 4420 3652 pjvdp.exe 104 PID 4420 wrote to memory of 944 4420 lxllllf.exe 105 PID 4420 wrote to memory of 944 4420 lxllllf.exe 105 PID 4420 wrote to memory of 944 4420 lxllllf.exe 105 PID 944 wrote to memory of 4348 944 bbbbtt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0b8602fa69521b6a56842bf54153bd20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\vvddd.exec:\vvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\dpdvp.exec:\dpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\fflffff.exec:\fflffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\hhbtbh.exec:\hhbtbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\djvvv.exec:\djvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\9xfffll.exec:\9xfffll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\hhhhnt.exec:\hhhhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\3bhbbb.exec:\3bhbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\vdpjj.exec:\vdpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\ddjjj.exec:\ddjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\xflffff.exec:\xflffff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\jpddp.exec:\jpddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\xfxxffr.exec:\xfxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\rrrrrlf.exec:\rrrrrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\vdvpv.exec:\vdvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\lxxrxfr.exec:\lxxrxfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\btntnt.exec:\btntnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\hbhhhh.exec:\hbhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pjvdp.exec:\pjvdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\lxllllf.exec:\lxllllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\bbbbtt.exec:\bbbbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\5fxrllf.exec:\5fxrllf.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\1hthhh.exec:\1hthhh.exe24⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ddvpj.exec:\ddvpj.exe25⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1hnhtn.exec:\1hnhtn.exe26⤵
- Executes dropped EXE
PID:4120 -
\??\c:\frxxrrr.exec:\frxxrrr.exe27⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ddvpj.exec:\ddvpj.exe28⤵
- Executes dropped EXE
PID:3456 -
\??\c:\xfrrlll.exec:\xfrrlll.exe29⤵
- Executes dropped EXE
PID:4424 -
\??\c:\vvdvp.exec:\vvdvp.exe30⤵
- Executes dropped EXE
PID:564 -
\??\c:\7bnhbb.exec:\7bnhbb.exe31⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9pvjv.exec:\9pvjv.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3ffxxxx.exec:\3ffxxxx.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\httttt.exec:\httttt.exe34⤵
- Executes dropped EXE
PID:4840 -
\??\c:\vpvpv.exec:\vpvpv.exe35⤵
- Executes dropped EXE
PID:4892 -
\??\c:\rlrlfrl.exec:\rlrlfrl.exe36⤵
- Executes dropped EXE
PID:744 -
\??\c:\tbhbtt.exec:\tbhbtt.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpvpj.exec:\jpvpj.exe38⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xffrrlx.exec:\xffrrlx.exe39⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jdpjj.exec:\jdpjj.exe40⤵
- Executes dropped EXE
PID:3272 -
\??\c:\frfxfxx.exec:\frfxfxx.exe41⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nnnnnh.exec:\nnnnnh.exe42⤵
- Executes dropped EXE
PID:4440 -
\??\c:\hhtnbh.exec:\hhtnbh.exe43⤵
- Executes dropped EXE
PID:860 -
\??\c:\9pvdv.exec:\9pvdv.exe44⤵
- Executes dropped EXE
PID:3640 -
\??\c:\rffffff.exec:\rffffff.exe45⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vpdvj.exec:\vpdvj.exe46⤵
- Executes dropped EXE
PID:900 -
\??\c:\vjpdv.exec:\vjpdv.exe47⤵
- Executes dropped EXE
PID:3252 -
\??\c:\1lrfrfr.exec:\1lrfrfr.exe48⤵
- Executes dropped EXE
PID:836 -
\??\c:\vpjpd.exec:\vpjpd.exe49⤵
- Executes dropped EXE
PID:4112 -
\??\c:\9pppj.exec:\9pppj.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\5thbtt.exec:\5thbtt.exe51⤵
- Executes dropped EXE
PID:968 -
\??\c:\jpvpd.exec:\jpvpd.exe52⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bbbtnh.exec:\bbbtnh.exe54⤵
- Executes dropped EXE
PID:1472 -
\??\c:\vddvj.exec:\vddvj.exe55⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lxllffx.exec:\lxllffx.exe56⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vdvpd.exec:\vdvpd.exe57⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xlrlxfx.exec:\xlrlxfx.exe58⤵
- Executes dropped EXE
PID:468 -
\??\c:\rffxrxx.exec:\rffxrxx.exe59⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bnbtnh.exec:\bnbtnh.exe60⤵
- Executes dropped EXE
PID:656 -
\??\c:\vdjdp.exec:\vdjdp.exe61⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jjpdv.exec:\jjpdv.exe62⤵
- Executes dropped EXE
PID:4528 -
\??\c:\xffxllf.exec:\xffxllf.exe63⤵
- Executes dropped EXE
PID:4648 -
\??\c:\tthbbb.exec:\tthbbb.exe64⤵
- Executes dropped EXE
PID:4852 -
\??\c:\rrxlrll.exec:\rrxlrll.exe65⤵
- Executes dropped EXE
PID:3568 -
\??\c:\btbtnt.exec:\btbtnt.exe66⤵PID:1648
-
\??\c:\dvdvv.exec:\dvdvv.exe67⤵PID:4264
-
\??\c:\vvvvj.exec:\vvvvj.exe68⤵PID:708
-
\??\c:\lxrlffx.exec:\lxrlffx.exe69⤵PID:1552
-
\??\c:\httnhh.exec:\httnhh.exe70⤵PID:5084
-
\??\c:\dvpjv.exec:\dvpjv.exe71⤵PID:2876
-
\??\c:\xflfxrl.exec:\xflfxrl.exe72⤵PID:3812
-
\??\c:\frlrlll.exec:\frlrlll.exe73⤵PID:4480
-
\??\c:\tbbbbn.exec:\tbbbbn.exe74⤵PID:3504
-
\??\c:\dvppd.exec:\dvppd.exe75⤵PID:2236
-
\??\c:\jpjjp.exec:\jpjjp.exe76⤵PID:3012
-
\??\c:\fflxrrl.exec:\fflxrrl.exe77⤵PID:4784
-
\??\c:\hbtnhb.exec:\hbtnhb.exe78⤵PID:4364
-
\??\c:\nbnhtn.exec:\nbnhtn.exe79⤵PID:2000
-
\??\c:\3pvpj.exec:\3pvpj.exe80⤵PID:4620
-
\??\c:\rxrllfl.exec:\rxrllfl.exe81⤵PID:348
-
\??\c:\nhnhhn.exec:\nhnhhn.exe82⤵PID:4368
-
\??\c:\dvdvd.exec:\dvdvd.exe83⤵PID:4428
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe84⤵PID:4440
-
\??\c:\tbhhbt.exec:\tbhhbt.exe85⤵PID:1992
-
\??\c:\dvdpj.exec:\dvdpj.exe86⤵PID:3608
-
\??\c:\xxllfll.exec:\xxllfll.exe87⤵PID:4652
-
\??\c:\htnbht.exec:\htnbht.exe88⤵PID:1168
-
\??\c:\dpjdv.exec:\dpjdv.exe89⤵PID:748
-
\??\c:\rxffrxl.exec:\rxffrxl.exe90⤵PID:1908
-
\??\c:\jvppj.exec:\jvppj.exe91⤵PID:1432
-
\??\c:\9djpp.exec:\9djpp.exe92⤵PID:2024
-
\??\c:\5lfxlff.exec:\5lfxlff.exe93⤵PID:4588
-
\??\c:\bbbbtn.exec:\bbbbtn.exe94⤵PID:4836
-
\??\c:\3jpjj.exec:\3jpjj.exe95⤵PID:3844
-
\??\c:\rfxllfx.exec:\rfxllfx.exe96⤵PID:2240
-
\??\c:\bnnhnb.exec:\bnnhnb.exe97⤵PID:2804
-
\??\c:\vjvjd.exec:\vjvjd.exe98⤵PID:2500
-
\??\c:\jdjdd.exec:\jdjdd.exe99⤵PID:4612
-
\??\c:\llfxrlf.exec:\llfxrlf.exe100⤵PID:696
-
\??\c:\nhttbb.exec:\nhttbb.exe101⤵PID:3008
-
\??\c:\vpjdv.exec:\vpjdv.exe102⤵PID:1592
-
\??\c:\llxrlxx.exec:\llxrlxx.exe103⤵PID:5008
-
\??\c:\tbthth.exec:\tbthth.exe104⤵PID:3448
-
\??\c:\ppjvp.exec:\ppjvp.exe105⤵PID:2316
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe106⤵PID:4464
-
\??\c:\nbhbbb.exec:\nbhbbb.exe107⤵PID:3568
-
\??\c:\hhtnbt.exec:\hhtnbt.exe108⤵PID:3604
-
\??\c:\pjppj.exec:\pjppj.exe109⤵PID:2504
-
\??\c:\xrxrfrx.exec:\xrxrfrx.exe110⤵PID:1820
-
\??\c:\nbtttt.exec:\nbtttt.exe111⤵PID:4180
-
\??\c:\nbbbtt.exec:\nbbbtt.exe112⤵PID:5084
-
\??\c:\jdppj.exec:\jdppj.exe113⤵PID:5016
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe114⤵PID:3456
-
\??\c:\tbtbhh.exec:\tbtbhh.exe115⤵PID:1028
-
\??\c:\tthbtn.exec:\tthbtn.exe116⤵PID:2364
-
\??\c:\dvjdv.exec:\dvjdv.exe117⤵PID:4764
-
\??\c:\fffxrll.exec:\fffxrll.exe118⤵PID:2724
-
\??\c:\3bttnn.exec:\3bttnn.exe119⤵PID:1932
-
\??\c:\btnnhb.exec:\btnnhb.exe120⤵PID:2076
-
\??\c:\jpvvp.exec:\jpvvp.exe121⤵PID:2000
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-